HolyMedia MCP Privacy Policy

Last updated: September 16, 2026

HolyMedia MCP is a B2B service for connecting advertising and analytics platforms, viewing and analyzing data, preparing reports, and working with compatible AI clients.

This Privacy Policy explains what information HolyMedia MCP receives and processes, how that information is used, stored and protected, and what controls are available to users.

1. Information We Process

HolyMedia MCP may process:

• HolyMedia MCP account information, including name, email address, profile settings, company, role, account status and session information;
• connection information, including platform names, connection identifiers, available accounts or properties, and assets selected by the user;
• advertising data, including campaigns, ad groups or ad sets, ads, statuses, budgets, spend, impressions, reach, clicks, conversions and other available metrics;
• Google Ads data;
• Google Analytics 4 data;
• Google Search Console data;
• data from other platforms connected by the user;
• OAuth data and technical information required to maintain authorized connections;
• technical and diagnostic information, including IP address, browser information, security events, errors and logs.

HolyMedia MCP obtains data from third-party platforms only within the permissions explicitly granted by the user through OAuth or another official authorization mechanism provided by the relevant platform.

2. How We Use Information

Information is used only to provide and protect HolyMedia MCP functionality, including:

• account registration and account management;
• connecting platforms through OAuth;
• displaying accounts, properties and assets available to the user;
• retrieving advertising and analytics data;
• preparing reports, comparisons and recommendations;
• responding to requests made by the user through connected AI clients;
• performing actions explicitly confirmed by the user where such functionality is available;
• diagnosing platform connections;
• preventing abuse and protecting the service;
• providing technical support.

We do not use connected-platform data for purposes unrelated to functionality requested by the user through HolyMedia MCP.

3. Google User Data

HolyMedia MCP accesses Google user data only after the user explicitly authorizes access through Google OAuth.

Depending on the Google services connected by the user, HolyMedia MCP may process the following categories of Google user data.

Google Ads

HolyMedia MCP may access Google Ads accounts available to the authorized user, campaigns, ad groups, ads, statuses, budgets, spend, impressions, clicks, conversions and other advertising metrics made available by the Google Ads API.

This information is used to display advertising statistics, analyze advertising performance, prepare reports and respond to user requests.

Google Analytics 4

When a user connects Google Analytics, HolyMedia MCP uses read-only access required to provide analytics functionality.

HolyMedia MCP may access:

• Google Analytics accounts and properties available to the user;
• information about selected GA4 properties;
• users, new users and sessions;
• traffic sources and channels;
• acquisition data;
• pages and landing pages;
• views and engagement metrics;
• events and key events;
• device and geographic information;
• real-time analytics;
• ecommerce metrics where available in the connected property;
• custom dimensions and metrics available through the Google Analytics API.

This information is used only to display analytics, prepare reports, compare periods and answer user requests.

For Google Analytics, HolyMedia MCP requests the minimum read-only scope required for these functions:

https://www.googleapis.com/auth/analytics.readonly

HolyMedia MCP does not use this scope to modify Google Analytics data or configuration.

Google Search Console

When a user connects Google Search Console, HolyMedia MCP may access:

• Search Console properties available to the user;
• search queries;
• pages;
• clicks;
• impressions;
• click-through rate;
• average position;
• date, country and device breakdowns;
• sitemap information and other available read-only Search Console data.

This information is used for SEO analytics, reporting and responding to user requests.

4. Google API Services User Data Policy and Limited Use

HolyMedia MCP's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

HolyMedia MCP:

• uses Google user data only to provide or improve user-facing features that the user accesses or requests;
• does not sell Google user data;
• does not use Google user data for unrelated advertising, credit scoring or unrelated purposes;
• does not use Google user data to build advertising profiles outside HolyMedia MCP functionality;
• does not use Google user data to train its own general-purpose AI or machine-learning models;
• does not transfer Google user data to third parties except where necessary to provide a feature explicitly requested by the user, operate and secure the service, or comply with applicable law.

