privacy

Optional analytics and advertising stay off until you choose.

This site runs a cookieless counter and a page-speed check for everyone, neither of which stores anything on your device, and loads a voice assistant you can choose to talk to. Google Analytics and Google Ads are separate choices, and each stays off until you allow it. When you type a website or work email into the onboarding, this site reads that company's public homepage and sends its text to Anthropic to draft who buys from you; an email is used only for its domain, and this site's server keeps nothing from the reading.

cookies this site sets before you choose: None
optional choices: 2
kept on our server from the onboarding: Nothing
hashed ad-id retention: 90 days
waitlist entries, after our last contact: 12 months

statusDraft, awaiting a solicitor's review

the technical version

The security page carries the controls, the onboarding's fetch, the list of services that receive data and every certification and registration we do not hold.

Read the security page

status of this document

This notice is a draft that a solicitor has not yet reviewed

AdBuyMCP is in its launch phase, and its legal documents have not yet been reviewed by a solicitor. This notice is a plain-English, UK-oriented draft written from what the code does.

Read its factual descriptions as accurate, because they were written from the code. Read anything that sounds like a legal commitment as not yet settled. If you are about to rely on it for a data protection assessment, ask us for the current position in writing.

who is responsible

You can contact the data controller directly

AdBuyMCP is a trading name, so the data controller is the company behind it, and that company is on the public register.

Tenhaw LTD is the data controller for this website and for the AdBuyMCP product, a company registered in England and Wales, number 12735685, operating from London. Where a customer runs campaigns on the platform, we act as their processor for the campaign data they put into it, under the agreement covering it, and they remain its controller.

Privacy questions, data subject requests and security questionnaires all go to hello@adbuymcp.com, which the founder reads. You can also complain directly to the Information Commissioner’s Office at ico.org.uk, with or without raising it with us first.

Registration for the ICO’s data protection fee and the data protection impact assessment for the exposure ledger are both open items. They are listed as such on the security page, beside the certifications we do not hold.

this website

Here is everything this website collects

Each row says what is collected or kept, when it applies and its lawful basis. The onboarding, the waitlist and the historical access applications have rows of their own.

