Privacy policy

Who we are and what this service does

100mcp lets you connect your own marketing accounts — such as Google Analytics, Google Search Console, Google Ads and Bing Webmaster Tools — to an AI assistant, so you can ask questions about your own data in plain language. You stay in control of which accounts are connected and can disconnect any of them at any time.

What we store

• Your name, email address and Google account identifier, from signing in.
• An encrypted access key (an OAuth refresh token) for each tool you choose to connect.
• Your private connector URL.
• A log, kept for 90 days, of which tools were called and whether each call succeeded. This records the name of the tool and the time, never the content of your data.
• The names and identifiers of the websites, properties and advertising accounts each connected login can reach, so that a question about one of them is answered using the right login. This is a list of names, not the data inside them.
• A security log of actions taken on your account — signing in, connecting or disconnecting a tool, sharing access with a team member, deleting the account — recording the action, the time, your IP address and your browser. See Data retention for how long this is kept.

What we never store

We do not store your passwords, and we do not keep the reports returned by Google Analytics, Google Search Console, Google Ads, Google Business Profile, Bing Webmaster Tools or Microsoft Advertising. Those are fetched live each time you ask a question and passed straight back to you, not written to our database.

There is one deliberate exception. Google Trends data is public, identical for everyone and not tied to any account, so a Trends result is held in memory for up to six hours and reused for whoever asks next. This is what keeps Trends working for everybody rather than being rate-limited by Google; no Trends result is stored against your account.

Sharing with an AI assistant

When you add your connector URL to an AI assistant — such as Claude, made by Anthropic — and ask a question, the data needed to answer that question is transmitted to that assistant. This happens only when you add the URL and ask a question. That assistant is operated by a third party and handles the data under its own privacy policy, not ours.

Google user data

100mcp’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request read-only access wherever the API offers it, and we use Google user data solely to provide the features you ask for. We do not use it for advertising, we do not sell it, and we do not allow humans to read it except where you explicitly ask us to for support, where it is required by law, or where it is necessary for security purposes.

How we protect your access keys

Each access key is encrypted with its own AES-256 data key, which is itself encrypted by Google Cloud Key Management Service. Only encrypted values are written to our database. Access to production systems is restricted to the operator of the service.

Your choices

• Disconnect any tool from your dashboard, which deletes its stored access key and asks the provider to withdraw the access.
• Delete your account from the Account page. This removes your account record, your connections and access keys, your site list, your connector URLs and your call logs. Security-log entries are kept, with your name, IP address and browser removed from them — see below.
• Revoke our access directly at your Google account permissions page or in your Microsoft account settings.

Data retention

Access keys are kept until you disconnect the tool or delete your account. Call logs are deleted automatically after 90 days.

Security-log entries are kept after an account is deleted, because the question they exist to answer — what was done to this account, and when — can arrive long after the account is gone. What is kept is the shape of what happened, not who it happened to: when you delete your account, your name, IP address, browser and account identifier are stripped from those entries and only the action and its time remain.

When you delete your account we also ask Google to withdraw each connected login. If Google does not confirm that a login was withdrawn, we tell you so immediately rather than quietly assuming it worked, because from that point only you can remove the access from your Google account permissions page.

Children

This service is intended for business use and is not directed at children under 16.

Changes to this policy

If we change this policy we will update the date at the top of this page.

Contact us

For questions about this policy, or to request deletion of your data, email support@100mcp.com. We aim to reply within five working days.