AdMesh Privacy Policy

1. Who We Are

AdMesh is an AI-native monetization platform that helps users discover tools and services through smart agents and GPTs. We match real user intent with relevant product campaigns — and reward users, agents, or creators based on meaningful actions.

2. What Data We Collect

We collect data to operate the Agentic Intent Protocol (AIP) effectively and transparently:

When you explicitly interact with AdMesh recommendations on websites you have enabled:

• IP address (processed transiently by backend services for security and fraud prevention)
• Device/browser type
• Timestamp
• Clicked campaign ID (ad_id)
• Referrer information is processed only when a user explicitly interacts with an AdMesh recommendation (for example, clicking a link) and is not collected during general browsing activity

When you sign up:

• Email address (via Firebase Auth)
• Role (user, brand, agent)
• Profile preferences
• Activity (credits, campaigns used, sessions)

When conversions occur:

• Conversion event metadata
• Associated attribution packet (user, agent, campaign)

3. Why We Collect It

• Track affiliate conversions and distribute rewards
• Improve recommendation quality (tool usage, click rates)
• Prevent fraud and abuse
• Provide brands and agents with performance analytics
• Power the credits system

4. How We Use Your Data

We do not sell your data.

Your data is used internally to:

• Match intent to campaigns
• Attribute clicks and conversions
• Generate insights for users, brands, and agents
• Ensure fair payouts

5. IP Address Usage

When using AdMesh services, IP addresses may be processed transiently for security, fraud prevention, and abuse detection. IP addresses are not stored long-term by the Chrome extension and are not used for tracking or advertising purposes.

6. Cookies & Tracking

We use cookies and equivalent technologies:

• To track session-level behavior
• For attribution of clicks and conversions
• To prevent duplicate credits or abuse
• To remember your cookie preferences

We do not use third-party trackers or ad networks. You can manage your cookie preferences at any time.

7. Data Sharing

We do not sell or rent your personal information.

We only share:

• Anonymized stats (e.g., campaign click-through rates)
• Conversion summaries to brands (without exposing user identity)
• Required data to payment providers (e.g., Stripe or PayPal)
• Data required by infrastructure, hosting, authentication, security, and support providers acting on our behalf under contractual confidentiality and data-protection obligations
• Information required to comply with applicable law or protect the security and integrity of the Services

8. Your Rights

You can:

• Request to view or delete your data
• Opt out of non-essential tracking
• Delete your account anytime

Email us at privacy@useadmesh.com

9. Third-Party Links

AdMesh may link to external websites through affiliate campaigns. We are not responsible for their privacy practices. Please review their policies independently.

AdMesh does not inject affiliate links, replace existing links, or apply affiliate codes without a clear, user-initiated action and a direct user benefit.

10. Children's Data

AdMesh is not intended for users under 13. We do not knowingly collect personal information from children.

11. Policy Updates

We may update this policy occasionally. Significant changes will be posted on this page.

12. Contact Us

For questions, feedback, or data requests, contact:
📧 privacy@useadmesh.com

13. PII Sanitization & Privacy Protection

AdMesh SDKs include built-in Personally Identifiable Information (PII) sanitization to protect user privacy:

• Local Processing: All PII detection and removal happens locally on your device or server
• No External Transmission: PII is never sent to AdMesh servers or third parties during sanitization
• Complete Removal: Names, emails, phone numbers are automatically detected and removed from queries
• Context Preservation: Useful context (age, gender, goals) is extracted while removing identifying information
• No Storage: Original input containing PII is never logged, stored, or retained

This privacy-by-design approach ensures compliance with GDPR, CCPA, and other privacy regulations while maintaining recommendation quality.

14. Agent-Sourced Data Responsibility

AdMesh does not directly access or analyze end-user content such as meeting transcripts, personal notes, or voice recordings. All query data processed by AdMesh is provided by external agents or applications via our API. These agents are solely responsible for ensuring that any data sent to AdMesh is appropriate, permissioned, and compliant with applicable privacy standards.

We strongly recommend that all developers use our built-in PII sanitization functionality to automatically remove sensitive information before sending queries to our recommendation API.