A cookieless page counter
Runs for everyone
Plausible Analytics loads on every page. It sets no cookie and stores nothing on your device. Your browser sends each event to an address on this site, /pl/api/event, which passes it straight on to Plausible, so a content blocker that stops requests to Plausible's own domain does not stop this one. Plausible receives your IP address and browser details in the forwarded request and turns them into an identifier that changes every day. It never stores the raw address, so it cannot follow you to another site and there is no individual record of you to retain. What it keeps is aggregate: the page, the referrer, your approximate location (country, region and city), the device type and the browser, how far down the page you scrolled and how long it was open, plus outbound link clicks, file downloads and a small fixed vocabulary of named events (a button clicked, the booking calendar coming into view, a question asked of the on-page assistant, a step of the onboarding viewed, an address that led to a missing page). It runs for everyone because it stores nothing on your device.
Legitimate interests: understanding which pages of our own site are useful.
Page-speed timings
Runs for everyone
Vercel Speed Insights runs on every page of the live site. It measures how quickly the page loaded and responded in your browser (the Core Web Vitals) and sends each timing to Vercel through this site's own address, together with the page address, your connection type, browser, device type, operating system and country. Vercel describes each timing as anonymous: it is tied to no visitor and no IP address, and nothing is kept that could rebuild a visit across pages. The script sets no cookie and stores nothing on your device, so it runs for everyone on the same footing as the page counter.
Legitimate interests: keeping the pages of our own site quick to load.
The website or email you type into the onboarding
Only when you use it
What you enter in the field on the homepage or at /start is kept in your browser tab's session storage, with your progress through the steps, which your browser clears when you close the tab, and none of it goes into a page address while you work through the steps. A work email is used only for its domain: with JavaScript on, your browser cuts it to the part after the @ and sends this site's server only the homepage address; without JavaScript, the field is posted to this site's server as typed, and the server uses the domain and keeps nothing else. The server then fetches that one public homepage and sends its title, description and visible text to Anthropic's API, where Claude drafts who buys from the company. The draft comes back to your screen for you to edit, and this site's server keeps no copy of the page, its text or the draft. To limit how many homepages one visitor can have read in ten minutes, the server counts reads against your IP address in its memory, and this site's code writes that address to no log and no storage. Analytics record that the onboarding started, whether you typed a website or an email, how the read went, which steps you viewed, the frequency you chose and the buttons you used, and never what you typed, your buyers or your market size. The optional Google Ads tag is kept off the onboarding page.
Steps taken at your request before entering a contract: you asked for a plan and its price.
What you tell the waitlist
Only when you use it
The form at /waitlist asks for your name, your work email, your company, your role and what you want awareness advertising to solve, and you tick a box to say we can reply. When you send it, those five answers go with the time, the page you sent them from and your browser's user agent string. If you priced a plan first, the line shown above the button goes with them: your market size, how often a week and the monthly price, which your browser took from this tab and which the form prints before you send it. Your website and your email address are never put in a link. We store waitlist details on Supabase in London, UK, in one table shared by Tenhaw's products. Our website can only add an entry, never read one back. Resend sends us an alert from Ireland, EU, so we can reply to the email address you gave. Resend stores email content and delivery logs in the United States. Its DPA includes Standard Contractual Clauses and the UK Addendum for these transfers. We process the details with your consent, because you asked us to reply. The required checkbox covers that purpose and does not subscribe you to a newsletter. We keep waitlist entries for 12 months after our last contact, then delete them. To limit how many entries one visitor can send in ten minutes, the server counts them against your IP address in its memory, and this site's code writes that address to no log and no storage. Analytics record that the form was started and that an entry was taken, and whether a plan came with it, never what you typed. The optional Google Ads tag is kept off the waitlist page.
Consent, which you give with the box on the form and can withdraw at any time by asking us.
Google Analytics
Only if you allow it
It does not load at all until you allow analytics, so declining means your browser never downloads the script. Once allowed, it sets its own cookies and records page views, the referring page and which buttons were used. Nothing in its configuration tries to identify you or the company you work for, and it never receives what you type into the onboarding.
Consent, which you give or refuse in the panel and can change at any time.
Google Ads
Only if you allow it
It loads only after you allow advertising, which is a separate choice from analytics, and it is kept off the onboarding page. Once allowed, Google Ads can use cookies, the addresses of the pages you visit, your IP address, browser and device details and cookie identifiers to measure advertising and show you ads for this site on other websites. The section at the end of this notice says how to withdraw it.
Consent, given or refused separately from analytics, which you can withdraw at any time.
Your consent decisions
Runs for everyone
Kept in your browser's local storage, not in a cookie and not on any server here. Your analytics decision is stored under the key adbuymcp_consent with the category-set version, whether analytics was allowed, the time of the decision and whether it came from a browser privacy signal. Your advertising decision is stored separately under adbuymcp_advertising_consent, with the time you made it. Neither leaves your device. Clearing your site data removes both, and you will be asked again.
Strictly necessary: they are the record of your own choices, and without them we would have to ask on every page.
The voice assistant
Runs for everyone
Kawl Now provides the optional AI voice widget on this website. The widget loads from app.kawlnow.com on every page, which receives the browser request information needed to serve it. If you start a conversation, your question and the AI answer are processed to provide the service and saved in a transcript that our team can review. Microphone access requires your browser permission; you can end the conversation at any time. Please keep passwords, payment details, customer records and sensitive personal information out of the conversation. Contact us through this website for questions about a transcript or a privacy request.
Legitimate interests: answering questions about our service by voice, once you start a conversation.
Historical access applications
Historical records
Before email registration replaced the access application on 7 October 2026, /signup collected five answers: name, work email, company, monthly media budget band and a sentence describing the intended audience. Historical records include the submission time and the referring page. They remain in Vercel Blob storage with private access, in a London store, reachable with our own credentials and never served from a public URL. A person read the application and replied by email. Where application alerts were enabled, the notice sent to our team's messaging tool carried only the budget band and submission time, never the name, email, company or audience sentence. The form held an IP address in memory for its five-minute rate-limit window and never wrote it to the store. An optional one-tap answer about where the applicant heard of us, and its time, may sit beside the application in the same private store; it was not stored on the applicant's device or sent to analytics. These are historical application records, not accounts created through today's product sign-up.
Steps taken at your request before entering a contract: the historical applicant asked for access.
The on-page assistant
Only when you use it
What you type is sent to Anthropic's API to produce the answer, along with up to the last ten messages of that conversation, each capped at a thousand characters. The conversation itself lives in the page for as long as the tab is open and reaches no storage here. To limit how many questions one visitor can send in a minute, the server counts them against your IP address in its memory, and this site's code writes that address to no log and no storage. Do not type anything into it you would not put in an email.
Legitimate interests, and your own request: you asked it a question.
The booking calendar
Only when you use it
A Cal.com embed, and none of Cal's code is requested until you scroll close to it, so on a page whose calendar you never reach nothing of theirs loads at all. What you enter to book a call (your name, your email, whatever you write in the notes) goes to Cal.com and to us as a booking. The embed is a cross-origin frame, so what happens inside it is governed by Cal.com's own privacy terms as well as this notice.
Steps taken at your request before entering a contract.
Email and enquiries
Only when you use it
Anything you send to our address, kept for as long as it takes to deal with it and to keep a record of what was agreed. Privacy requests go to the same address, which is read by the founder.
Legitimate interests, and steps taken at your request before entering a contract.
Fonts and page assets
Runs for everyone
Served from this origin. The three typefaces are downloaded at build time and self-hosted rather than fetched from a font network, so loading a page here does not tell a font provider that you visited.
Strictly necessary: the page has to render.
Web server request logs
Outside our control
Vercel, which hosts this website, keeps ordinary request logs, which include IP addresses, under its own retention and for its own security and operations. This notice does not yet state that retention period.
Legitimate interests: keeping the site available and secure.

