Privacy policy

Operator

AdHatch is operated by Яремчук Александр, an individual based in Ukraine. Contact developer@adhatch.io for questions, access, correction or deletion. This policy covers adhatch.io, app.adhatch.io and the AdHatch API.

Data and purposes

We process your name, email, workspace membership and roles, plan, requests, business context, reports, materials and drafts. Authorized sources provide advertising accounts, campaigns, ads, costs and results; GA4 properties, aggregate metrics and key events; and Merchant Center accounts, products, statuses and issues. Necessary request, security and API-usage records are also processed.

Purposes are your selected reports, analysis, supported change preparation, support and security. Do not include unnecessary customer personal information in context or materials.

Google permissions

Each connection requires separate consent and resource selection. Google Ads permissions technically allow reading and managing advertising. GA4 reading and management are requested separately; editing supports key-event changes. The Merchant content scope includes reading and managing catalogues even when only reports are needed.

OAuth consent is not approval for arbitrary changes or advertising launch. Sending approved, supported changes requires a separate interface action by an authorized user.

AI and MCP

AdHatch has no built-in AI chat. Your connected ChatGPT, Claude, Codex or other MCP client can receive authorized data for your selected business and requests. Review that AI provider’s data policies and settings.

Source OAuth tokens are not returned to AI clients. Access to one business does not grant access to others. AdHatch does not use Google user data to train generalized AI/ML models, sell it or transfer it for third-party advertising targeting.

Providers and security

Saved data is processed in AdHatch infrastructure on Google Cloud. Vercel hosts the public website; WorkOS handles sign-in. These providers process data for hosting, authentication and security. Your selected AI client receives data when connected. Infrastructure may be outside your country.

Roles and explicit business assignments restrict access; OAuth tokens are stored encrypted. Authorized personnel may have limited access for support, security and confirmed requests. Absolute security cannot be guaranteed.

Retention and deletion

Data is retained while needed for selected features, decision history, security and obligations. Subscription expiry or disconnection does not automatically delete reports. Request access, correction, export or deletion of your own data at developer@adhatch.io.

We verify authority and scope before deletion and communicate the result separately. Where mandatory exceptions apply, we explain what remains and why. Live-database deletion is not immediate erasure from isolated backups; recovery must account for completed deletion requests.

Revocation and updates

Disconnect a source in AdHatch or revoke permission in Google Account or the provider’s settings. This does not delete provider data in Google Ads, GA4 or Merchant Center or pause campaigns.

AdHatch’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Before changing the purpose or scope of Google-data use, we update disclosures and obtain any required additional consent.