Privacy Policy

1. Introduction

This Privacy Policy explains how BrainMine Web Solutions Pvt. Ltd. ("BrainMine", "we", "us") collects, uses, stores and shares information when you use the BrainMine Campaign Platform at https://campaign.brainmine.ai (the "Platform").

It applies to the Platform's web dashboard, its application programming interfaces, and its Model Context Protocol (MCP) interface. By creating an account or connecting an advertising account, you agree to the practices described here. If you do not agree, please do not use the Platform.

2. About BrainMine Campaign Platform

The Platform is a multi-channel advertising intelligence service. It connects to advertising and analytics accounts that you authorise, retrieves reporting data from them, and presents that data as dashboards, reports, summaries and insights.

The Platform supports connections to Google Ads, Google Analytics 4, Google Search Console, Meta Ads and LinkedIn Ads. It also exposes an MCP interface so that an AI client you choose, such as Claude, can request the reporting data your account is authorised to see.

The Platform is operated as a multi-tenant service. Each user belongs to an organisation, and access to connected accounts and advertising data is scoped to that organisation.

3. Information We Collect

We collect the following categories of information:

• Account information you provide when registering, or that Google provides when you sign in with Google.
• Authorisation credentials for the advertising and analytics accounts you connect, stored in encrypted form.
• Advertising and analytics data retrieved from those connected accounts under the permissions you granted.
• Usage and audit records, including which actions were taken in the Platform, by which user, at what time, and from which IP address and browser user agent.
• Technical information necessary to operate the service, such as request logs and error diagnostics.

We do not ask for, and the Platform does not require, payment card details, government identifiers, or special categories of personal data.

4. Account and Authentication Information

When you register with an email address and password, we store your email address, your name, your role within your organisation, and a cryptographic hash of your password. We do not store your password itself and cannot recover it.

When you sign in with Google, we receive your Google account's email address, your name as reported by Google, and whether Google has verified that email address. We use this to identify you and to create or match your Platform account. We do not receive or store your Google password.

We record sign-in events, password changes, account connections and disconnections in an audit log, together with the time, the acting user, the organisation, and the originating IP address and user agent. These records support security review and troubleshooting.

5. Google Account and Google Ads Data

Identity

If you sign in with Google, we receive identity information through Google OAuth 2.0 under the openid, email and profile scopes: your email address, your name, and your email verification status.

Google Ads

If you connect Google Ads, you authorise the Platform through Google OAuth 2.0 to access the Google Ads accounts available to the Google identity you used. Depending on what that identity can reach, the Platform may retrieve:

• customer and account identifiers, including manager (MCC) relationships
• account names, currency codes and time zones
• campaigns, ad groups and ads
• impressions, clicks and click-through rate
• spend and cost metrics, including cost per click and cost per thousand impressions
• conversions, conversion value, return on ad spend and cost per acquisition
• keyword and search term reporting
• other reporting information available through the authorised Google Ads API scopes

The Platform stores daily snapshots of this reporting data so that dashboards, trends and scheduled reports can be produced without re-querying Google for every view.

6. Other Connected Advertising Platforms

Where you connect them, the Platform retrieves comparable reporting information from other providers under the permissions you grant:

• Google Analytics 4 — read-only analytics reporting.
• Google Search Console — read-only search performance data, including clicks, impressions, click-through rate and average position.
• Meta Ads — advertising account, campaign and insights data.
• LinkedIn Ads — advertising account, campaign and reporting data.

Each connection is separate. Connecting one provider does not grant the Platform access to any other, and you may connect only the providers you need.

7. How We Use Information

We use the information described above to:

• authenticate you and maintain your session
• establish which advertising accounts your organisation is authorised to access
• retrieve, store and display advertising and analytics reporting data
• generate dashboards, reports, summaries and performance insights
• carry out campaign management actions you explicitly request
• respond to requests from an AI client you have connected through MCP
• operate, secure, monitor and troubleshoot the Platform
• maintain audit records and meet legal and contractual obligations

We do not use your connected advertising data for advertising to you, and we do not sell it.

