Privacy policy

1. Who We Are and Scope

AdMesh, Inc., a Delaware corporation ("AdMesh," "we," "us," or "our"), provides advertising infrastructure that connects advertisers with opportunities in AI conversations and other channels through brand agents, real-time offers, and auctions. This Privacy Policy describes how we collect, use, disclose, and retain personal information through our websites, platform, APIs, SDKs, browser extension, and related services (collectively, the "Services").

This Policy applies to account holders, business contacts, website visitors, and individuals whose information reaches AdMesh through an AI platform, publisher, agent, application, or other integration. It describes our data practices; it does not replace notices provided by the platform or property you use.

1.1 Processing for Our Own Purposes

AdMesh acts as a controller or business where we determine the purposes and means of processing, including account administration, billing, security, fraud prevention, legal compliance, and management of our business relationships. The applicable role depends on the processing activity and the law that applies.

1.2 Processing on a Customer's Behalf

Where we process personal information on a customer's behalf to provide the Services, we act as a processor or service provider under the applicable agreement and Data Processing Addendum ("DPA"). The customer is responsible for its collection of data, instructions, notices, and required permissions. The applicable DPA governs that processing and controls over conflicting provisions of this Policy regarding Customer Personal Data.

2. Information We Collect and Its Sources

The information we receive depends on the Services used, the integration configuration, and the data submitted. We collect information directly from you, automatically through use of the Services, and from customers, authorized integrations, payment providers, and connected services.

2.1 Account and Business Information

• Names, email addresses, business contact details, account identifiers, roles, and access permissions;
• Organization details, brand profiles, product information, logos, offer content, and brand-agent settings;
• Billing and payment records, prepaid balances, invoices, transaction identifiers, and applicable tax information; and
• Support requests, correspondence, feedback, and records of account or integration activity.

2.2 Queries and Contextual Inputs

We receive queries and relevant context from services that integrate with AdMesh to provide recommendations and conduct real-time advertising auctions. Queries may contain personal information included in the submitted text. The service sending the information is responsible for providing required privacy notices, obtaining consent where required, and limiting submissions to information necessary for the requested Services. Our processing and redaction practices are described in Section 3.

2.3 Advertising and Attribution Information

We collect information about offers, bids, auction results, sponsored recommendations, exposures, clicks, and conversions to measure advertising activity and attribute results. This may include when an activity occurred, the account or platform involved, and relevant referral or landing-page information. We may link these records to the related query, auction, recommendation, or transaction.

2.4 Technical and Usage Information

We and our service providers collect technical information, such as your IP address, browser and device details, pages visited, session activity, request and security logs, cookie identifiers, and saved preferences. We use this information to operate and secure the Services, prevent fraud, troubleshoot problems, understand usage, and measure advertising and attribution where applicable.

2.5 Connected Services

When an authorized user connects a third-party service, we receive the information and credentials needed for the requested integration, within the permissions granted. Google-specific access, use, security, and disconnection practices are described in Section 14.

2.6 Publisher Content and Assistant Interactions

When a publisher enables content indexing or a Publisher Assistant, we receive authorized source material, such as article text, page URLs, titles, and related metadata, to support retrieval, answers, and citations. Material submitted or made available for indexing may contain personal information. Depending on the integration and feature, we also receive assistant questions, relevant conversational context, feedback, session or property identifiers, and recommendation events. An AI platform using its own assistant may submit selected context through an API or SDK; the information received depends on what that integration sends.

Publishers and AI platform operators must limit submitted information to what is needed, have permission to use the sources they provide, and explain the integration in their own privacy notices. The additional AI Platform & Publisher Terms describe these responsibilities.

3. Query Processing, Redaction, and Storage

3.1 Processing the Submitted Query

AdMesh receives and analyzes submitted queries and relevant context to identify intent, evaluate offer relevance, and operate recommendations and real-time auctions. Depending on the requested feature, processing may involve service providers supporting intent analysis or content generation. The storage redaction described below operates separately from this processing and does not mean that the original query is redacted before it is used to provide the Services or transmitted to a provider for that purpose.

