Privacy policy
Last updated 31 October 2026
This policy explains how Adpatch handles personal information and ad platform data. Adpatch is operated by Liam Gallagher in New Zealand ("we", "us"). We are responsible for personal information Adpatch holds under the New Zealand Privacy Act 2020. Contact: privacy@adpatch.co.
How Adpatch works
Adpatch connects an AI assistant (an "MCP client" such as Claude) to your ad accounts on platforms such as Meta. It can run in two ways:
- Local mode. You run the Adpatch program on your own computer. Your ad platform login is stored in a file on your computer, requests go straight from your computer to the ad platform, and nothing passes through servers we operate. We receive no data from local mode.
- Hosted service (not yet available). You sign in at app.adpatch.co, connect your ad accounts, and your assistant reaches Adpatch over the internet. The rest of this policy mostly describes the hosted service. We will update it before the hosted service opens.
What we collect and why
| Information | Why we need it |
|---|---|
| Your email address | To sign you in (by emailed link) and to contact you about your account or a security issue. |
| Ad platform access tokens, encrypted | To act on the ad accounts you connected, when your assistant asks. Encrypted with keys kept outside the database. |
| Which ad accounts and pages you connected | To show your connections and to refuse changes to accounts you did not connect. |
| A record of each change made through Adpatch | Security and support: the tool used, when, which ad objects it affected, and whether it succeeded. The full request is not stored, only a fingerprint of it. |
| Files you upload for ads (images, videos) | To pass them to the ad platform. Deleted within 24 hours. |
| Technical logs | To run and secure the service: request times, errors, and identifiers. Logs never contain access tokens. |
| Payment details (later, if paid plans are offered) | Handled by the payment provider; we would see only the plan, status and the last digits of the card. |
When your assistant asks for ad data (campaigns, performance numbers, audiences), Adpatch fetches it from the ad platform and passes it to your assistant. We do not keep that data, apart from brief caches of a few minutes used to avoid repeated requests.
Ad platform data
Data we receive from Meta and other ad platforms ("platform data") is used only to provide Adpatch to the person who connected the account, as they direct through their assistant. We do not:
- sell platform data or personal information,
- use it for advertising, profiling, or to build audiences,
- share it with anyone except as described in this policy, or
- use it to train AI models.
Your AI assistant
Information Adpatch returns to your assistant is then handled by the company that provides the assistant (for example Anthropic for Claude), under your agreement with them. Choose an assistant whose privacy terms you are comfortable with.
Who we share information with
We use these service providers to run the hosted service. Each only processes information to provide its service to us.
| Provider | Purpose | Where |
|---|---|---|
| Railway | Hosting the server and database | United States |
| Cloudflare | DNS, network protection, file uploads and encrypted backups | Global |
| An email delivery provider | Sending sign-in links | To be confirmed before launch |
| Sentry (if used) | Error reports, with tokens removed | United States |
| The ad platforms you connect (such as Meta) | Carrying out the reads and changes you ask for | Their own regions |
Some providers are outside New Zealand. We choose providers with security commitments comparable to New Zealand's privacy principles. We may also disclose information if required by law.
How long we keep it
- Ad platform tokens: until you disconnect the account, then deleted immediately. We also ask the platform to revoke them where it allows.
- Your account and everything under it: deleted within 30 days of you closing your account, or sooner on request.
- Uploaded files: deleted within 24 hours.
- Change records and logs: kept for up to 90 days.
- Encrypted database backups: kept for 30 days, so deleted data disappears from backups within 30 days.
Security
Access tokens are encrypted, never written to logs, and only decrypted while handling your request. Every change your assistant proposes is shown to you before it is made. If a breach is likely to cause serious harm, we will tell affected people and the Privacy Commissioner as the Privacy Act requires. To report a security issue, see Security.
Your rights
You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing privacy@adpatch.co. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner. If you are in the European Union or the United Kingdom, you also have rights under the GDPR, including objecting to processing and data portability.
To delete data connected through Facebook or Instagram, see Deleting your data.
This website
adpatch.co uses no cookies, analytics or tracking. Cloudflare, which serves the site, processes visitors' IP addresses to deliver pages and block attacks.
Changes
We will post changes here and update the date at the top. If a change materially affects how we use information you have already given us, we will email account holders before it takes effect.