5. AI Clients

HolyMedia MCP may be used together with compatible AI clients such as ChatGPT, Claude or Codex.

An AI client receives access only after the user connects it to the user's own HolyMedia MCP workspace.

When a user asks an AI client to work with connected data, HolyMedia MCP may provide the AI client with information necessary to fulfill that specific user request.

HolyMedia MCP does not provide AI clients with the user's password or OAuth credentials belonging to connected advertising or analytics platforms.

HolyMedia MCP does not use Google user data to train its own general-purpose AI models.

Use of information by an external AI client is also subject to that service's own terms and privacy policies.

6. Sharing With Third Parties

We do not sell personal information, advertising data or Google user data.

Limited sharing may occur with:

• infrastructure and hosting providers required to operate HolyMedia MCP;
• Google and other connected platforms when processing OAuth and API requests initiated by the user;
• AI clients that the user independently connects and uses to process requests;
• technical service providers required to operate and secure HolyMedia MCP;
• governmental authorities or other parties where disclosure is required by law.

Information sharing is limited to what is necessary for the relevant purpose.

7. Data Storage and Security

We use technical and organizational measures to protect information, including:

• HTTPS;
• server-side session management;
• protected storage of OAuth credentials;
• encryption of connected-platform credentials;
• hashing or digest storage of access keys and tokens where applicable;
• workspace-level data isolation;
• server-side authorization controls;
• auditing of security-sensitive actions;
• restricted access to production infrastructure;
• removal of secrets and tokens from user-facing responses and diagnostic logs.

OAuth access tokens, refresh tokens, client secrets and passwords are not exposed to users and are not provided to connected AI clients.

8. Data Retention

HolyMedia MCP account data is retained while the account remains active or for as long as necessary to provide the service, comply with legal obligations, maintain security and resolve technical disputes.

OAuth connection data is retained only for as long as required to maintain the relevant connection and functionality authorized by the user.

Metadata, reports, security logs and backups may remain temporarily after an integration is disconnected when necessary for technical, security or legal purposes.

We do not retain Google user data longer than necessary to provide the user-facing functionality described in this Privacy Policy.

9. Disconnecting Google and Revoking Access

Users may at any time:

• disconnect Google Ads, Google Analytics or Google Search Console from the HolyMedia MCP Connections section;
• revoke HolyMedia MCP access through their Google Account settings;
• revoke or delete MCP access keys;
• request deletion of their data.

After Google OAuth authorization is revoked, HolyMedia MCP can no longer retrieve new information through the affected Google connection.

10. Data Deletion and User Rights

Users may request:

• deletion of their HolyMedia MCP account;
• deletion of connection data;
• disconnection of connected platforms;
• correction of personal information;
• information about data processed by HolyMedia MCP.

Requests may be submitted to:

mcp@holymedia.kz

We may retain the minimum information necessary where required by law, security obligations, fraud prevention or the integrity of mandatory audit records.

11. International Processing

To provide HolyMedia MCP, information may be processed using infrastructure located outside the user's country of residence.

We apply the safeguards described in this Privacy Policy and restrict processing to the purposes described above.

12. Customer and Workspace Isolation

HolyMedia MCP is a multi-tenant B2B service.

Access to data is limited to the user's current company or workspace.

A user in one workspace is not permitted to access data belonging to another workspace without appropriate authorization.

Possession of an advertising account ID, GA4 property ID, Search Console property ID or other external identifier does not itself grant access to that resource.

13. Changes to This Privacy Policy

We may update this Privacy Policy when HolyMedia MCP functionality, integrations, legal requirements or platform requirements change.

If the way Google user data is used changes materially, this Privacy Policy will be updated before the new use begins and additional user consent will be obtained where required.

14. Contact Information

For questions regarding privacy, Google user data, data deletion or connected platforms:

HolyMedia MCP

Email: mcp@holymedia.kz

Website: https://mcp.holymedia.kz