3.2 Redaction Before Storing a Query Copy

AdMesh may retain query content and related service records as necessary to operate the Services, support attribution and measurement, resolve technical issues, and prevent fraud and abuse. Retention does not depend on whether a recommendation is provided and is subject to applicable law, the applicable agreement, any applicable Data Processing Addendum, and the retention practices in Section 9.

For supported AI-platform submissions, AdMesh applies automated redaction measures before retaining query copies to reduce personal information. These measures do not guarantee complete removal, and retained content may still contain personal information, as described in Section 3.3.

3.3 Limits of Automated Redaction

Automated redaction is a best-effort safeguard. Detection varies by language, format, and context and may miss personal information, confidential material, or sensitive disclosures. Language-based detection currently focuses on English, while pattern matching may identify certain information in other languages. A processed query may still contain personal information; redaction does not necessarily make it anonymous.

Optional SDK sanitization tools can help integrators minimize information before transmission. Their availability or use does not replace the integrator's duties or AdMesh's obligations under applicable law and the applicable DPA.

3.4 AI Providers and Content Use

Depending on the requested feature, relevant content and context may be processed by AI and infrastructure providers supporting retrieval, intent analysis, answer generation, and sponsored recommendations. The applicable agreement and DPA govern processing on a customer's behalf, including authorized purposes, provider obligations, retention, and deletion. Do not assume that content described as redacted is anonymous or that every provider receives only a redacted query.

Permission to index publisher content and operate an assistant does not, by itself, grant unrestricted permission to train general-purpose models on that content or users' conversations. Any additional use must be permitted by the applicable agreement and law. You may contact AdMesh for information about the processing arrangements applicable to your integration.

4. How We Use Personal Information

AdMesh processes personal information for the following purposes, to the extent permitted by applicable law and consistent with its role and obligations under the applicable agreement and any applicable Data Processing Addendum:

• Establish and administer accounts, verify authorized access, manage permissions, and provide requested integrations;
• Provide advertising and recommendation Services, including analysis of submitted intent and context, evaluation of brand-agent offers, real-time auctions, and delivery of sponsored recommendations;
• Index and retrieve authorized publisher content, generate assistant responses and citations, and provide the publisher experience and controls enabled by the customer;
• Measure advertising activity, including exposures, clicks, and conversions, and provide attribution, analytics, and reporting;
• Administer account funding, charges, invoices, credits, and payments due to eligible partners;
• Provide customer support, investigate technical issues, and maintain the quality and operation of the Services;
• Protect the security and integrity of the Services and detect, investigate, and prevent fraud, abuse, and unauthorized activity;
• Provide account and service communications and, where permitted, relevant business communications, subject to applicable consent requirements and communication preferences; and
• Comply with applicable legal and regulatory obligations, resolve disputes, enforce applicable agreements, and establish, exercise, or defend legal claims.

5. Lawful Bases for Processing

Where AdMesh acts as a controller and applicable law requires a lawful basis for processing, we rely on the legal ground appropriate to the purpose and circumstances of the processing, including:

• Contractual necessity: processing necessary to perform a contract with you or to take steps at your request before entering into a contract;
• Legal obligations: processing necessary to comply with applicable legal requirements, including tax and financial recordkeeping obligations;
• Legitimate interests: processing necessary to operate and secure the Services, prevent fraud, and manage business relationships, provided those interests are not overridden by your interests or fundamental rights and freedoms; or
• Consent: processing based on your consent where required by applicable law, including for technologies or communications that require consent.

Where AdMesh processes personal information on a customer's behalf, the customer is responsible for establishing and maintaining the lawful basis for its collection, disclosure, and processing instructions, providing required notices, and obtaining consent where required. AdMesh processes that information in accordance with the applicable agreement, documented instructions, Data Processing Addendum, and applicable law. These responsibilities do not limit AdMesh's own statutory obligations.

Acceptance of the Terms of Service does not, by itself, constitute consent to processing for which applicable law requires separate consent. Where processing relies on consent, you may withdraw it as described in Section 10, without affecting the lawfulness of processing carried out before withdrawal.

