Adjoin Privacy Policy
Draft for review · Last updated 15 October 2026
Adjoin ("Adjoin", "we", "us") is operated from Dubai, United Arab Emirates, and serves merchants worldwide. This policy explains what we store when you use adjoin.ae and the Adjoin MCP service, why we store it, and the choices you have. It is written to meet the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for people in the UK and EEA, the UK GDPR and EU GDPR.
1. What Adjoin does
Adjoin connects advertising and analytics accounts you own (Google Ads, Meta Ads, Microsoft Clarity, and in future Google Analytics and Google Search Console) to AI assistants such as Claude and ChatGPT through a read-only Model Context Protocol (MCP) endpoint. When your AI assistant asks a question, Adjoin reads the relevant data from the platform using credentials you provided and returns it to the assistant.
2. What we store
Account data
Your email address, login records, and the billing status of your subscription.
Platform credentials
Access tokens, refresh tokens, developer tokens and API tokens you connect. Each credential is encrypted with AES-256-GCM before it is written to our database; the encryption key lives only in our runtime environment, never in the database or in our code. Credentials are decrypted in memory for the duration of a single request and are never logged, never shown back to you, and never returned to an AI client.
Account metadata
Non-secret information needed to show you connection health: account ids, account names, currency and time zone, the result and time of the last connection check.
AI client authorizations
When you connect Claude, ChatGPT or another MCP client, we store the client's registration details and hashed access and refresh tokens so the client can authenticate. You can revoke any client from the dashboard.
Operational logs
For each tool call we log the tool name, your tenant id, latency and whether it succeeded. We do not log query contents, platform responses, or anything containing a token.
3. What we never do
- No write access. Adjoin registers read-only tools only. We cannot change campaigns, budgets, audiences or settings on any platform, and our codebase is tested to make sure no write tool exists.
- No selling of data. We do not sell, rent or share your data with advertisers or data brokers.
- No training on merchant data. We do not use your platform data, queries or results to train AI models, and we do not provide it to anyone for that purpose.
- No retention of platform data. Data read from a platform is passed to your AI assistant and discarded. The only exception is a short in-memory cache (up to one hour) for Microsoft Clarity, which limits API requests to ten per day.
4. Who processes data on our behalf
| Processor | Purpose | Location |
|---|---|---|
| Google Cloud (Cloud Run, Secret Manager, Cloud Build) | Hosting and runtime secrets | United States (us-central1) |
| Supabase | Database and login (magic link, Google sign-in) | As selected for the project |
| Paddle.com Market Ltd | Merchant of record: payments, tax, invoicing | United Kingdom |
Your AI assistant provider (for example Anthropic for Claude or OpenAI for ChatGPT) receives the data your assistant requests. Their handling of that data is governed by your agreement with them.
5. Data we receive from platforms
Google user data is used only to read the Google Ads, Google Analytics and Search Console accounts you connect, to display their names and health in your dashboard, and to answer requests your AI assistant makes on your behalf. Adjoin's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Meta data is read with the ads_read permission only, for the same purposes.
6. International transfers
Adjoin is operated from the UAE and hosted on Google Cloud in the United States. Where UK or EU personal data is transferred, we rely on the processors' standard contractual clauses and equivalent safeguards.
7. Retention and deletion
Credentials and metadata are kept while the connection exists and are deleted immediately when you disconnect a platform. Account data is kept while you have an account. You can delete your account and all associated data by emailing privacy@adjoin.ae; we complete deletion within 30 days and confirm by email. Billing records are retained by Paddle as required by tax law.
8. Your rights
Depending on where you live, you have the right to access, correct, delete, restrict or export your personal data, and to object to certain processing. To exercise any right, email privacy@adjoin.ae. You may also complain to your supervisory authority (the UAE Data Office, the UK ICO, or your EU data protection authority).
9. Security
All traffic is encrypted in transit. Credentials are encrypted at rest with per-credential keys bound to your account. Runtime secrets are supplied from Google Secret Manager. Access to the MCP endpoint requires OAuth 2.1 with PKCE and short-lived tokens. Every query is scoped to the authenticated account.
10. Cookies
We set one strictly necessary cookie to keep you logged in to the dashboard. The website also loads Google Tag Manager, which may set analytics cookies (for example Google Analytics) to measure how the site is used. These are not used inside the dashboard to read your ad data, and you can block them with your browser settings or an ad blocker without affecting the service.
11. Changes and contact
We will post changes here and update the date above. Questions: privacy@adjoin.ae. Adjoin, Dubai, United Arab Emirates.