the platform, not this website

The product handles your account under its own notice

Account sign-up takes place on the product host, app.adbuymcp.com. Joining the waitlist takes a short form and no card. James is setting the first customers up himself, so he reads every entry and comes back to you, and nothing is bought until the plan, the ads and the start date are confirmed with you. Supabase processes account identity and sign-in, and AdBuyMCP operates the hosted service with each workspace isolated.

The sign-up flow links the product privacy notice. Read it for account and workspace processing. The historical application retention described above applies to the former form on this site, and does not set the retention period for product accounts.

The full technical account

Your plan and the campaign data that follows from it: Your plan and brief, compiled targeting specifications, creatives, delivery rows and statements, scoped to one workspace. A plan describes a market: the kinds of company, the job titles and the places it covers.
Exposure and outcome events: Ad exposures keyed on an opaque household key, a hashed mobile advertising id, a EUID or a postcode sector, plus the outcomes a customer imports or that arrive through their own analytics. The ledger that holds them never resolves a key back to a person or across key spaces, and today only the sandbox writes to it.
Hashed advertising ids, for at most 90 days: After the window the hashed id is persistently stripped from the exposure event, and the event is re-graded to a coarser key rather than deleted, so the history survives without the identifier. It is enforced in one module, which is also the only module in the platform permitted to perform an identity join.
Vendor credentials: Encrypted at rest with AES-256-GCM, never logged and never returned by an API read. Deleted when the connection is removed.
A lawful-basis manifest on every compiled plan: Each segment's provider and the basis it relies on (consent-chained, legitimate interest, or outside UK GDPR scope, which is where out-of-home delivery sits), recorded for each segment, with the warnings raised while compiling still attached. It is evidence a DPO can read; it is not a compliance guarantee, and the conditions it attaches are ones the advertiser still owes.

lawful basis

Each lawful basis we rely on works differently

Consent can be withdrawn, legitimate interests can be objected to, and a legal obligation survives both. Out-of-home delivery needs none, because it involves no personal data.

Consent: The optional analytics and advertising choices on this website and, inside the product, device-level advertising identifiers where the segment provider asserts a consent chain. Consent is the basis that can be withdrawn, and withdrawing it here means reopening the panel from the links in the footer and choosing again.
Legitimate interests: The cookieless page counter, the page-speed timings, the voice assistant, the on-page assistant, keeping this site available and secure, answering enquiries, and B2B marketing of our own service. Inside the product, business-to-business signals that rely on a legitimate interests assessment, which the manifest names as a condition the advertiser holds.
Contract, and steps before one: Reading your homepage and pricing your plan in the onboarding at your request, booking and holding a call, corresponding about an agreement, handling historical access applications and providing an account. Account sign-up takes place on the product host, whose privacy notice is linked in the product section below.
Legal obligation: Records we are required to keep, principally financial ones. This notice states no fixed retention figure for them, because the correct figure is a question for a solicitor.
Outside scope: Out-of-home delivery involves no personal data (screen locations, venue types, postcode areas and times of day), and the product records it as outside scope.

how long

Each record has its own retention period

The third column says what happens to each record when its period ends.