6. How We Disclose Information

AdMesh may disclose personal information to the following categories of recipients, to the extent reasonably necessary for the purposes described in this Policy and permitted by applicable law and the applicable agreement:

• Service providers: providers engaged to support hosting, storage, authentication, payments, security, customer support, analytics, and automated analysis or content generation. Disclosures may include submitted content where necessary to provide the requested Services. Providers processing personal information on AdMesh's behalf are subject to applicable contractual confidentiality, security, and data-protection obligations.
• Advertising and integration partners: AI platforms, publishers, advertisers, agencies, and other authorized partners, as necessary to provide advertising Services, deliver recommendations, and support attribution, measurement, and reporting. Disclosures are limited to the information appropriate to the recipient's authorized role and applicable obligations.
• Connected third-party services: services an authorized user connects to AdMesh, as necessary to perform requested integrations or actions, within the permissions granted and subject to the applicable terms.
• Analytics and marketing providers: providers supporting website analytics, business-contact identification, and marketing measurement, as described in Section 7 and subject to applicable consent and opt-out requirements.
• Authorities and professional advisers: public authorities, legal and other professional advisers, or other recipients where disclosure is required by law or reasonably necessary to investigate unlawful activity, protect rights or safety, resolve disputes, or establish, exercise, or defend legal claims.

Where a disclosure constitutes a sale or sharing of personal information, or processing for targeted advertising, under applicable law, the corresponding rights and choices described in Section 10 apply. Disclosures of personal information processed on a customer's behalf remain subject to the applicable Data Processing Addendum and statutory restrictions on service providers and processors.

7. Cookies and Similar Technologies

On AdMesh's own websites and dashboard, we use cookies, local storage, tags, and similar technologies for authentication, session management, preferences, security, analytics, and website marketing measurement. Optional providers include Google Analytics, Vercel Web Analytics, Vercel Speed Insights, Google Ads, and Apollo visitor identification. The providers may process technical and usage information under the applicable arrangement and their own privacy disclosures. This description concerns AdMesh's own properties and does not mean that these website trackers are deployed on a customer's property through an AdMesh integration.

Optional analytics and marketing technologies are disabled until you choose to allow them. Use the cookie banner to accept or customize your choices. You can reject optional tracking in the preferences dialog. Use "Manage cookie preferences" in the footer to change or withdraw your choices. After you save a choice, the banner and floating controls stay hidden. We remember your choice for 180 days. Changing active tracking preferences reloads the page to apply your new choice. Essential authentication, security, and requested settings remain available.

Visitors to AdMesh's own properties may use browser or device settings to block or delete cookies and manage certain similar technologies. These settings may not control all tracking technologies, and blocking necessary technologies may affect login or other functionality. Settings may need to be adjusted separately for each browser or device.

AdMesh's standard browser-based click and conversion setup uses attribution links, browser storage, and conversion pixels rather than tracking cookies. Customers may also report conversion events through server-side integrations. These measurement technologies remain subject to applicable privacy requirements, including notice and consent where required.

Customers are responsible for the cookies and tracking technologies they deploy or authorize on their own platforms, applications, and properties, including required disclosures, consent, and privacy controls. Individuals using those properties should consult the operator's privacy and cookie notices. AdMesh's processing of information received through a customer integration remains subject to this Policy, applicable law, and any applicable Data Processing Addendum.

8. Security and International Processing

8.1 Security Measures

AdMesh maintains technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction. These measures include access controls, authentication requirements, and encryption in transit, as appropriate to the nature of the information and the risks associated with its processing. AdMesh remains responsible for compliance with its security obligations under applicable law and any applicable Data Processing Addendum.

8.2 International Processing

Personal information may be transferred to, stored in, or otherwise processed in the United States and other jurisdictions in which AdMesh or its service providers operate. The data-protection laws of those jurisdictions may differ from those of your place of residence. Where a transfer is subject to legal restrictions, AdMesh implements the safeguards required by applicable law, which may include standard contractual clauses or another legally recognized transfer mechanism. Transfers of Customer Personal Data are also subject to the applicable Data Processing Addendum. You may request information about applicable transfer safeguards using the contact details below.

