Privacy Policy

1. Introduction

JamunAI ("we", "us", "our") operates the JamunAI platform (the "Service"), a hosted Model Context Protocol (MCP) server and web dashboard that provides AI agents with tool access to manage advertising and marketing operations across Google Ads, Google Analytics 4, Google Tag Manager, Google Search Console, Google Merchant Center, Google PageSpeed Insights, Meta/Facebook Ads, and Facebook/Instagram Pages.

This Privacy Policy explains how we collect, use, store, process, share, and protect your personal information when you use the Service. It applies to free, trial, and paid subscribers and covers both the web dashboard and MCP API interface.

2. Information We Collect

2.1 Information You Provide to Us

When you create an account and use the Service, we collect account information received through Clerk, including your Clerk user ID, email address, first name, last name, and profile picture URL. We also collect OAuth credentials and scopes for connected Google and Meta accounts, selected advertising and analytics resources, API-key metadata, and support communications. OAuth tokens are encrypted at rest using AES-256-GCM. API keys are stored as SHA-256 hashes and shown in plaintext only once.

2.2 Competitor Intelligence Data

We collect search queries, advertiser watchlists, saved competitor advertisements, creative briefs, and publicly visible advertisement data used by the Ad Library and competitor-intelligence features. Watchlists and swipe-file content remain private to your account. We do not access non-public competitor data, performance metrics, or targeting information.

2.3 Information We Collect Automatically

We collect usage data, device and connection data, IP address, browser and operating-system information, MCP tool invocations, timestamps, error events, Clerk session cookies, and the sidebar preference cookie.

2.4 Information from Third-Party Platforms

With your authorization, we access advertising, analytics, tag-management, search-console, merchant-center, and page data from Google and Meta platforms. This data is accessed only while you use the Service and only to display information or execute MCP tools at your direction.

3. How We Use Your Information

We use information to authenticate users through Clerk, maintain sessions, operate and secure the Service, display advertising data, execute authorized MCP requests, manage accounts and API keys, provide two-phase write safety, maintain audit trails, support competitor intelligence, improve the Service, respond to support requests, send service communications, and prevent unauthorized access or abuse.

4. Legal Basis for Processing (GDPR)

For users in the EEA, our legal bases include contractual necessity, legitimate interests for security and service improvement, consent for connected-platform OAuth access, and legal obligations where applicable.

5. Data Storage and Security

Your data is stored in a Supabase PostgreSQL database hosted on AWS infrastructure, primarily in the United States. We use encryption at rest, TLS 1.2 or higher in transit, hashed API keys, server-side access controls, authenticated API routes, short-lived Google access tokens, and token-refresh protections.

5.1 Data Retention

Account information is retained while your account is active. Personal information is deleted or anonymized within 30 days after account deletion where applicable. OAuth tokens remain until disconnection or account deletion. Change plans expire after 24 hours unless applied or cancelled. Audit logs remain for the duration of the account, and usage logs may be retained for up to 90 days.

6. Data Sharing and Disclosure

We do not sell personal information. We share information only with providers that help operate the Service, including Clerk for authentication, Supabase for database hosting, Vercel for application hosting, Google Cloud Platform for certain Google API calls, and Apify or ScrapeCreators for publicly available competitor-ad retrieval. We may also disclose information when legally required or during a business transfer.

7. Your Rights and Choices

You may access, correct, export, or request deletion of your information through the dashboard or by contacting jamunaisupport@gmail.com. You may disconnect connected platforms, revoke API keys, withdraw OAuth consent, and control functional cookies through your browser. Marketing communications require consent and may be unsubscribed from at any time.

8. International Data Transfers

Information may be processed in the United States, India, and other countries where our providers operate. For transfers from the EEA or United Kingdom, we rely on appropriate safeguards including Standard Contractual Clauses where applicable.

9. Children’s Privacy

The Service is not directed to children under 18 or the applicable age of majority. We do not knowingly collect children’s personal information.

10. Third-Party Links and Services

The Service may link to Google, Meta, Clerk, Supabase, and other third-party services. Their privacy practices are governed by their own policies.

11. Changes to This Privacy Policy

We may update this policy periodically. Material changes may be communicated by email or through the Service. Continued use after an update constitutes acceptance of the revised policy.

12. California Privacy Rights (CCPA/CPRA)

California residents may request access, deletion, correction, information about collection and disclosure practices, and may opt out of the sale of personal information. We do not sell personal information. Contact jamunaisupport@gmail.com to exercise these rights.

13. Virginia, Colorado, Connecticut, and Utah Privacy Rights

Residents of these states may request access, correction, deletion, portability, and information about processing. We do not sell personal information, use it for targeted advertising, or engage in profiling that produces legal or similarly significant effects.