Retention periods for data held by AdBuyMCP and this website.
What	How long	What happens then
Your consent decisions	How longUntil you clear them	What happens thenThey are stored only in your browser. Clearing site data removes them, and a change to the analytics category set makes that record stop counting, so you are asked again.
What you type into the onboarding	How longUntil you close the tab	What happens thenKept only in your browser tab's session storage, with your progress, and cleared by your browser when the tab closes. This site's server keeps no copy of your homepage, its text or the draft of your buyers.
What you tell the waitlist	How long12 months after our last contact	What happens thenThe entry is deleted. We store waitlist details on Supabase in London, UK, until then, and Resend sends us the alert from Ireland, EU, and stores email content and delivery logs in the United States. Withdraw your consent or ask us sooner and the entry goes sooner.
Cookieless page analytics	How longAggregate only	What happens thenNo individual-level record is created, so there is nothing about you to keep or to delete.
Page-speed timings	How longAnonymous only	What happens thenEach timing is held by Vercel without an IP address or anything tied to you, so there is nothing about you to keep or to delete.
Google Analytics and Google Ads, if you allowed them	How longGoogle's own retention	What happens thenHeld by Google under its own retention settings. If you declined, no record was created in the first place.
Assistant conversations	How longNot stored here	What happens thenThe conversation reaches no storage on this site. The API call is subject to Anthropic's own terms, and the rate limit counts against your IP address in the server's memory, which this site's code never writes to a log or to storage.
Voice assistant transcripts	How longKawl Now's retention	What happens thenA conversation you start is saved as a transcript that our team can review. Ask us about a transcript, or make a privacy request, through this website.
Historical applications from the former signup form	How longAs long as it is needed	What happens thenHeld in private blob storage to retain the access request, its handling and what was agreed. Deleted on request unless we are required to keep it. The optional answer about where the applicant heard of us is kept with the application and deleted with it. This row does not set retention for current product accounts.
Bookings and correspondence	How longAs long as it is needed	What happens thenHeld to arrange the call, to follow it up, and to keep a record of what was discussed and agreed. Deleted on request unless we are required to keep it.
Hashed advertising ids in the product	How long90 days maximum	What happens thenPersistently stripped from the exposure event, which is kept under a coarser key.
Campaign configuration and delivery data	How longLife of the workspace	What happens thenDeleted on request, and returned or deleted at the end of an agreement under its terms.
Vendor credentials	How longUntil the connection is removed	What happens thenDeleted. They are encrypted at rest for as long as they exist and are never returned by an API read.
Financial records	How longAs UK law requires	What happens thenKept for as long as tax and company law requires. This notice states no number, because the number is a question for a solicitor.

your rights

You have these rights under UK GDPR

UK GDPR gives us one month to answer a request, and if a complex one needs longer, the law requires us to tell you within that month. Exercising any of these rights costs nothing and changes nothing about how you are treated.

Access: A copy of the personal data we hold about you, and an explanation of what we do with it.
Rectification: Correction of anything inaccurate, and completion of anything incomplete.
Erasure: Deletion, where we have no overriding reason or legal obligation to keep it.
Restriction: A pause on processing while a dispute about accuracy or basis is resolved.
Portability: The data you gave us, in a structured, commonly used, machine-readable form.
Objection: An objection to anything we do on the basis of legitimate interests, including marketing our own service to you.
Withdrawal of consent: For anything relying on consent, at any time and as easily as it was given. On this site that is the links in the footer.
Complaint: To the Information Commissioner's Office at ico.org.uk, whether or not you raise it with us first.

If your data is in a customer’s campaign

Where we process campaign data for a customer, they are the controller and the request belongs with them. Send it to us anyway if you do not know who they are, and we will route it and help them answer it.

Automated decisions

Nothing here makes an automated decision producing a legal or similarly significant effect about an individual. On this website, Claude drafts who buys from a company, and the person who typed in that company’s website edits the draft. In the product, the AI layer drafts and plans media, and a named person must approve any spend.

when this changes

Changes to this notice are posted here.

If the analytics categories or the processors behind them change, the stored version number stops matching and you are asked again.

security terms hello@adbuymcp.com

if you need more than this

Ask the founder anything this notice leaves open.

If your data protection assessment needs more than this notice gives, book a call or email us.

Get my plan and price Book a 30-minute call with the founder

Free, with no card.

Talk your market and your plan through with James Rooney, who built AdBuyMCP and wrote its code.

People ask these questions about privacy

What happens to the website or email I type into the onboarding?

It stays in your browser tab until you close it. A work email is used only for its domain, and this site reads that company's public homepage and sends its text to Anthropic, whose model Claude drafts who buys from you. The draft comes back to your screen, and this site's server keeps no copy of the homepage, its text or the draft. The server counts reads against your IP address in its memory, to limit how many homepages one visitor can have read in ten minutes, and never logs that address or stores it. Analytics never record what you typed.

Do you set cookies?

