Terms of Service

1. Acceptance of Terms

By creating an account on gadspilot.com or using the Gadspilot MCP service, you agree to be bound by these Terms of Service ("Terms"). If you do not agree, do not use the service.

2. Description of Service

Gadspilot is a Model Context Protocol (MCP) server that allows you to expose your Google Ads accounts to AI clients such as Claude (by Anthropic). The service is provided free of charge in v1, with no usage limits beyond those imposed by the Google Ads API itself.

3. Google Ads API Compliance

Gadspilot uses the official Google Ads API to read and modify data in the Google Ads accounts you explicitly authorize. By using Gadspilot, you acknowledge that:

• Your use of the service is subject to Google's Google Ads API Terms of Service and Required Minimum Functionality.
• Gadspilot will only access Google Ads accounts you explicitly authorize via OAuth.
• OAuth tokens issued by Google are stored encrypted at rest and never shared with third parties beyond the AI client you connect (e.g. Claude).
• You can revoke Gadspilot's access at any time via your Google Account permissions.

4. Write Operations & Dry-Run

Gadspilot supports write operations on Google Ads (campaign creation, budget updates, keyword changes, etc.). All write operations default to dry-run mode, meaning the AI must explicitly request dry_run=false to actually execute changes. Every write attempt — dry-run or real — is logged with full parameters for audit purposes.

You are solely responsible for any change executed through Gadspilot. We strongly recommend reviewing all proposed changes before authorizing real execution.

5. Account Responsibility

You are responsible for safeguarding your account credentials and the MCP tokens we generate. The OAuth-based MCP URL (the recommended mode) is protected by per-session Bearer tokens; the legacy token-in-URL mode embeds a static secret and should never be shared publicly.

6. Acceptable Use

You agree not to:

• Use Gadspilot to access Google Ads accounts you do not own or have explicit authorization to manage.
• Attempt to abuse, overload, or reverse-engineer the service.
• Use the service to violate any law or third-party rights.
• Use the service to send spam, generate misleading content, or violate Google's Ads Policies.

7. Service Availability

Gadspilot is provided "as is" without warranty of any kind. We do not guarantee uptime, accuracy of data returned by the Google Ads API, or fitness for any particular purpose. We may modify, suspend, or terminate the service at any time without prior notice.

8. Limitation of Liability

To the maximum extent permitted by law, Gadspilot, its publisher (Stay Web SASU), and its affiliates shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the service, including but not limited to losses caused by changes executed via AI clients on your Google Ads accounts. Service hosted by LWS.fr (French) / LWS.net (English), ISO 27001 certified, France.

9. Termination

You may delete your account at any time via the dashboard, which will remove all stored data including OAuth tokens, MCP tokens, and request logs. We may terminate accounts that violate these Terms.

10. Changes to Terms

We may update these Terms at any time. Material changes will be communicated by email to registered users. Continued use of the service after changes constitutes acceptance.

11. Governing Law

These Terms are governed by French law. Any dispute will be resolved by the competent courts of France.

12. Contact

For questions about these Terms, see our contact page.

1. Who we are

Gadspilot is operated by Depredurand Nicolas, a French web hosting company. Hosted by LWS.fr (French) / LWS.net (English) — ISO 27001 certified infrastructure. Contact: contact@gadspilot.com.

2. What data we collect

We collect the minimum data required to operate the service:

• Account data: your name, email, hashed password.
• Google OAuth tokens: access_token and refresh_token issued by Google for each Google Ads account you connect. These are encrypted at rest via Laravel's Crypt facade (AES-256-CBC).
• Google Ads account metadata: customer ID, descriptive name, currency, timezone.
• MCP tokens: the per-account UUID v4 tokens used to authenticate Claude.
• Request logs: timestamp, MCP method (e.g. tools/call), tool name, success/error, duration. We do not log the actual data returned by the Google Ads API.
• Write action logs: every write operation (real or dry-run) is logged with full parameters for audit purposes.

3. What we do NOT collect

• We do not store the content of your Google Ads campaigns, ads, keywords, or performance data beyond what's needed to identify your accounts.
• We do not use cookies for tracking. We use only essential cookies for session management and CSRF protection.
• We do not run third-party analytics, advertising trackers, or fingerprinting.

4. Google API Services User Data Policy

Gadspilot's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• Data accessed via Google APIs is used only to provide the Gadspilot service to you.
• We do not transfer Google user data to third parties except when necessary to provide the service (e.g. forwarding tool responses to the Claude AI client you authorized).
• We do not use Google user data for advertising or to build user profiles.
• Humans do not read Google user data unless required for security investigations or legal compliance.

5. Data sharing

We do not sell or rent your data. Data is shared only:

• With Google, when calling the Google Ads API on your behalf (using your OAuth token).
• With the AI client (e.g. Claude.ai) you connect to Gadspilot — and only the data your AI requests through MCP tool calls.
• With our hosting provider — LWS.fr (French) / LWS.net (English), ISO 27001 certified, France — which stores the database file.

6. Data retention

• Account data and OAuth tokens: kept until you delete your account.
• OAuth authorization codes: deleted after use or 1 hour.
• OAuth access tokens: kept until 7 days after expiration.
• MCP request logs and account access logs: kept for 45 days, then automatically purged.

7. Security

We use industry-standard security practices: HTTPS-only, encrypted-at-rest OAuth tokens, hashed passwords (bcrypt), CSRF protection, OAuth 2.1 with PKCE for MCP authentication, per-account write toggles, and dry-run defaults on all write operations.

8. Your rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access the data we hold about you (available in your dashboard).
• Rectify inaccurate data.
• Delete your account and all associated data (one-click in dashboard).
• Export your data (contact us).
• Lodge a complaint with the French data protection authority (CNIL).

9. Revoking Google access

You can revoke Gadspilot's access to your Google Ads accounts at any time:

• From the Gadspilot dashboard (per-account or all at once).
• From your Google Account permissions.

10. Changes to this policy

We may update this policy. Material changes will be communicated by email.

11. Contact

For privacy questions: contact@gadspilot.com