9. Retention

AdMesh retains personal information for as long as reasonably necessary to fulfill the purposes described in this Policy, comply with applicable legal obligations, and meet its contractual responsibilities. Applicable retention periods are determined by the nature of the information, the duration of the relevant relationship or Services, operational and measurement requirements, security and fraud-prevention needs, dispute resolution, and statutory recordkeeping obligations.

These criteria also apply to retained query content and related service records. Where AdMesh processes personal information on a customer's behalf, retention, return, and deletion are governed by the applicable agreement, documented instructions, Data Processing Addendum, and applicable law. Requests for deletion are subject to applicable legal rights and any lawful retention exceptions. Additional provisions concerning data from Google integrations are set out in Section 14.4.

10. Your Rights and Choices

Depending on your location, the applicable law, and our processing role, you may have the right to:

• Request access to or information about personal information we process about you;
• Request correction, deletion, or a portable copy of applicable personal information;
• Object to processing or request that it be restricted;
• Withdraw consent where processing relies on consent, without affecting prior lawful processing;
• Opt out of sale, sharing, or targeted advertising where those rights apply; and
• Appeal a request decision where provided by law or complain to the competent supervisory authority.

To make a request, contact legal@useadmesh.com. We may ask for information reasonably necessary to verify your identity or authority and locate relevant records. You may use an authorized agent where permitted by law. Please avoid sending unnecessary personal information or credentials with your request. We respond within applicable legal timeframes, subject to applicable exemptions, and will not discriminate against you for exercising protected rights.

If your information was submitted by another platform or property and we process it on that operator's behalf, you should contact the operator responsible for your interaction. We assist the customer with requests as required by the applicable DPA and law. You can also contact AdMesh so we can help identify the appropriate route. Where required by law, applicable opt-out preference signals, including Global Privacy Control, must be honored for the processing they cover.

11. Customer and Integration Responsibilities

Customers and other users who collect or submit information through the Services are responsible for ensuring that its collection and disclosure to AdMesh are lawful. They must establish and maintain the necessary rights and lawful basis, provide all required privacy notices, obtain consent where required, and implement applicable consent, withdrawal, and opt-out controls. Submissions must be limited to information reasonably necessary for the requested Services, with unnecessary personal or confidential information removed before transmission, in accordance with our Terms of Service and any applicable Data Processing Addendum.

Users must not include passwords, API keys, authentication tokens, or other credentials in queries or contextual content. Special-category personal data or other highly sensitive information must not be submitted unless AdMesh has expressly agreed in writing and the processing is permitted by applicable law. The availability or use of AdMesh's sanitization or redaction features does not relieve users of these responsibilities or authorize an otherwise unlawful submission. Nothing in this section limits AdMesh's obligations under applicable law or any applicable Data Processing Addendum.

12. Third-Party Properties and Links

The Services may be accessed through third-party platforms or properties and may contain links to third-party websites, products, or services, including through sponsored recommendations and real-time offers. This Policy governs AdMesh's processing of personal information and does not apply to processing independently undertaken by third-party operators. Those operators are responsible for their own privacy notices, data practices, and compliance with applicable law. You should review their notices before providing personal information or using their services. Nothing in this section limits AdMesh's responsibility for its own processing or its obligations under applicable law or any applicable Data Processing Addendum.

13. Children's Information

The Services are not intended for or directed to children under thirteen (13), or any higher minimum age required by applicable law. AdMesh does not knowingly collect personal information from children below the applicable age. Customers and other users must not knowingly submit such information or integrate the Services into platforms, applications, or properties directed to those children.

If AdMesh becomes aware that children's personal information has been received in violation of this Policy or applicable law, we will take appropriate steps to delete that information and address the affected submission or integration in accordance with applicable law. Parents, guardians, and other individuals who believe such information has been submitted may contact legal@useadmesh.com.

14. Google API User Data

AdMesh's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google integrations are optional and are activated only when an authorized user explicitly connects the applicable Google account.