This site sets no cookie until you choose. The page counter and the page-speed timings that run for everyone are cookieless and store nothing on your device, and your consent decisions are kept in your browser's local storage. Google Analytics and Google Ads set their own cookies, and neither loads at all unless you allow it, so declining means neither is ever written.

How do I change or withdraw my consent?

The cookie settings and advertising settings links in the footer of every page reopen each choice. A new decision replaces the stored one immediately, and the gated tools stop loading from the next page view; withdrawing advertising also removes this site's advertising cookies and reloads the page. Clearing your browser's site data removes the records entirely, in which case you will be asked again. A browser sending Global Privacy Control or Do Not Track is treated as a refusal without a prompt.

What happens to what I type into the assistant on these pages?

It is sent to Anthropic's API to produce the answer, together with up to the last ten messages of that conversation, each capped at a thousand characters. The conversation lives in the page while your tab is open and reaches no storage here. The server counts questions against your IP address in its memory, to limit how many one visitor can send in a minute, and never logs that address or stores it. Treat it as you would an email.

What happens to what I put in the waitlist form?

We store an entry in one database and send an email alert to the founder. We store waitlist details on Supabase in London, UK, in one table shared by Tenhaw's products, with the time, the page you sent them from, your browser's user agent string and, if you priced a plan first, the plan line the form printed above the button. Our website can only add an entry, never read one back. Resend sends us an alert from Ireland, EU, so we can reply to the email address you gave. Resend stores email content and delivery logs in the United States. Its DPA includes Standard Contractual Clauses and the UK Addendum for these transfers. We process the details with your consent, because you asked us to reply. The required checkbox covers that purpose and does not subscribe you to a newsletter. We keep waitlist entries for 12 months after our last contact, then delete them, and sooner if you ask. Joining the waitlist creates no account.

What happens to what I put in the application form?

The former access application was replaced by email registration on the product host on 7 October 2026. Its historical records contain the five answers (name, work email, company, budget band and audience sentence), submission time and referring page, held in Vercel Blob with private access. A person read and answered the application. An optional one-tap source answer may be stored beside it. The form's five-minute IP rate-limit record was never written to the store. Any application alert carried only the budget band and time to our team's messaging tool; the personal answers stayed in the private store. These records follow the retention row above. Current account sign-up is described by the product privacy notice linked in the product section, and there is no newsletter or drip sequence attached to the historical application.

How long do you keep advertising identifiers?

At most 90 days. After the window, the hashed mobile advertising id is persistently stripped from the exposure event and the event is re-graded to a coarser key (a household key or a postcode sector) and kept, so the delivery history survives without the identifier. The rule is enforced in code, in the one module permitted to perform identity joins.

Are you registered with the ICO, and have you completed a DPIA?

We have not registered for the data protection fee or completed the data protection impact assessment for the exposure ledger. Both are open items, published as such on the security page alongside the certifications we do not hold. If either is a condition of your assessment, it is worth establishing before a questionnaire cycle.

Is this privacy notice final?

No. It is a draft written from what the code does, and a solicitor has not yet reviewed it, along with the terms, the data processing agreement and the subprocessor list. Its factual descriptions are accurate; anything that reads like a legal commitment is not yet settled.

Optional Google Ads advertising

Google Ads, provided by Google LLC, stays off until you separately allow advertising. It can use cookies and your page addresses, IP address, browser/device information and cookie identifiers to measure advertising and show you personalised ads for this site across other websites. Allowing analytics does not allow advertising. Google Analytics advertising features remain disabled.

Your advertising decision and its timestamp are stored separately in your browser. Use Advertising settings in the footer to change or withdraw it. Withdrawal denies further advertising use, removes this site's advertising cookies and reloads the page to unload the advertising tag, while preserving your analytics choice. Browser privacy signals keep advertising off. We exclude pages or referring addresses with sensitive paths or parameters; ordinary marketing query strings and section navigation may still be processed by Google Ads.

Read Google Business Data Responsibility for how Google uses personal information, and My Ad Center to manage your Google advertising choices.

This notice is a draft that a solicitor has not yet reviewed

You can contact the data controller directly

Here is everything this website collects

A cookieless page counter

Page-speed timings

The website or email you type into the onboarding

What you tell the waitlist

Google Analytics

Google Ads

Your consent decisions

The voice assistant

Historical access applications

The on-page assistant

The booking calendar

Email and enquiries

Fonts and page assets

Web server request logs

Analytics and advertising are separate choices

Each optional tool stays off until you allow it

Saying no takes one click, the same as saying yes

Nothing is loaded and then suppressed

Browser privacy signals are honoured without a prompt

A change to the categories asks everyone again

A consent control that gates nothing is removed