15. Chrome Web Store User Data Compliance

AdMesh complies with the Chrome Web Store User Data Policy, including Limited Use requirements. Data collected through the Chrome extension is used solely to provide user-requested functionality, is not sold or used for personalized advertising, and is not transferred to third parties except as necessary to operate the service or comply with legal obligations.

16. Google API User Data

AdMesh's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google integrations are optional and are activated only when an authorized user explicitly connects the applicable Google account.

Google data AdMesh accesses and why

• Google Tag Manager: Google account identity needed to complete authorization, accessible Tag Manager accounts and containers, and the workspaces, tags, triggers, variables, and container versions needed to configure and publish AdMesh conversion tracking at the user's direction.
• Google Ads: accessible customer and manager-account identifiers, Search campaigns and their structure and status, reporting metrics, and enabled conversion actions needed to display reporting, prepare campaign changes, and perform actions the user approves.
• OAuth credentials: access and refresh tokens needed to maintain the connection and make the API requests the user initiates. OAuth client secrets and tokens are never exposed to the dashboard.

Google Tag Manager and Google Ads use separate OAuth clients, requested scopes, stored credentials, and processing paths. A credential issued for one integration is not used to access the other integration.

Data protection mechanisms

• Encryption in transit: Google API data and OAuth credentials are transmitted over HTTPS/TLS.
• Encryption at rest: OAuth access and refresh tokens are encrypted before storage. Encryption keys and OAuth client secrets are maintained separately from application data and are available only to authorized server-side services.
• Access controls: access is limited through authenticated, role-based and brand-scoped authorization. Agency and partner users must be authorized for the applicable brand. Production access is limited to personnel and services with a legitimate operational need.
• Least privilege and user control: AdMesh requests only the scopes needed for the feature the user chooses. Publishing, activation, pausing, budget changes, and Tag Manager publication require an explicit user action or confirmation.
• Credential and request protection: OAuth requests use state validation to prevent cross-site request forgery. Credentials are processed server-side and are excluded from application logs, browser responses, Brand Agent prompts, and public APIs.
• Monitoring and incident response: AdMesh records security- and audit-relevant events, restricts access to those records, investigates suspected unauthorized access, contains and remediates confirmed incidents, and provides notices when required by applicable law.

Limited Use, sharing, and AI/ML training

• Google API user data is used only to provide or secure the user-facing Google integration requested by the user.
• AdMesh does not sell Google API user data or use it for advertising unrelated to the requested integration.
• AdMesh does not transfer Google API user data to Grok, OpenRouter, or any other third-party generative-AI provider. This applies to raw data and to aggregated, anonymized, or derived data.
• Google API user data is not used to create, train, retrain, test, or improve a generalized AI or machine-learning model.
• Brand Agent campaign drafting uses only information supplied directly by the user outside Google APIs, such as the user's saved brand profile, landing page, campaign brief, budget, and targeting selections. Google account identifiers, campaign data, performance metrics, conversion actions, Tag Manager data, and OAuth credentials are excluded from model prompts.
• Google API data is disclosed only to infrastructure providers acting on AdMesh's behalf where necessary to operate and secure the requested feature, or when required by law. Such providers are subject to confidentiality, security, and data-processing obligations.

Retention, revocation, and deletion

• OAuth credentials are retained only while the relevant Google integration remains connected or as needed to provide the requested service.
• When a user disconnects an integration, AdMesh attempts to revoke the corresponding Google token and removes the active stored credentials. Disconnecting Google Tag Manager does not remove tags the user has already published in their container; the user can pause or delete those tags in Google Tag Manager.
• Limited security, ownership, and audit records may be retained after disconnection when needed to prevent duplicate actions, preserve campaign ownership controls, investigate abuse, resolve disputes, or satisfy legal obligations. These records do not contain active OAuth credentials and are retained only as long as necessary for those purposes.
• Users may also revoke AdMesh from their Google Account permissions and may request deletion of associated AdMesh data by emailing privacy@useadmesh.com. We verify the requester's authority before processing account-specific requests.