Effective date: August 12, 2026

Also see our Terms of Service.

1. Who we are#

This Privacy Policy explains how Kovacs Software Solutions (“we,” “us,” or “our”) collects, uses, and shares information when you use AdPilot MCP (the “Service”).

Contact: support@kovacssoftware.com.

2. Information we collect#

We may collect:

• Account information — such as name, email address, password (hashed), and security settings (for example two-factor authentication or passkeys).
• Waitlist information — name and email if you join a waitlist before registration is open.
• Workspace and product data — apps, strategy profiles (including protected terms and goals), operation limits, operations, change history, skills configuration, and related audit records.
• Connected advertising and monetization data — Apple Ads connection material (including client, team, and key identifiers and private signing credentials we store encrypted), scoped API access tokens, synced campaign, ad group, keyword, search-term, and performance metrics; RevenueCat API keys and revenue or subscriber metrics used for profitability analysis.
• MCP and client data — OAuth client registrations, authorizations, and redacted tool-call or activity logs related to AI clients you connect.
• In-app assist prompts — when you use optional strategy-assist features, prompts and related context may be processed to generate suggestions.
• Scheduled report data — when enabled, the report prompt, relevant workspace context, generated report, delivery status, model/provider metadata, token usage, and estimated cost records needed to deliver and audit the report.
• Usage and technical data — such as IP address, device/browser information, timestamps, pages viewed, and diagnostic or error logs.
• Cookies and similar technologies — session cookies for authentication, and preferences such as appearance settings.
• Payment-related data — if you purchase a paid plan, our designated payment provider processes payment details. We typically receive order or subscription metadata needed to manage entitlements, not full card numbers.

3. How we use information#

We use information to:

• Provide, operate, secure, and improve the Service
• Sync and store advertising and monetization data from providers you connect
• Power MCP tools and resources for AI clients you authorize
• Execute requested operations, enforce limits and correctness rules, retain audit records, and support rollback
• Manage accounts, workspaces, plan entitlements, and (when available) purchases
• Send transactional or service-related communications (for example connection issues or support replies)
• Detect abuse, prevent fraud, and comply with law

We do not sell your personal information. We do not use your advertising account data, API credentials, or other User Content to advertise to you or to others.

4. Artificial intelligence processing#

When you authorize an AI client via MCP, you direct us to provide that client with the workspace context and tool results necessary to fulfill requests made through it. Depending on the request, those results may include Apple Ads campaign names, settings, bids, budgets, keywords, search terms, spend, impressions, taps, installs, and other reporting metrics, together with AdPilot analyses and RevenueCat data. We limit MCP responses to the workspace, permissions, and tool request associated with the authorization and do not use one customer’s connected data to answer another customer’s requests.

Your AI client and its provider may process, transmit, retain, or use prompts and MCP tool results under their own terms, privacy policy, account type, and data-control settings. For interactive MCP use, you select and authorize the client; AdPilot does not choose the provider on your behalf. Review that provider’s controls before sending connected data, and revoke clients you no longer trust. Revoking a client from AdPilot prevents future authorized access but does not delete information already received or retained by that client or its provider.

We do not send your Apple Account password, two-factor authentication code, recovery credential, Apple Ads private signing key, client secret, or Apple Ads access token to an MCP client or AI provider as part of a tool result. Those credentials are used by AdPilot to authenticate directly with the connected provider and are excluded from MCP responses and redacted from relevant audit data.

Optional in-app strategy assist and scheduled email reports may send prompts and relevant workspace context to language-model providers configured by us to generate the requested output. Scheduled reports are recommendation-only and do not mutate Apple Ads; direct MCP operations are separate user-requested actions. For these AdPilot-operated features, we select and configure the applicable model provider and use the information only to provide, secure, and audit the feature as described in this Policy.

We do not train our own machine-learning models on your advertising account data, API credentials, or other User Content.

AI providers and the AI clients you choose process data under their own terms and privacy policies. We do not control their independent retention or model-training practices beyond what we configure or contract for. AI Output can be inaccurate; see our Terms of Service for important limitations.

5. Legal bases (where applicable)#

If laws such as the GDPR apply, we process personal data where necessary to perform our contract with you, to pursue legitimate interests (such as securing and improving the Service) in a way that does not override your rights, to comply with legal obligations, or with your consent where required.

6. How we share information#

We share information only as needed to operate the Service or as required by law, including with:

• Service providers — hosting, infrastructure, email delivery, and configured language-model providers for in-app assist and scheduled report generation
• Integration partners you connect — Apple (Apple Ads APIs) and RevenueCat, to sync data and perform actions you authorize
• AI clients you authorize — MCP clients such as ChatGPT, Claude, Cursor, or Codex, and the providers operating them, which receive the workspace context and tool results you request, potentially including Apple Ads reporting metrics and RevenueCat data
• Payment providers — when paid billing is enabled, to process purchases and manage entitlements
• Professional advisors — such as lawyers or accountants, under confidentiality where appropriate
• Authorities — when we believe disclosure is required by law, legal process, or to protect rights, safety, or security
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards

We do not share your advertising account data for advertising or data-broker purposes.

7. Retention#

We retain account and Service data while your account is active and as needed to provide the Service, resolve disputes, enforce agreements, and meet legal obligations. When you disconnect integrations, delete apps or workspaces, or delete your account through available Service features, we delete or anonymize associated content in line with our technical processes, except where retention is required by law or for legitimate security and accounting purposes (for example billing or audit records).

8. Security#

We implement reasonable technical and organizational measures designed to protect information, including encrypting sensitive Apple Ads private keys at rest, scoping access through workspace and Apple-side permissions, redacting credentials from relevant audit data, and not exposing private signing keys, client secrets, or access tokens through the MCP interface. Apple Account passwords, two-factor authentication codes, and recovery credentials are not required for the Apple Ads connection. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International transfers#

The Service is offered worldwide. Your information may be processed in countries other than your own, including where our providers operate. Where required, we rely on appropriate transfer mechanisms or contractual safeguards.

10. Your rights#

Depending on your location, you may have rights to access, correct, delete, or export personal data, to object to or restrict certain processing, or to withdraw consent where processing is consent-based. To exercise these rights, email support@kovacssoftware.com. We may need to verify your request. You may also have the right to lodge a complaint with a supervisory authority.

11. Children#

The Service is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

12. Changes#

We may update this Privacy Policy from time to time. The “Effective date” at the top will change when we do. Material changes may be communicated through the Service or by email where appropriate. Continued use after an update means you acknowledge the revised Policy.

13. Contact#

Privacy questions: support@kovacssoftware.com.