Privacy Policy

How Agency Autopilot accesses, uses, stores and shares Google user data. Last updated 12 October 2026.

Agency MCP is operated by Jiyu Marketing LLC ("we", "us"). Agency MCP is now called Agency Autopilot; both names refer to the same service, and this policy uses the new one. This policy covers the Agency Autopilot service at mcp.jiyumarketing.com only.

The public pages of this site (not the dashboard) use Google Analytics to count visits. It sets cookies and sends page views to Google on our behalf; it is not used on the pages where you manage client accounts.

Google user data we access

When you connect Agency Autopilot you grant access through Google OAuth. We request these scopes and no others:

Scope	What it lets us read
openid, email, profile	Your Google account identifier, email address and name — used to identify your account and keep it separate from other customers'.
analytics.readonly	Read-only access to the Google Analytics properties your account can already access: the list of properties, and report data such as sessions, conversions and channels.
webmasters.readonly	Read-only access to the Search Console sites your account can already access: the list of sites, and search performance data such as clicks, impressions, click-through rate and position.
analytics.edit	Sets up Analytics for a client you have registered: creates a GA4 property and its web data stream, marks events such as generate_lead and phone_click as key events, and links the client's Google Ads account to the property — only when you ask, and only after a preview you confirm. Nothing is deleted or edited; existing properties, streams, key events and links are never changed.
webmasters	Adds a site to Search Console and submits its sitemap, for a client you have registered — only when you ask, and only after a preview you confirm. Nothing is removed.
siteverification	Fetches an ownership-verification token for a client's site and asks Google to verify it, so the site appears in Search Console. Nothing is un-verified.
adwords	Access to the Google Ads accounts your account can already manage: listing accounts, reporting on spend and results, keyword research, and creating or changing campaigns, ad groups, keywords, ads and budgets. Every change is previewed and applied only on your explicit confirmation; new campaigns and ads are created paused.

Agency Autopilot cannot reach any account the signed-in Google user could not already reach by signing in to Google directly. In Analytics and Search Console the service reads reports and, when you ask, adds new set-up (a property, key event, Ads link, site or sitemap); it never edits or deletes what exists. Google Ads access can make the changes you ask for, each previewed first.

An account can hold more than one Google login. Each request is made with the login that has access to the property, site or Ads account being asked about, and never reaches an account that login could not already reach.

How we use it

Solely to answer the requests you make through your AI assistant. When you ask a question we call the relevant Google API, return the result to your assistant, and the request ends. We do not use Google user data for advertising, for profiling, or to train any machine-learning model, and we do not use it for any purpose other than providing this service to you. Features you switch on (Autopilot, reports, live dashboards) also run in the background, and Autopilot is improved using combined results across agencies, as described under Improving Autopilot, which you can opt out of.

What we store, and what we do not

We store

Your account record — Google account identifier, email address and name.
How and roughly where you signed up — which assistant or directory added the connector, the referring site if any, and the country, region and city your network reported at sign-in. We do not store your IP address. We use this to understand who the service reaches, and your contact details are kept in our own CRM so we can send you a welcome message and reply to you; you can opt out of email by replying “stop”.
An OAuth refresh token for each Google login connected to your account (your own, any further login you add, and any a client connects through an access link you sent), so the service keeps working without asking anyone to sign in repeatedly. Tokens are held in our database and are never displayed to you or anyone else.
An audit log entry per request — the time, your account, which tool ran, and the parameters you supplied. Parameters can include identifiers such as an Analytics property ID, a Search Console site URL and a date range. Failed requests also record the error returned, for diagnosis.
Client definitions you create — the client name you choose and the platform identifiers you link to it.
Client access links you create — the client name you entered, which platforms you asked for, when the link expires, and which logins were connected through it.
Credentials for non-Google platforms you connect (for example a WordPress application password, or a Meta or CRM access token), encrypted at rest and never displayed back to you.
Your agency branding — agency name, contact email, colors and the logo file you upload.
Billing records — your plan, subscription status and a Stripe customer identifier. Card details are handled by Stripe and never reach us.
🔴 Report and dashboard contents that you choose to create. See below.

Reports and client dashboards store Google user data — deliberately

When you create a client report, or switch on a live dashboard for a client, we store the figures behind it — including Analytics and Search Console data such as sessions, clicks, impressions and average position:

A saved report is rendered once and stored as a fixed page, so the client you send it to still sees the same figures months later. It stays until you revoke it.
A live client dashboard stores a periodic snapshot of that client's figures and serves the stored copy. This is why opening the dashboard never uses your platform logins, and why someone holding the link cannot cause requests against your accounts.

Both are created only by an explicit action of yours, and both are deleted when you revoke the report or switch the dashboard off. If you do neither, no Analytics or Search Console data is retained: results are fetched when you ask, passed to your assistant, and discarded.

We do not store

Any Google user data belonging to one customer in a form another customer could reach. Every query is scoped to the account that made it.
Payment card details. Those are held by Stripe.
Google user data for advertising, resale, or model training. We do none of those.