8. Monitoring, Reporting and Analytics

The Platform runs scheduled background jobs that refresh reporting data from your connected accounts, keep authorisation tokens current, and produce recurring reports. These jobs operate only on accounts your organisation has connected, and only with the permissions you granted.

Reporting data is aggregated into dashboards and summaries within your organisation. Analytics are produced for your own accounts; we do not pool your advertising data with other customers' data to build cross-customer benchmarks or market datasets.

9. MCP and AI Client Access

The Platform provides a Model Context Protocol interface so that an AI client you choose can request your reporting data in conversation. Access follows this path:

Before any request is served, the MCP client must complete an OAuth authorisation against your BrainMine account. Every request is then checked against the organisation the authenticated user belongs to.

The AI client never receives:

• Google OAuth client secrets
• access tokens or refresh tokens for your connected accounts
• developer tokens or other provider credentials
• database credentials
• internal encryption keys

The AI client does not call Google Ads, Meta, LinkedIn or any other provider directly. It communicates only with the BrainMine MCP service, which performs the provider calls itself and returns only the data your organisation is authorised to receive for the functionality requested.

The AI client you connect is operated by a third party under its own terms and privacy policy. What that provider does with the content of your conversation, including any reporting data returned to it, is governed by that provider's policies rather than this one. We encourage you to review them before connecting a client.

10. How We Share Information

We do not sell your connected advertising data to third parties. We do not share it publicly, and we do not disclose it to other customers of the Platform.

We share information only in these circumstances:

• Within your organisation. Users in your organisation can see the connected accounts and reporting data belonging to that organisation, subject to their role.
• With the advertising platforms you connect. Requests the Platform makes on your behalf are sent to those providers' APIs.
• With an AI/MCP client you connect, limited to the data your organisation is authorised to receive, as described in section 9.
• With service providers necessary to operate the Platform, such as server hosting, database and supporting infrastructure services. These providers process data on our behalf in order to run the service.
• Where required by law, or to establish, exercise or defend legal claims, or to protect the rights, safety and security of users, the public or the Platform.
• In a corporate transaction, such as a merger or acquisition, where information may transfer as a business asset. We would remain bound by the commitments in this policy or give you notice of any material change.

11. Google API / Connected Account Data

The Platform's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Specifically:

• We use Google user data only to provide and improve the features you have authorised, as described in sections 5, 7, 8 and 9.
• We do not transfer Google user data to third parties except as necessary to provide and improve those features, to comply with applicable law, or as part of a merger or acquisition.
• We do not use Google user data for serving advertisements.
• We do not allow humans to read Google user data unless we have your explicit consent for specific data, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymised.
• We do not sell Google user data.

The same commitments apply to data retrieved from Meta Ads, LinkedIn Ads, Google Analytics 4 and Google Search Console.

12. Data Storage and Security

The Platform runs on private server infrastructure under our control. We maintain the following technical and organisational controls:

• All traffic to the Platform is served over HTTPS with TLS.
• Connections to advertising providers use OAuth 2.0; we never ask for or store your password for a connected provider.
• OAuth access and refresh tokens are encrypted before being written to the database and are decrypted only server-side when a request requires them.
• Provider credentials, developer tokens and encryption keys are held server-side in the application environment and are never sent to a browser or an AI client.
• Passwords are stored only as cryptographic hashes.
• Every data query is scoped to the authenticated user's organisation, enforced in the application's data access layer rather than by the interface alone.
• Requests for a specific advertising account are checked against the accounts that organisation has actually connected, and refused otherwise.
• Role-based access control governs which users may read data, take campaign management actions, or manage connections.
• Administrative access to servers and databases is restricted to authorised personnel.
• The Platform writes an append-only audit log of significant actions, and operational logging and monitoring are in place for security and reliability.
• Application configuration and secrets are supplied through the server environment and are excluded from version control.

No system can be guaranteed completely secure. We work to protect your information but cannot warrant absolute security. We hold no formal security certification at this time, and this policy makes no such claim.

