Privacy policy

This policy explains how MKAMG Pty Ltd (“we”) handles personal information in MCG Launch (“the service”), software that businesses use to launch and manage Meta (Facebook and Instagram) advertising and their creative assets. We are based in Melbourne, Australia, and handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles.

Each business that uses the service (“the customer”) decides what it connects and puts in. For that content and advertising data we act on the customer's behalf and instructions. For the accounts of the people who sign in, we are responsible.

Information we handle

• Your sign-in details: your name, email address and profile picture from Google when you sign in, your organisation, role and language choice.
• Meta advertising data: through the Meta app and tokens the customer connects, we read and manage its Business Managers, ad accounts, Pages, Instagram accounts, pixels, custom audiences (names and sizes only), conversions, campaigns, ad sets, ads, and their settings, statuses and performance figures. These figures are aggregated by Meta; we do not receive the identities of people who see the ads, and we do not upload customer lists to Meta.
• Google Drive files you choose: when you import from Drive, the service can access only the files and folders you pick (the drive.file permission) or folders your organisation shares with our service account. It copies those images and videos into your organisation's media library and reads their names and folder structure.
• Content you create: media, ad copy, launch settings and templates, Creative board cards, briefs, references, comments, tasks and Offer Brain content.
• Keys and tokens: Meta access tokens, AI provider keys and assistant (MCP) keys your organisation creates. They are stored encrypted.
• Activity and technical data: who did what and when (for example who launched a campaign), session records with IP address and browser, and error reports used to fix problems.

How we use it

• To provide the service: sign-in, building and launching ads, syncing and reporting, organising creative work.
• To keep it secure, prevent misuse and fix errors.
• To support you and tell you about changes to the service.

We do not sell personal information, use it to build advertising profiles, or use customer content to train AI models. We do not use advertising or analytics trackers in the service.

AI providers you connect

If your organisation connects its own AI provider key (for example Anthropic, OpenAI, Google, xAI or OpenRouter), the text needed for the feature you use is sent to that provider under your organisation's account: for example a card's title, brief, reference links and notes, file names and the relevant Offer Brain items. The provider's own terms and privacy policy apply to that data. If no key is connected, nothing is sent to an AI provider.

Google user data

The service's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Drive data is used only to import the media you select into your organisation's library and to show it there. It is not used for advertising, not sold, not used to develop or train AI models, and humans do not read it except with your permission, for security, or to comply with the law.

Who we share it with

We share information only as needed to run the service, with:

• Meta and Google, when the service acts on the accounts you connect;
• the AI provider your organisation connects, if any;
• our infrastructure providers: Render (hosting, United States), Neon (database, United States), Cloudflare R2 (media storage) and Sentry (error monitoring, United States, with tokens and keys removed from reports);
• authorities, if the law requires it, or a buyer of our business under the same protections.

Because these providers are mostly in the United States, your information is stored and processed outside Australia. We choose providers with strong security and contract terms to protect it.

Security

Data travels over HTTPS. Meta tokens and AI keys are encrypted at rest. Each organisation's data is kept separate, and only people invited to an organisation can see it. No system is perfectly secure; if a breach is likely to cause you serious harm, we will tell you and the regulator as the law requires.

How long we keep it

We keep information while your organisation uses the service. When an organisation leaves, we delete its data, tokens, keys and media within 30 days. Media you delete in the app is hidden immediately and removed in later clean-ups. Database backups roll off on our provider's schedule. We may keep limited records where the law requires.

Your choices and rights

• You can ask to access, correct or delete your personal information, or ask a question, at mpknup@gmail.com.
• You can revoke the service's Google access at myaccount.google.com/permissions and remove its Meta access in your Business Manager. See data deletion.
• If you are unhappy with how we handled a complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au, or your local data protection authority.

Cookies

We use only the cookies the service needs: your sign-in session and your language choice. Your theme choice is kept in your browser. There are no advertising cookies.

Children

The service is for businesses and is not meant for anyone under 18.

Changes

We may update this policy and will show the new date above. If a change is significant, we will tell signed-in users.

Contact

MKAMG Pty Ltd · mpknup@gmail.com