Google Business Profile

Business Profile is a separate, optional sign-in ("Connect Business Profile" on the dashboard). It uses a different Google OAuth client from the main connection, because Google grants Business Profile API access per project, and it requests one additional scope:

Scope	What it lets us do
business.manage	Access to the Business Profile locations the signed-in Google account already manages: listing locations, reading reviews and performance figures, and — only when you ask, and only after a preview you confirm — replying to reviews and publishing posts. Nothing is deleted.

The refresh token for this sign-in is stored encrypted, separately from the main Google connection, and is removed when you click Disconnect. Everything else on this page (how we use data, what we store, and what we do not) applies to Business Profile data in the same way.

When a client connects their own accounts

An agency using Agency Autopilot can send one of its clients an access link. If you are that client and you open the link, you choose which of your own accounts to connect: your Google account (Analytics, Search Console and Google Ads), Meta ads, Google Business Profile, your CRM, or your WordPress site. You sign in with Google or Meta directly, or enter a WordPress application password or CRM token yourself. The page names the agency that sent the link and says what each connection allows before you connect anything.

Connecting gives that agency, and only that agency, access to the accounts you chose, through Agency Autopilot. Everything in this policy applies to your data in the same way: the same permissions, the same uses, the same storage, and the same limits. We store an OAuth refresh token or the credential you entered, encrypted, so the connection keeps working. We do not use your data for advertising or to train models, and we do not share it with anyone other than the agency you connected for and the AI assistant that agency uses.

You can end the connection at any time without asking anyone: remove Agency Autopilot at myaccount.google.com/permissions for Google, under Facebook Settings → Business Integrations for Meta, or delete the application password or token you created. You can also ask the agency to remove your login, or email harrison@jiyumarketing.com and we will remove it within 30 days.

Meta Platform Data

If you connect a Meta account, Agency Autopilot accesses only the ad accounts and Pages that your own Meta login already manages, under the permissions ads_read, ads_management and business_management.

What we access	Why
Your ad accounts and their names, currency and status	So you can pick the right account and link it to a client
Campaign and account performance — spend, impressions, clicks, leads	Reporting, and comparing Meta against the client's other channels
Campaign creation and changes to budget or status	Only when you ask for them, and only after you confirm each change

We store your Meta access token, encrypted at rest, so the connection keeps working; it is never displayed to you or anyone else. Meta performance figures are stored only inside a report or client dashboard that you chose to create, exactly as described above for Google data. Disconnecting Meta deletes the stored token immediately.

We do not sell Meta Platform Data, do not combine one client's data with another's, do not use it for our own advertising, and do not use it to train models. See Deleting your data for how to remove it.

Sharing

We do not sell Google user data and we do not share it with third parties. It travels only between Google's APIs, our service, and the AI assistant you connected. Our infrastructure runs on Cloudflare, which processes and stores this data on our behalf as a service provider and for no independent purpose.

Autopilot (optional). Only when an agency previews Autopilot or switches it on for a client, the Google Ads search terms that cost money without a lead — with that client's business name, website, city, keywords and campaign names — are sent to Anthropic's API so its Claude model can judge which terms are irrelevant to the business. When Autopilot's lead watch finds that leads stopped, the daily counts, landing-page checks and recent account changes behind that finding are sent the same way, so Claude can explain the likely cause. Anthropic processes them as our service provider, only to return that judgement, and does not use them to train its models. No other Google data is sent, and nothing is sent for a client where Autopilot is off.

Improving Autopilot. To learn which kinds of change bring in leads, we compare the results of changes made through Agency Autopilot across the accounts connected to the service, whether Autopilot made the change or the agency made it itself. For each change we record its kind (for example “paused a keyword”), the client’s line of business, what prompted it, and how that client’s leads, cost per lead and (where a CRM is connected) won deals moved afterwards. Only combined results are used to steer Autopilot, and only once a pattern holds across five or more clients. Those results are counts and percentages, never another agency’s name, clients, accounts or figures, and they are included in the instructions Autopilot gives each agency’s own AI assistant. We also review these results ourselves, including which agencies switched Autopilot on or off and the reasons they gave, to find and fix problems in Autopilot. None of this is sold or shared with anyone else.

Opting out. On your dashboard, open Account → Privacy and choose Leave my clients out, or email harrison@jiyumarketing.com. From then on none of your clients’ results are included in the combined learning. Autopilot still learns from your own clients for your own account, and you can include your clients again at any time.

Retention, revocation and deletion

Your account record and refresh token are kept while your account is active. Audit log entries are kept for operational and security review.

You can disconnect at any time at myaccount.google.com/permissions, which immediately revokes our access. You can delete stored report and dashboard data yourself at any time — revoke a report, or switch a client dashboard off — and doing so removes the stored figures. To have your stored account record, refresh token and audit history deleted, email harrison@jiyumarketing.com and we will delete them within 30 days.

Security

All traffic is encrypted in transit over HTTPS. Credentials are held as secrets, are not written to logs and are not exposed by any endpoint. Access is scoped per customer and enforced at the database layer.

Limited Use

Agency Autopilot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Changes and contact

If this policy changes materially we will update this page and the date above. Questions: harrison@jiyumarketing.com, Jiyu Marketing LLC, Provo, Utah, USA.