14.1 Google Data AdMesh Accesses and Why

• Google Tag Manager: Google account identity needed to complete authorization, accessible Tag Manager accounts and containers, and the workspaces, tags, triggers, variables, and container versions needed to configure and publish AdMesh conversion tracking at the user's direction.
• Google Ads: accessible customer and manager-account identifiers, Search campaigns and their structure and status, reporting metrics, and enabled conversion actions needed to display reporting, prepare campaign changes, and perform actions the user approves.
• OAuth credentials: access and refresh tokens needed to maintain the connection and make the API requests the user initiates. OAuth client secrets and tokens are never exposed to the dashboard.

Google Tag Manager and Google Ads use separate OAuth clients, requested scopes, stored credentials, and processing paths. A credential issued for one integration is not used to access the other integration.

14.2 Data Protection Mechanisms

• Encryption in transit: Google API data and OAuth credentials are transmitted over HTTPS/TLS.
• Encryption at rest: OAuth access and refresh tokens are encrypted before storage. Encryption keys and OAuth client secrets are maintained separately from application data and are available only to authorized server-side services.
• Access controls: access is limited through authenticated, role-based and brand-scoped authorization. Agency and partner users must be authorized for the applicable brand. Production access is limited to personnel and services with a legitimate operational need.
• Least privilege and user control: AdMesh requests only the scopes needed for the feature the user chooses. Publishing, activation, pausing, budget changes, and Tag Manager publication require an explicit user action or confirmation.
• Credential and request protection: OAuth requests use state validation to prevent cross-site request forgery. Credentials are processed server-side and are excluded from application logs, browser responses, Brand Agent prompts, and public APIs.
• Monitoring and incident response: AdMesh records security- and audit-relevant events, restricts access to those records, investigates suspected unauthorized access, contains and remediates confirmed incidents, and provides notices when required by applicable law.

14.3 Limited Use and Sharing

• Google API user data is used only to provide or secure the user-facing Google integration requested by the user.
• AdMesh does not sell Google API user data or use it for advertising unrelated to the requested integration.
• AdMesh does not transfer Google API user data to Grok, OpenRouter, or any other third-party generative-AI provider. This applies to raw data and to aggregated, anonymized, or derived data.
• When preparing changes for a connected Google Ads account, AdMesh uses information supplied directly by the user outside Google APIs, such as the user's saved brand profile, landing page, advertising brief, budget, and targeting selections. Google account identifiers, campaign data, performance metrics, conversion actions, Tag Manager data, and OAuth credentials are excluded from model prompts.
• Google API data is disclosed only to infrastructure providers acting on AdMesh's behalf where necessary to operate and secure the requested feature, or when required by law. Such providers are subject to confidentiality, security, and data-processing obligations.

14.4 Retention, Revocation, and Deletion

• OAuth credentials are retained only while the relevant Google integration remains connected or as needed to provide the requested service.
• When a user disconnects an integration, AdMesh attempts to revoke the corresponding Google token and removes the active stored credentials. Disconnecting Google Tag Manager does not remove tags the user has already published in their container; the user can pause or delete those tags in Google Tag Manager.
• Limited security, ownership, and audit records may be retained after disconnection when needed to prevent duplicate actions, preserve campaign ownership controls, investigate abuse, resolve disputes, or satisfy legal obligations. These records do not contain active OAuth credentials and are retained only as long as necessary for those purposes.
• Users may also revoke AdMesh from their Google Account permissions and may request deletion of associated AdMesh data by emailing legal@useadmesh.com. We verify the requester's authority before processing account-specific requests.

15. Changes to This Policy

AdMesh may amend this Privacy Policy from time to time to reflect changes in the Services, its data practices, or applicable legal requirements. Revised versions will be published on this page and identify the date of the latest revision. Where required by applicable law, AdMesh will provide notice of material changes through the Services or another legally appropriate means before those changes take effect. If a change requires new or renewed consent, AdMesh will obtain that consent before commencing the relevant processing. Continued use of the Services does not, by itself, constitute consent where applicable law requires separate consent.

Contact Information

For privacy questions or requests concerning personal information, contact AdMesh at legal@useadmesh.com.