You run paid media at a scale where a new tool goes through security or legal before it goes anywhere near an ad account. The AI tool you are evaluating has passed the demo. Now the review asks what happens to your ad-account data once the AI is connected, and it wants the answer from the vendor's documents, not from the sales deck. This comparison is written for that review: for advertisers and agencies for whom data security is a gate and who connect at a scale where one wrong permission reaches every client account.
The question is sharper than it was a year ago. In 2025, OAuth tokens stolen from one AI chat app, Salesloft Drift, gave attackers data from many companies' Salesforce instances. IBM's Cost of a Data Breach study counted breaches of AI models or applications at 13% of organizations in 2025 and more than 20% in 2026. In October 2026, a phishing kit imitating ChatGPT, Claude, and Meta's Muse as ad tools ended every page at a "Connect your ad account" button.
The comparison covers eleven tools, our own included and held to the same lines as the rest, on three questions: what is collected, trained on, and sold; what is deleted on request; and what the tool can do in your account without you. Three things worth doing before you read it:
- Send legal the vendor's DPA and privacy policy.
- Where the tool offers a read-only role, connect with it first and widen the scope only after the review clears it.
- Ask what the tool can change when nobody is in the chat, and where that change is logged.
How this comparison was built
Each tool was read from its own public privacy policy, data processing agreement, security or trust page, and product documentation as they stood on Nov. 11, 2026, with document dates given in each entry. Nothing was tested hands-on. Reviews and forums tell you how a tool behaves; they can't tell you what a vendor does with your data, so for these three questions the only source is the vendor's own document. Where a vendor's pages say nothing on a point, the entry says so.
Tool by tool
Entries are alphabetical, with the platform route last. Each carries the same seven lines: the documents it publishes and the platform partnerships it names, what it collects and where it is hosted, whether it trains on your data, whether it sells or shares it, how deletion works, what it can do in the account without you, and the one line a security review sends back.
Adalysis
Documents: privacy policy and terms, undated; no DPA, no security page, no certification; no platform partnership stated.
Collects: "the structure of your accounts and campaigns, spend and results, product and audience information, and website traffic and conversion data," and "no more"; audience lists are not downloaded. Hosted in the UK and the US.
Trains on your data: no: "We do not use it to train artificial intelligence or machine learning models."
Sells or shares: "We do not sell it"; not used for Adalysis's own advertising.
Deletes: connected-account data is kept while the account stays connected; UK and EEA requests answered within one month; disconnecting a login removes its data and "access stops immediately."
Can act without you: connects through your own login and reads all enabled campaigns; changes only the ones you ask for or the rules you enabled. The MCP connector is read-only unless you tick "Allow this assistant to make changes to my accounts" at consent; every change is approved, previews expire after 10 minutes, and budgets and bids stay out of reach. Change history labels automated changes; a view-only role exists.
Ask them for: a DPA, and a version date on the policy.
Birch
Documents: privacy policy and DPA (Oct. 14, 2026), help center; no certification named; official Meta, Google, TikTok, and Snapchat partner.
Collects: "campaign performance data, advertising metrics, and account information" from connected platforms, processed "solely to operate the Services." Hosted in the US; agent logs in the EU.
Trains on your data: no: OpenAI, the model provider, "does not use this data to train its models"; it keeps prompts up to 30 days for abuse monitoring, and Birch keeps agent logs for no longer than 90 days.
Sells or shares: "does not and will not sell"; not used "for Birch's own independent marketing purposes."
Deletes: "within ninety (90) days of receipt," with written confirmation.
Can act without you: Birch AI with Meta MCP works one ad account per request; every tool defaults to "Needs approval," per person, and "Everything Birch AI creates is created paused." A Routine asks before each change unless set to "Approved in advance" for the accounts you select. Birch MCP creates rules from your own AI client after showing a preview, manages existing rules, and stays read-only on campaigns, ad sets, and ads; access is revoked from Settings.
Ask them for: the certification summaries the DPA offers on request.
Hunch
Documents: privacy policy (Oct. 10, 2018), terms (Jan. 22, 2025); no DPA, no security page, no certification; Meta Business Partner.
