Skip to main content

Privacy & Data Handling

This page summarizes how the headless REST API and MCP server handle your data. It is a technical overview for integrators. Your use of the API is governed by the NativeAds Terms & Conditions, which also contains the privacy and cookie policy.

What the API processes​

  • Brand information you create or update (name, industry, description, values, tone, voice, logo).
  • Assets you upload (images, video, documents) and URLs you submit for Brand DNA extraction.
  • Generation inputs (prompts, source asset references, model and format selections).
  • Usage metadata (which operations ran, against which organization, for billing and rate limiting).

All data is scoped to your organization. A key or OAuth token can only read and write data belonging to the organization it was issued for.

How credentials are protected​

  • API keys are never stored in plaintext. Only a keyed hash (HMAC-SHA256 with a server-side secret) is persisted; the secret portion of the key is shown once at creation and never again. Compare, revoke, and expiry checks run server-side.
  • OAuth tokens are opaque and verified by introspection against the authorization server on every request, so revocation and role changes take effect immediately.
  • Access is resolved from your live organization membership. Removing a user or changing their role changes what their key or token can do on the next call.

Asset storage and delivery​

Uploaded assets are stored in cloud object storage. Downloads are served through short-lived, signed URLs, they are not publicly listable. Requesting an asset returns a signed URL that expires. Bytes are uploaded by your client directly to a presigned URL; the MCP transport never carries file contents.

URL fetching (Brand DNA)​

When you submit urls for Brand DNA extraction, the platform fetches those pages server-side. Only public http/https addresses are allowed. Requests to internal, loopback, link-local, and cloud-metadata addresses are rejected at submission and again at fetch time.

Data retention and deletion​

Brands, assets, and Brand DNA versions persist until you delete them. Brand DNA versions can be deleted via the API (delete_brand_dna_version / DELETE …/brand-dna/versions/{versionId}). For deletion of other data or a full account, contact support@nativeads.ai.

Contact​

Security or privacy questions: support@nativeads.ai.