See what AdBuyMCP enforces in code, and what it does not hold.

When you type a company website or work email into the onboarding, this site's server fetches that company's public homepage, and Claude, Anthropic's AI model, drafts who buys from it. The draft is a starting point you edit, never a fact about your company. Each point below is a behaviour of this site's code.

Only a homepage address leaves your browser

With JavaScript on, a work email is cut to its domain in your browser, and only the homepage address, such as https://acme.com/, is sent to this site's server. Without JavaScript, the field is posted as typed, and the server uses the domain and nothing else. Personal email providers are refused, because their homepage says nothing about your company.

The fetch reaches public addresses only

Only http and https on the standard ports, with no username or password in the address. Private, loopback, link-local, multicast and reserved network ranges are refused where the connection is made, so a name that points somewhere else between a check and a connection gets nowhere. At most three redirects are followed, each checked again, and the fetch stops after ten seconds or one megabyte of HTML. A blocked address gets the same answer as an address that does not exist.

Anthropic receives the page's text and nothing else

The server takes the page's title, description and visible words, up to 12,000 characters, and sends that text to Anthropic's API. Claude drafts what the company sells, the job titles likely to buy, the kinds and sizes of company and where they are, and is told to work only from that text, to treat it as data and never to name a person or a company. If the model declines or fails, you describe your buyers yourself.

Nothing read is kept on this site

The draft comes back to your screen for you to edit. This site's server keeps no copy of the page, its text or the draft, and logs nothing from them. To limit how many homepages one visitor can have read in ten minutes, the server counts reads against your IP address in its memory, and this site's code writes that address to no log and no database.

Your progress stays in your browser tab

What you typed, the buyers you confirmed, your market and your frequency are kept in the tab's session storage, which your browser clears when you close the tab, and none of it goes into a page address. Analytics never record what you typed, your buyers or your market size. The waitlist form at the end reads your plan's numbers from that same tab and prints them above the button before you send them; your website, your email and what you wrote about your buyers never go into a link.

Campaign configuration is yours and is held for as long as your workspace exists. Vendor credentials are encrypted at rest and are the highest-value target here. Exposure and outcome data is the category a DPO will ask about, and it is the one with a hard retention rule.

Campaign and plan data

Your plan and brief, compiled targeting specifications, creatives, delivery rows and statements, scoped to your workspace.

Vendor credentials

Encrypted at rest with AES-256-GCM over the JSON-serialised credential object, keyed on SHA-256 of a master key held in the environment. Never logged, never returned by an API read, and the connection store's health is checked at startup and on every readiness probe.

Exposure and outcome events

Ad exposures keyed on an opaque household key, a hashed mobile advertising id, a EUID or a postcode sector, plus outcomes you import or that arrive through your own analytics. Hashed advertising ids are held for at most 90 days. Today the ledger is written to only by the deterministic sandbox. There is no inbound ingest route for viewshed panels, CTV logs or IP logs, so the retention rule is in force before there is live data for it to govern.

Everything about the privacy posture follows from that. The exposure ledger that every channel writes into records an exposure against a key and holds it there, and today the deterministic sandbox is the only thing writing to it. Joining a key to a person, or to another key space, happens in the key-translation service alone: it is where the retention rule is enforced, and the one place a reviewer needs to read to understand what is joined to what.

90-day maximum on hashed advertising ids

After the window, the hashed id is persistently stripped from the exposure event. The event is re-graded to a coarser key rather than deleted, so history is preserved without the identifier.

The identity spine uses several kinds of key

Household key, hashed advertising id, EUID and postcode sector. A spine that depended on advertising ids alone would degrade on a schedule set by Apple and Google; this one loses precision one step at a time and records which step it is on.

Per-key legal grading

Each key space carries its own legal grade, so a consent-chained EUID and a postcode sector permit different uses, and the code enforces the difference.