Collects: "Ad Account Access" and "Business Manager Access"; Hunch fetches "your businesses, ad accounts, pages, and catalogs." Hosted in the US.
Trains on your data: not stated; the terms do let Hunch analyze "anonymous customer advertising data and performance metrics data" itself and "via third parties."
Sells or shares: "not in the business of selling your information"; aggregate data shared with partners.
Deletes: at termination, each party deletes or destroys confidential information; no timeframe.
Can act without you: connecting needs Admin over the whole Business, and the assets are then available across your team. Rules "execute the defined action automatically," with an alert-only option; Autopilot is "instantly creating, editing, or pausing the ads," with no approval step described; "most actions cannot be undone." Logs are per campaign.
Ask them for: a policy newer than 2018, and processor terms.
Kitchn
Documents: privacy policy (Sept. 4, 2026), terms (July 1, 2021), two help articles on data and security; no DPA, no security page, no certification; no platform partnership stated.
Collects: user data, ad account IDs, and performance data "only stored - when necessary - for a required use case"; "never stores the individual customer data of our customers." Hosted in the EU.
Trains on your data: not stated; anonymized usage data may be used to improve the software.
Sells or shares: no statement for ad-account data.
Deletes: personal data within one month on request; ad-account data after termination not stated.
Can act without you: one main user's Meta login, with ad accounts selected one by one. Rules, on Enterprise, act when their conditions are met; ads are created paused by default. The Claude and ChatGPT connectors add ads as drafts and start rules paused, "Nothing is saved until you agree," and "Every call lands in your organization's audit log, with who made it and which tool ran." Tokens expire on a date you pick.
Ask them for: a DPA and a training statement.
Madgicx
Documents: privacy policy (Jan. 24, 2023), terms (Nov. 18, 2024); no DPA published, no security page, no certification; Meta Business Partner.
Collects: the privacy policy does not mention ad-account data; connecting needs Admin on the ad account, the Page, and the pixel. Hosting region not stated.
Trains on your data: allowed: the terms permit "Customer Data in an anonymized manner for machine learning."
Sells or shares: "We do not sell your personal information."
Deletes: from the settings page or by email; no timeframe.
Can act without you: automations run continuously once switched on; AI Marketer runs autonomous or with approval, your choice. The MCP server has 27 write and delete tools, and the approval sits in your AI client, not on the server; team admins can revoke access. Actions show per asset; there is no view-only role.
Ask them for: the DPA the terms refer to, and a sub-processor list.
Mediaocean / Innovid
Documents: privacy policy (Oct. 23, 2026), DPA (May 2026), Master Terms (undated); SOC 1 and SOC 2 Type 2; ISO 27001 at Innovid; Meta Business Partner and TikTok Marketing Partner.
Collects: acts "only as a data processor"; credentials, action logs, and audit trails; audience services hold identifiers and contact data. Hosted in the US.
Trains on your data: no, on the NIVO page: "Client data is never used to train external AI models"; the contract itself has no AI clause.
Sells or shares: the DPA prohibits selling.
Deletes: no obligation to keep data more than 90 days after termination, after which Mediaocean "may retain a copy"; an export file is offered at termination.
Can act without you: the connection scope is not documented. NIVO on Meta's ads MCP server "doesn't autonomously change your Meta campaigns"; its Social Agent pauses ads and shifts budgets, "validated automatically before anything goes live"; "Human oversight governs high-impact decisions." The agents are in pilots.
Ask them for: the no-training line in the DPA, and the connection scope.
Optmyzr
Documents: privacy policy and terms (March 25, 2026), DPA (Aug. 28, 2020), MCP privacy article; an annual SSAE 18 report under the DPA; no SOC 2 or ISO named; Google Partner, Microsoft Advertising Select Partner, Meta Business Partner, Amazon Ads Verified Partner, TikTok Marketing Partner.
Collects: performance and settings data; customer match and audience lists "may be accessible through the MCP." Hosted in the US and other countries.
Trains on your data: no for "foundation or general-purpose models"; prompts and outputs do "improve our AI systems." OpenAI, its sub-processor, does not train on the data by default.
