Privacy policy

1. Data the application accesses

With the signed-in user's authorization, the application accesses the accounts and resources needed for the requested work:

• Google Ads: account details, campaigns, budgets, targeting, keywords, search terms, ads, assets, conversion configuration and advertising performance. The Google Ads permission allows reading and managing advertising data.
• Google Analytics: account and property information, streams, key events, links, definitions and aggregate analytics reports, using read-only permission.
• Google Tag Manager: account and container information, workspaces, versions, tags, triggers and variables. Read access is separate from optional permissions to edit containers, create versions and publish reviewed changes.
• Google Search Console: accessible site properties, search performance and stored URL inspection results, using read-only permission.
• Meta advertising and connected assets: authorized advertising accounts, campaigns, budgets, configuration, performance, and Facebook Page and Instagram professional-account identifiers and available profile details needed for the integration.
• Instagram conversations: conversation and message identifiers, dates, sender and recipient details returned by Meta, message text, replies, shared content, attachment metadata and URLs, and referral or advertising identifiers when available. Message text may contain personal information supplied by participants. The module stores attachment information but does not download the attached files.

The application does not request Gmail, Google Drive or Google Cloud administration access. Separate local credentials are used for advertising, read-only measurement and optional Tag Manager editing and publication.

2. How data is used

Data is used to answer the operator's advertising and analytics questions, inspect measurement, prepare reports and support authorized campaign changes. Requests explicitly identify the Google user profile and target account or resource. Access is limited by the user's Google permissions. Meta requests likewise specify an authorized advertising account or approved client project; Meta permissions remain decisive.

Instagram conversation data is used to assess the subject and quality of enquiries, stated booking intent and administrator responses for the authorized client. Booking statements in a conversation are distinguished from independently confirmed payments. Advertising attribution is recorded only when supported by explicit evidence; otherwise the source remains unknown. Message history may be incomplete. The module does not send messages or change inbox statuses or labels.

Advertising updates can be prepared and validated before application. Tag Manager changes require an explicit target, a reviewed before-and-after plan and separate authorization; publication is a separate operation. The tool does not change Google Analytics or Search Console settings.

3. External service providers

The operator uses external service providers to process selected requests and platform data for analysis and reporting. This can include Instagram message text and associated details. These providers process the selected information outside the operator's computer, subject to their terms, account settings and retention policies. Local storage of application records does not mean that all data remains exclusively with the operator. The conversation module does not automatically anonymize message contents.

The operator must use provider settings and account permissions appropriate to the data being processed. Google user data may be shared only as needed to provide the requested user-facing features with authorization and in accordance with Google's Limited Use requirements. The application does not sell Google or Meta platform data, use Google user data for advertising profiles or operate a public account-data service.

OAuth credentials are used to authenticate access to the relevant platform and are excluded from analysis results. For questions about external processing or the providers involved, contact support@mkworkbench.com.ua.

Ads Workbench MK's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Storage, retention and security

OAuth credentials are stored in restricted files on the operator's computer. Local reports, connection checks and change records may include account identifiers, campaign settings, advertisement text, before-and-after values and responses from Google.

For Meta, the main authorization is held by the desktop client; Page access tokens used by the module are kept in memory. Conversation data is stored locally, separately by client project, in a SQLite database and optional JSONL exports. Stored material can include message contents, available raw API records, previous record versions and synchronization diagnostics. Local file access is restricted; the conversation module does not add database encryption.

These local records remain until the operator deletes them; automatic retention expiry is not currently implemented. Credentials and private reports are kept outside the public website and its source repository. Network requests to Google and Meta use HTTPS. Access to the computer and the selected MCP client remains the operator's responsibility.

5. Control, revocation and deletion

You can revoke Google access at Google Account connections. Revocation prevents future use of the revoked authorization but does not delete previously saved reports or records held by service providers.

For Meta, remove UFA Ads Workbench in the connected account's Facebook Business Integrations or Apps and Websites settings to revoke its access. Revocation does not erase existing local databases, previous record versions, exports or external provider records. See the data deletion instructions for a separate deletion request.

To request deletion of locally retained application data, contact support@mkworkbench.com.ua and identify the relevant account or report without sending passwords or access tokens. Requests affecting advertising accounts require verification of the requester's authority. A person requesting deletion of their own conversation data can identify the relevant business page and Instagram handle without sending the complete conversation. After verifying the request as needed, the operator will manually delete applicable local data under the operator's control and confirm completion or explain any limits. Data held by an external service provider must also be managed through that provider's controls; local deletion does not itself remove those records or messages held by Meta.

6. This website and support messages

This website contains no sign-in form, advertising pixels or analytics scripts added by the operator. The hosting provider processes ordinary network request information needed to deliver and secure the pages, such as an IP address and browser request headers.

If you email the operator, your email address and message are used to respond to your request. Please do not include credentials or unnecessary personal information.

7. Operators and contact

This policy will be updated when data handling changes. The effective date appears above.

Meta integration operator: Товариство з обмеженою відповідальністю «М-КІНО» (Ukraine)
Authorized representative and contact: Maksym Korkodym
Google integrations and website operator: Maksym Korkodym
Support: support@mkworkbench.com.ua