13. Data Retention

We retain information for as long as it is necessary to provide the Platform to you and to meet the purposes described in this policy — in particular to:

• operate your account and your organisation's connections
• produce the historical reporting and trends the Platform is designed to show
• maintain the security and integrity of the service
• keep accurate business and audit records
• comply with legal, tax and regulatory obligations
• resolve disputes and enforce our agreements

Retention periods therefore vary by data type and circumstance. Audit records are kept as append-only entries for security and accountability. When you disconnect a connected account, the stored authorisation credentials for that connection are invalidated as described in section 14.

14. Account Disconnection and Revocation

You can end the Platform's access to a connected advertising account in two ways.

Disconnect within the Platform

Each connected account in the Platform has a Disconnect control. When you use it, the Platform marks the connection inactive and destroys the stored encrypted access and refresh tokens for it. The disconnection is recorded in the audit log. Once disconnected, the account is no longer available to the dashboard, to scheduled jobs, or through the MCP interface.

For Google, the Platform asks Google to revoke the authorisation. For Meta and LinkedIn, the Platform destroys its stored credentials but does not currently call those providers' revocation endpoints, so you should also remove access in your Meta or LinkedIn account settings.

Revoke directly with Google

You can also revoke the Platform's access from your Google Account at any time, under Third-party apps & services. Revoking there ends the Platform's ability to retrieve new data from Google on your behalf. Reporting data already stored by the Platform is handled according to sections 13 and 15.

15. Data Deletion Requests

You may request deletion of your Platform account and of the data associated with it by contacting us at info@brainminetech.com from the email address registered to your account, or by asking an administrator of your organisation to make the request on its behalf.

We will verify the request, confirm what will be deleted, and act on it within a reasonable period. We may retain limited information where we have a legitimate or legal basis to do so — for example audit and security records, records needed to comply with legal obligations, or information required to resolve a dispute or enforce an agreement. We will tell you if that applies to your request.

16. User Rights and Choices

Depending on where you live, you may have rights to:

• access the personal information we hold about you
• have inaccurate information corrected
• have information deleted, subject to the limits in section 15
• object to or restrict certain processing
• receive a copy of certain information in a portable form
• withdraw consent where processing relies on it, without affecting processing already carried out

Independently of those rights, you can always change your password in the Platform, disconnect any connected advertising account, revoke access at the provider, or ask us to close your account.

To exercise any of these, contact info@brainminetech.com. We may need to verify your identity before acting.

17. Third-Party Services

The Platform interoperates with services operated by others, including Google (Google OAuth, Google Ads, Google Analytics 4 and Google Search Console), Meta, LinkedIn, and any AI/MCP client you choose to connect. We also rely on hosting and infrastructure providers to run the service.

Those services are governed by their own terms and privacy policies, not by this one. We do not control how they handle information you give them directly, and we recommend reviewing their policies. Links in this policy to third-party sites are provided for convenience and are not endorsements.

18. Children's Privacy

The Platform is a business tool intended for use by adults in a professional capacity. It is not directed to children, and we do not knowingly collect personal information from anyone under the age of 18. If you believe a child has provided us with personal information, contact info@brainminetech.com and we will take reasonable steps to delete it.

19. International Data Processing

BrainMine Web Solutions Pvt. Ltd. is established in India. Information you provide, and data retrieved from your connected accounts, may be processed and stored in India and in other jurisdictions where BrainMine or its infrastructure and service providers operate.

Data protection laws in those jurisdictions may differ from those where you live. Where we transfer personal information internationally, we take steps appropriate to the transfer to keep it protected and handled in line with this policy. By using the Platform, you understand that your information may be processed outside your country of residence.

20. Changes to This Privacy Policy

We may update this policy to reflect changes to the Platform, to our practices, or to legal requirements. When we do, we will revise the effective date at the top of this page and publish the updated policy at this address.

If a change materially affects how we handle your information, we will take reasonable steps to notify you, for example by email to the address on your account or by a notice within the Platform. Continuing to use the Platform after an update takes effect means you accept the revised policy.

21. Contact Us

For questions about this policy, about how your information is handled, or to exercise any of the rights described above, please contact us.

BrainMine Web Solutions Pvt. Ltd.
BrainMine Campaign Platform
Email: info@brainminetech.com
Website: https://campaign.brainmine.ai

We aim to respond to privacy enquiries within a reasonable period of receiving them.