Sells or shares: not shared "for their own marketing purposes."
Deletes: "after 30 days" of account deletion or termination; MCP server logs are kept "indefinitely."
Can act without you: on Google, every account under the manager account is linked by default. Manual tools need "Apply"; the Rule Engine can apply changes itself or notify. From an AI client, "Nothing reaches your account until you confirm it," and writes stop at keyword creation. Optimization History records the login; read-only access levels are Enterprise only.
Ask them for: one training statement, and a reason for indefinite logs.
Skai
Documents: privacy policy (Aug. 30, 2026), trust center; ISO 27001:2022 and SOC 2 Type 2 reports under NDA; the DPA and current terms are not public; Amazon Ads Advanced Partner, Walmart Connect Premium Partner.
Collects: your ad data sits outside the privacy policy, which "does not apply to" data "controlled by the Customers." Hosted in the EU and the US.
Trains on your data: no for Celeste, the assistant ("is not trained on your organization's data"); no platform-wide statement.
Sells or shares: does "not sell, rent or lease" personal information. The platform is single tenant.
Deletes: "it will take some time until we completely delete residual copies"; no timeframe.
Can act without you: agent connectors work through your own Skai login and permissions; the Reporting connector "never changes anything," Campaign Actions are "previewed for a person to approve before it's applied," and Auto Mode is "not recommended." Whether core bidding and budget automation writes without approval is not stated.
Ask them for: the DPA and terms under NDA, with a deletion clause that has a number in it.
Smartly
Documents: privacy policy (January 2026), terms (Feb. 1, 2026), DPA, sub-processor page, security page; ISO 27001; no platform partnership shown.
Collects: campaign entities and metrics, "encrypted at rest." Hosted in the EU.
Trains on your data: no: "does not use Customer Content to train Smartly.io AI Models," and third-party models are contractually restricted from training on it.
Sells or shares: the DPA bars selling Personal Data; spend and settings data may be analyzed for product development, disclosed only "in an anonymized form."
Deletes: Facebook ad account data 30 days after termination; backups after 90 days.
Can act without you: the authorizing user "must have full Admin access to all relevant ad accounts." Budget allocation and triggers run on their own; Synapse agents act "with or without human input," and "built-in approvals ensure agents act only when you choose." A customer-visible log of agent actions is not documented.
Ask them for: which third-party models the no-training clause binds, and where agent actions are audited.
Sprinklr
Documents: privacy notice (Nov. 1, 2026), DPA v2.10, AI Addendum, security addendum, and MSA (May 2026; the AI Addendum August 2025), sub-processor list (Oct. 1, 2026), trust center; SOC 2 Type II, ISO 27001:2022, FedRAMP Low; Meta Business Partner and TikTok Marketing Partner.
Collects: platform content, connected ad accounts, customer lists, pixels, and catalogs. Hosted in the US or the EU, set in the Order Form.
Trains on your data: no unless you authorize it (AI Addendum); its AI providers are Amazon Bedrock, Azure OpenAI, OpenAI, and Google Vertex.
Sells or shares: "shall not (i) Sell or Share any Personal Information."
Deletes: the MSA says Sprinklr "will delete customer's available content" within 30 days after termination; on request, no timeframe.
Can act without you: Meta ad accounts are ticked one by one as "Publishing and Reporting or Reporting only." The Rule Engine pauses and raises budgets on schedule, and anomaly detection pauses on its own; approval workflows are optional unless a rule routes items through them. The Ads Publishing Agent, in limited availability, creates drafts for review; Sprinklr MCP is read-only. The Audit Trail in Ads Manager records changes, credited to whoever authenticated the token.
Ask them for: which of its two training statements governs, with the AI Addendum attached.
Your own AI client on Meta's or Google's server
Documents: Anthropic and OpenAI privacy policies (Sept. 10, 2026); Meta's and Google's MCP server documentation.
Collects: the ad data goes to the model provider under your plan; Meta's server exposes reporting, creatives, audiences, and catalogs.
Trains on your data: depends on the plan: Claude's consumer plans train by default but exclude content from MCP servers; ChatGPT's consumer plans may use app data when "Improve the model for everyone" is on. Business and API plans of both don't by default.
