Privacy Policy
This Privacy Policy explains how Grindin AI ("Grindin AI", "we", "us") handles information when you use the Grindin AI MCP service at mcp.grindinai.com (the "Service"). The Service provides Model Context Protocol (MCP) servers that connect an AI client chosen by you to Google Search Console, Google Tag Manager and Meta Ads.
1. Controller and contact
The controller of personal data processed through the Service is Grindin AI. Contact: contact@grindinai.com.
2. Information we access
2.1 Account information
When you sign in with Google or Meta, we receive basic profile information that you authorize, such as your name, email address and account identifier. We use it to identify you, keep your connection linked to your account and contact you about the Service.
2.2 Authorization tokens
We store the OAuth access and refresh tokens issued by Google and Meta so that the Service can make API calls on your behalf. Tokens are encrypted at rest and are used only to perform requests that you initiate.
2.3 Data from connected services
The Service accesses only the data needed to perform the request you make through your AI client, within the permissions (scopes) you grant on the provider's consent screen.
| Service | Data accessed | Purpose |
|---|---|---|
| Google Search Console | Verified sites and properties, search analytics (queries, pages, clicks, impressions, CTR, position), sitemaps, URL inspection results | Answer your questions about search performance and indexing; submit sitemaps or inspect URLs when you ask |
| Google Tag Manager | Accounts, containers, workspaces, tags, triggers, variables, folders, versions and environments | List, audit, create, update, delete or publish Tag Manager configuration when you instruct it |
| Meta Ads | Ad accounts, campaigns, ad sets, ads, creatives and performance insights | Report on and analyze advertising performance when you ask |
2.4 Technical information
We keep limited operational logs (for example time of request, tool called, response status and error messages) for security, debugging and abuse prevention. Logs do not intentionally contain the content of API responses.
3. How we use information
- To provide the Service: to execute the requests you make through your AI client and return the results to that client.
- To keep the Service secure, prevent abuse and fix errors.
- To communicate with you about the Service, including changes to these terms.
- To comply with legal obligations.
We do not sell personal data or data from connected services, use it for advertising, build user profiles for third parties, or use it to train or improve AI or machine-learning models.
4. Google API Services User Data Policy
Grindin AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, data received from Google APIs is used only to provide and improve user-facing features of the Service that you request; it is not transferred to others except as needed to provide those features (namely to the AI client you choose), to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you; it is not used for serving advertisements; and no human reads it unless you give affirmative consent for specific data, it is necessary for security purposes (such as investigating abuse), it is required to comply with law, or the data is aggregated and anonymized for internal operations.
5. Data sent to AI platforms
The purpose of the Service is to return data from your connected accounts to the AI client you have connected (for example Claude by Anthropic, ChatGPT by OpenAI, Gemini by Google or another MCP client). When the Service returns a result, that data is processed by your AI provider under your agreement with that provider and its privacy policy, not this Policy.
Grindin AI does not control, and is not responsible for, how AI platforms process, store, retain or use data that you or the Service send to them, including whether they use it for model training. Review your AI provider's settings and terms before connecting the Service, and do not request data that you are not permitted to share with your AI provider.
6. Sharing
We share information only:
- with the AI client you connect, as described in section 5, at your direction;
- with Google and Meta, when we call their APIs on your behalf;
- with service providers that host and operate the Service on our behalf (such as Cloudflare and Google Cloud), bound by data processing terms;
- when required by law, court order or to protect rights, safety and security; and
- in connection with a merger, acquisition or sale of assets, with notice to you.
7. Retention
- Data from connected services is processed in memory to answer your request and is not stored persistently by the Service, except short-lived caching where needed for performance.
- OAuth tokens and account information are kept while your connection is active and deleted within 30 days after you disconnect, revoke access or request deletion.
- Operational logs are kept for up to 90 days, unless a longer period is needed to investigate a security incident or comply with law.
8. Revoking access and deleting your data
You can stop the Service from accessing your accounts at any time:
- Google: remove "Grindin AI" at myaccount.google.com/permissions.
- Meta: in Facebook, go to Settings & privacy → Settings → Business Integrations and remove the app.
- Your AI client: remove the Grindin AI MCP connector in the client's settings.
To request deletion of all data we hold about you, email contact@grindinai.com with the subject "Data deletion" from the email address linked to your account. We complete deletion within 30 days and confirm by email. Deleting data held by Grindin AI does not delete data already held by your AI provider, Google or Meta.
9. Legal bases (EU/EEA and UK)
We process personal data on the basis of performing our contract with you (providing the Service), our legitimate interests (security, abuse prevention, improving reliability), your consent where we ask for it (such as OAuth authorization, which you can withdraw at any time), and legal obligations.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability and to withdraw consent. Contact us to exercise these rights. You may also lodge a complaint with a supervisory authority; in Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi).
11. International transfers
Our service providers and your chosen AI provider may process data outside the EU/EEA. Where we transfer personal data outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.
12. Security
We use encryption in transit (TLS) and at rest for stored tokens, access controls and least-privilege permissions. No system is completely secure, and we cannot guarantee absolute security of information transmitted over the internet or to third-party platforms.
13. Children
The Service is intended for business and professional use and is not directed to anyone under 18. We do not knowingly collect data from children.
14. Changes
We may update this Policy. We will post the new version on this page with a new effective date and, for material changes, notify you by email or in the Service.
15. Contact
Grindin AI · contact@grindinai.com