Every compiled channel plan carries a lawful-basis manifest: the provider of each segment used, the basis it relies on (consent-chained, legitimate interest, or outside scope) and the warnings raised while compiling it. It exists so that the answer to "where did this audience come from?" is a document a DPO can read. It is evidence a compliance assessment draws on, and the assessment is still to be made. The manifest also carries the conditions that remain yours: a Legitimate Interests Assessment on file for a given source, say, or a vendor's consent-framework attestation verified on connection. Turning those conditions into enforced launch gates is work we have not finished.

Out-of-home is marked outside UK GDPR scope

Out-of-home delivery runs on screen locations, OpenOOH venue types, postcode areas and times of day. None of that is personal data, and the product records that it sits outside UK GDPR scope. Movement data is absent from that list because none reaches the product: the Adsquare contract does not exist.

Warnings travel with the plan

A low-confidence segment match, an unmapped geography or an excluded segment all raise warnings that stay attached to the compiled plan wherever it goes.

Every route is scoped to an advertiser workspace, and a cross-tenant request returns a 404 rather than a 403, because a 403 confirms that the resource exists. Hosted authentication uses Supabase-signed tokens and server-owned workspace claims. User-supplied metadata cannot choose another workspace.

Actor class is verified on the server

Every request carries a verified actor class, and a header cannot change it. A human web session paired with the agent source marker is rejected outright, and agent credentials must carry a signed agent claim and a verified client id.

Consequential permissions are server-controlled

Exact-digest approval, operator reconciliation and supplier authorisation are three separate permissions issued only from server-controlled roles. An ordinary human tenant member fails closed with a 403, and agents cannot hold any of them.

Audit trail

Actor, source and client attribution are persisted on every action, and the audit log is readable through both the dashboard and the MCP surface.

Each refusal below is in the code today.

Production will not start without its configuration

Production startup requires the configured Supabase verifier, a strong master key, PostgreSQL, explicit HTTPS origins and a public API asset origin. A legacy plaintext credential row, ciphertext that will not decrypt with the current key, or a missing live credential stops the deployment.

A launch without the funds to cover it is blocked

The spend check is enforced by default; only a sandbox preview may run it as a warning. Creative production has no warning-only path at all, because a provider charges when a piece is submitted.

An ambiguous supplier outcome stops the run

It raises an exception that requires explicit human resolution, and the operator is handed the vendor, the operation and the idempotency token. It is never retried and never assumed failed.

Expired supplier authority raises a spend lock

The lock takes effect before any scheduled work runs. One emergency pause tied to the incident is sent, and only a named person's reconciliation clears the stop.

The MCP boundary requires an explicit allowlist

Production must set exact allowed hosts and browser origins, with "none" where there are no browser clients. Local execution binds to loopback. Verifier time, request concurrency and JSON body size are bounded, and a request missing its protocol version header is rejected before dispatch.

This website uses Claude, Anthropic's AI model, to draft who buys from a company during the onboarding and to answer questions in the on-page assistant. The product uses it to extract an audience from a brief, draft plans, pre-check creative, suggest optimisations and explain scores. The points below set out what the model may do and what deterministic code does instead.

The model never sets a price

On this website, your market size is the number you give, and your monthly price is worked out from the published rate. The model's draft of who buys from you is a starting point you edit.

The model never emits a vendor identifier

It extracts semantics; deterministic registry tables emit segment ids by matching those semantics against catalogue keywords. Every segment id that reaches a buy came out of the catalogue.

The model does no arithmetic

Every number in a plan is computed by deterministic code, and the model explains the numbers.

Format limits are enforced by schema

Copy that exceeds a channel's limit is rejected at the boundary as a validation error. Nothing is truncated on its way to a provider.

Provenance is visible

AI-produced output is distinguished from deterministic fallback output wherever it appears. With no API key configured, the product runs on those fallbacks and the onboarding asks you to describe your buyers yourself.

Your data is not used to train models

The homepage text this site sends during the onboarding, and the briefs and campaign data the product sends, go to the model provider to produce your output and are not used to train models.