What Mecrio can and cannot do in your ad accounts
- Mecrio acts only on your instruction: it publishes the campaigns you prepare, changes the settings you edit, and starts or pauses campaigns when you ask.
- Every campaign is created paused in your own ad account, so nothing spends until you start it.
- Live campaigns are edited field by field. Mecrio re-checks that the platform allows a change before writing it, then reads the value back to confirm it.
- Mecrio AI cannot change anything on its own. It prepares a change for you to review, and nothing is sent to the platform until you approve it.
- Mecrio never handles your ad money. Spend is paid from your own ad account directly to each platform, and Mecrio takes no commission on it.
How you connect an ad account
You connect each ad account on the platform's own sign-in screen, and Mecrio never asks for a password or a key. Mecrio lists the permissions it will request before you continue, and the platform shows them again. If you untick a required permission, the connection is not completed.
What Mecrio asks for on each platform, in plain words:
| Platform | What Mecrio asks to access |
|---|---|
| Meta (Facebook, Instagram) | Read and manage your ads, use your Business Manager, and list your Facebook Pages and read their engagement, since ads run in a Page's name. |
| Google Ads | One permission to manage your Google Ads accounts. |
| TikTok | Permissions are attached to Mecrio's app and shown on TikTok's own screen: ad, campaign and audience management. |
| Read and manage ads and reports, see the company pages you manage, and read and publish their posts, since LinkedIn ads run as company page posts. | |
| Microsoft Advertising | Manage your Microsoft Advertising accounts and stay connected without signing in again. Ad accounts opened with a Google account sign in with Google. |
| Read and write ads, boards and Pins. | |
| Read and edit ads and work with conversions, plus Reddit's general access to posts and comments through your account and to your voting history and saved or hidden items. | |
| Snapchat | Use Snapchat's marketing interface and read your public profile, which every Snapchat ad needs. |
| X | X's sign-in uses no permission list. Access follows the level set on Mecrio's app. |
Google Analytics 4 and Google Search Console are connected read-only. Mecrio views and downloads your data there but never changes a setting.
Removing a connection
You can disconnect any account at any time. Mecrio's access is removed, no new data comes in and nothing can be published from Mecrio. Campaigns and settings in your ad account are not touched. Mecrio tries to revoke the access at the platform, then deletes its record.
Campaign and report data already pulled stays in your project until you delete the campaign or project. For Google Analytics and Search Console, that project's data and access are deleted right away. Removing Mecrio on Google's linked apps page also turns off a Google Ads connection made with the same Google account.
Team roles and the activity log
Each teammate gets a role, either for the whole workspace or only for chosen projects. The database itself enforces this: a user reaches only the projects they own or belong to.
- Owner: full access, and the only role that invites and removes teammates.
- Manager and Editor: can change project data, such as campaigns.
- Viewer: can only look, not change anything.
- Activity log: who changed what, and when, filterable by action and by actor: a user, the AI or the system. Entries cannot be edited or deleted.
Who processes your data
Mecrio's providers process data only on its instructions: Supabase for sign-in, the database and file storage; Cloudflare for hosting, content delivery, email, bot protection and the browser used in project analysis; Resend as a fallback email service; Google for site analytics and Sign in with Google; and a payment provider for subscriptions.
When you publish, the campaign's structure, targeting, copy and media go to your own ad account, where that platform's terms apply. The servers of these providers, the ad platforms and the AI providers are outside Türkiye, so data is transferred abroad under the safeguards in the privacy policy.
How Mecrio AI uses your data
AI runs on Mecrio's own accounts with Anthropic, Higgsfield, OpenAI and Google, so you never need your own key. Your prompt and the relevant context, such as campaign data or brand details, go only to the provider doing that job.
Mecrio aims to use these providers on terms under which inputs and outputs are not used for model training. Google Analytics and Search Console data is never used to train AI models. No AI suggestion is applied without your approval.
How data is protected
- All traffic is encrypted in transit with TLS.
- Access tokens stay on the server and are never sent to the browser.
- Uploaded and generated media is stored privately and opened only through short-lived signed links.
- Passwords are stored irreversibly by the sign-in provider, so Mecrio cannot read them.
- Sign-in, sign-up and password reset pages have bot protection.
Report a security issue
Found a security problem? Write to info@mecrio.com, the address our legal pages use, with what you found and how to reproduce it.