Sells or shares: the ad platform processes under its own terms; the model provider holds the conversation.
Deletes: deleted conversations leave both providers' systems within 30 days; API logs are kept 30 days.
Can act without you: on Meta, the consent screen exposes every ad account under a business portfolio you tick; write tools create entities paused and your client confirms activation; edits to budgets, audiences, catalogs, and pixels have no documented confirmation step; ads MCP server rules deny actions per account. Claude and ChatGPT ask before a write unless you allow a tool always. On Google, you host the server yourself; it is read-only once the asset and label tools are switched off in its config.
Ask them for: the plan each seat is on, because a personal plan and a business plan give the same ad data different training and retention terms.
Which route fits which situation
A review that starts with the DPA. Birch, Mediaocean, Skai, Smartly, and Sprinklr publish one (Skai under NDA). What to settle before signing is how the automation decides: in the suites, pacing, auto-pause, and rules run on their own once configured, and approval gates sit on the newer agents, not on the engine underneath. Worth asking for the list of actions that run unattended, and for the preview mode where one exists.
A single-platform optimizer with an autonomous mode. Madgicx and Hunch on Meta, Optmyzr and Adalysis on Google. Thresholds you set decide, and the tool executes; the question is whether a per-action approval exists at all. Madgicx and Hunch run continuously by design, and Madgicx's MCP approval lives in your AI client. Optmyzr and Adalysis stage changes from an AI client for a person, and Adalysis starts read-only.
Your own AI client on the platform's server. Nothing sits between the model provider and the ad platform: the cleanest data path and the most exposed write path. Training and retention follow the seat type; the write gate is your client's tool approval plus Meta's paused creation and rules, or on Google the tools you leave enabled. What's missing is a rules engine and a second log. The Meta side is in Meta ads MCP: what AI agents can and can't do in your ad account.
Always-on rules you want an AI to write and audit, but not to spend through. Birch. The rules run unattended on the thresholds you set, as any rule-based automation does; Birch AI drafts rules you review before publishing, Birch MCP creates and manages rules from your own client after a preview, and one-off Meta changes go through per-tool approval, with anything new created paused.
What a security review will ask
Four things come back on almost every review and need the vendor in writing:
- The sub-processor list, with the AI providers on it. Birch and Sprinklr name their model providers in a list; Optmyzr names OpenAI in a help article. For the rest, "we use AI" without a named provider means the retention terms are unknown.
- The model provider's own retention. A no-training clause says nothing about how long prompts and tool results are kept, or whether zero retention is available. Ask for both numbers.
- Hosting region and the transfer mechanism. Each entry names the region its documents state; Madgicx's don't. The transfer mechanism belongs in the DPA.
- The change log you can see. Vendor-side logging is near universal; a customer-visible log of what the tool or its agent changed, by whom, is rarer. Adalysis's change history and Kitchn's connector log document one; most entries don't.
For an agency, two more: per-client separation inside the tool, because one connection with Business-level admin exposes every client under it, and the agency's own seat type on the model provider, because the client's data inherits it.
The eight-question connection review
The checklist is the artifact to keep. Send it to any vendor before an AI touches an ad account; the answers go into the review file next to the DPA.
- What exactly do you pull from the ad account, is it stored or queried live, and does it include audience lists or customer data?
- Do you, or any model provider you use, train on our ad-account data? Show the clause.
- Which AI providers are sub-processors, and what are their retention terms for prompts and tool results?
- Where is our data hosted, and under which transfer mechanism?
- What is the connection scope: one ad account, selected accounts, or everything under the Business Manager or MCC?
- Which actions run without a person approving each one, can they be switched to approval or notify-only, and what is created live rather than paused?
- Where do we see every change the tool or its agent made, attributed to a person or client, and can we export it?
- When we leave, how many days until deletion, and will you confirm it in writing?
A vendor who answers all eight from documents is the one the review clears fastest. Silence on any of them goes back as a condition of the connection.
Birch's entry is built from the same documents as the rest. If the next step is connecting your own AI client to the rules it audits, the setup is at bir.ch/mcp.
.png)
