Adjoin Privacy Policy
Last updated 16 October 2026
Adjoin is a service of Delune Global FZE ("Adjoin", "we", "us"), a company registered in Ajman, United Arab Emirates, serving merchants worldwide. This policy explains what we store when you use adjoin.ae and the Adjoin MCP service, why we store it, who we share it with, and the choices you have. It is written to meet the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for people in the UK and EEA, the UK GDPR and EU GDPR.
1. What Adjoin does
Adjoin connects advertising and analytics accounts you own (Google Ads, Meta Ads, Google Analytics, Google Search Console and Microsoft Clarity) to AI assistants such as Claude and ChatGPT through a read-only Model Context Protocol (MCP) endpoint. When your AI assistant asks a question, Adjoin reads the relevant data from the platform using the access you granted and returns it to the assistant. Adjoin cannot change anything in your accounts.
2. What we store
Account data
Your email address, the sign-in method you used (email link, or a social login such as Google, Apple, Microsoft, GitHub, Notion or LinkedIn, from which we receive only your email address and the provider's user id), login records, dashboard preferences, and the billing status of your subscription.
Platform credentials
Access tokens, refresh tokens, developer tokens and API tokens you connect for Google Ads, Meta Ads and Microsoft Clarity. Each credential is encrypted with AES-256-GCM before it is written to our database; the encryption key lives only in our runtime environment, never in the database or in our code. Credentials are decrypted in memory for the duration of a single request and are never logged, never shown back to you, and never returned to an AI client. Google Analytics and Search Console do not involve a credential of yours: you grant our service account read access on your property, and we store only the property ids you register.
Account metadata
Non-secret information needed to show you connection health: account and property ids and names, currency and time zone, and the result and time of the last connection check.
AI client authorizations
When you connect Claude, ChatGPT or another MCP client, we store the client's registration details and hashed access and refresh tokens so the client can authenticate. You can revoke any client from the dashboard at any time.
Operational logs
For each tool call we log the tool name, your tenant id, latency and whether it succeeded, retained for 30 days. We do not log query contents, platform responses, or anything containing a token.
3. What we never do
- No write access. Adjoin registers read-only tools only. We cannot change campaigns, budgets, audiences or settings on any platform, and our codebase is tested to make sure no write tool exists.
- No selling of data. We do not sell, rent or share your data with advertisers, data brokers or anyone else for their own purposes.
- No training on merchant data. We do not use your platform data, queries or results to train AI models, including generalised or non-personalised models, and we do not provide it to anyone for that purpose.
- No retention of platform data. Data read from a platform is passed to your AI assistant and discarded. The only exception is a short in-memory cache (up to one hour) for Microsoft Clarity, which limits API requests to ten per day.
- No human access. Our staff do not read your platform data. The only exceptions are with your explicit consent for support, where required for security investigations or by law, and for internal operations where the data has been aggregated and anonymised.
4. Who processes data on our behalf
| Processor | Purpose | Location |
|---|---|---|
| Google Cloud (Cloud Run, Secret Manager, Cloud Build) | Hosting and runtime secrets | United States (us-central1) |
| Supabase | Database and sign-in (email link and social logins) | Project region (AWS) |
| Paddle.com Market Ltd | Merchant of record: payments, tax, invoicing, refunds | United Kingdom |
Your AI assistant provider (for example Anthropic for Claude or OpenAI for ChatGPT) receives the data your assistant requests, because you instructed it to ask. Their handling of that data is governed by your agreement with them. We share data with no one else, except where required by law.
5. Data we receive from Google and Meta
Adjoin accesses Google user data only to read the Google Ads accounts, Google Analytics properties and Search Console properties you connect, to display their names and connection health in your dashboard, and to answer requests your AI assistant makes on your behalf. For Google Ads we use the OAuth refresh token you provide with the adwords scope; for Google Analytics and Search Console we use the read-only analytics.readonly and webmasters.readonly scopes through a service account you have added as a Viewer. We do not use Google user data for advertising, for building profiles, or for any purpose other than providing the features you asked for. Adjoin's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is transferred only to the AI assistant you connected, at your instruction, and never to any other party.
Meta
Meta data is read with the ads_read permission only, through the system user token or Facebook Login you provide, to list your ad accounts, show their status in your dashboard and answer your AI assistant's requests. We do not post, message, manage pages or change ads, and we comply with the Meta Platform Terms and Developer Policies. You can revoke Adjoin's access at any time from Meta Business Settings or by disconnecting Meta Ads in your dashboard.
6. International transfers
Adjoin is operated from the UAE and hosted on Google Cloud in the United States. Where UK or EU personal data is transferred, we rely on the processors' standard contractual clauses and equivalent safeguards.
7. Retention, deletion and revoking access
Disconnecting a platform (Dashboard → Settings, or Connections → Disconnect) deletes the stored credentials and metadata for that platform immediately.
Deleting your account (Dashboard → Settings → Delete account) immediately and permanently removes your account, every stored credential, all AI client authorizations and your subscription record, and signs you out. If you cannot sign in, email admin@adjoin.ae from your account address and we will delete the account within 30 days and confirm by email. These are our data deletion instructions for all platforms, including Meta.
Revoking access on the platform side: Google Ads: remove Adjoin at myaccount.google.com/permissions or revoke the refresh token's OAuth client. Google Analytics and Search Console: remove the Adjoin service account from the property's users. Meta: remove the system user token or Adjoin's app in Business Settings. Clarity: delete the Data Export token in project settings. Any of these stops Adjoin reading that platform immediately.
Account data is kept while you have an account. Operational logs are kept for 30 days. Billing records are retained by Paddle as required by tax law.
8. Your rights
Depending on where you live, you have the right to access, correct, delete, restrict or export your personal data, and to object to certain processing. To exercise any right, email admin@adjoin.ae; we respond within 30 days. You may also complain to your supervisory authority (the UAE Data Office, the UK ICO, or your EU data protection authority).
9. Security
All traffic is encrypted in transit. Credentials are encrypted at rest with per-credential keys bound to your account. Runtime secrets are supplied from Google Secret Manager. Access to the MCP endpoint requires OAuth 2.1 with PKCE and short-lived tokens, and every query is scoped to the authenticated account. If we become aware of a breach affecting your data we will notify you and the relevant authorities as the law requires.
10. Cookies and local storage
We set strictly necessary cookies to keep you signed in to the dashboard and to protect forms, and preference cookies for your language and whether the setup card is shown. Your light or dark theme choice is kept in your browser's local storage. The website also loads Google Tag Manager, which may set analytics cookies (for example Google Analytics) to measure how the public site is used. Analytics cookies are not used inside the dashboard to read your ad data, and you can block them with your browser settings or an ad blocker without affecting the service.
11. Children
Adjoin is a business service for people aged 18 and over. We do not knowingly collect data from children.
12. Changes and contact
We will post changes here and update the date above; material changes are also announced in the dashboard. Questions and requests: admin@adjoin.ae. General support: team@adjoin.ae.
Delune Global FZE (Adjoin), Ajman, United Arab Emirates. UAE TRN: 105094949200001.