Is it safe to give your marketing data to ChatGPT or Claude?

Is it safe to connect my ad accounts and sales data to ChatGPT or Claude, and what should I check first?

Connecting your ad accounts to an AI assistant is useful and, done carefully, safe. Done carelessly, it can put your customers' personal data somewhere you do not control. The difference is not which assistant you pick. It is what data you share, on which plan, through which connection, with which permissions. This article goes through each, with the providers' own policies linked.

Two kinds of data, two levels of risk

Campaign performance data is spend, impressions, clicks, conversions and revenue by campaign, ad set or ad. It is commercially sensitive, but it identifies no person, and sharing it with an assistant on a trustworthy plan is low-risk.

Personal data about customers is names, emails, phone numbers, addresses, order histories tied to a person. That is where the real risk is, legally and reputationally, and it should not go into a chat. Most useful marketing questions do not need it: you can ask which campaigns bring repeat buyers without the assistant ever seeing a buyer's name.

What the providers do with your data

Anthropic (Claude). For its consumer plans (Free, Pro and Max), Anthropic's privacy center says it uses chats to improve its models if you allow it in your privacy settings, if a conversation is flagged for safety review, or if you join a program such as its Trusted Tester Program. Since its 2025 terms update, chats are kept for 30 days if you do not allow training and five years if you do. Team, Enterprise and API use are covered by its commercial terms, which that update did not change. Incognito chats are not used for training.

Connectors are treated separately. The same privacy center article says the data used for model improvement does not include raw content from connectors, including remote and local MCP servers, although data can be included if it is copied directly into the conversation. So the campaign data an MCP connector fetches is not training data unless you paste it into the chat yourself.

OpenAI (ChatGPT). OpenAI's enterprise privacy page says it does not train its models on business data from its business products and API by default. Consumer accounts have a data control to turn off model improvement. If your team uses personal accounts for work, that setting is the one to check first.

Policies change, so read the current version for the plan your team actually uses, and prefer a business plan for anything that involves client or customer data.

The risks that matter more than training

Permissions. A connector can only do what its permissions allow, but some request more than analysis needs. Read the permissions at sign-in. If a connector can change campaigns, treat it like a new person with admin access to your ad accounts.

Prompt injection. An AI that reads web pages or tool results can be fed hidden instructions that try to make it do something you did not ask. Anthropic's guidance on custom connectors is to connect only to servers you trust, review requested permissions and watch for changes in tool behavior.

Wrong numbers, confidently. The most common damage is not a leak. It is a decision made on a fluent answer built from numbers that were wrong or incomplete. Ask for the figures behind every conclusion; we cover that habit in what MCP is and why it matters.

Access you forgot about. Connections outlive projects and employees. Review which connectors your workspace has every quarter and remove the ones nobody uses.

Your obligations to your customers

In Mexico, customer data that identifies a person is personal data under the federal data protection law, and sharing it with a new processor is something your privacy notice and your contracts have to cover. We are preparing an article on the new LFPDPPP and marketing tracking; until then, the practical rule is simple: keep identifiable customer data out of AI chats, and make sure every vendor that processes it on your behalf has a data processing agreement with you. Ours is public: Adray's DPA.

A checklist before you connect anything

• Use a business plan, or check that model improvement is off on personal accounts used for work.
• Connect only servers from companies you trust, and read the permissions they request.
• Grant read access for analysis; grant write access only on purpose, and review what it changes.
• Never paste customer lists, payment data, passwords or API keys into a chat.
• Prefer connectors that answer with aggregates rather than lists of people.
• Know how to revoke access, in the assistant and in the service, and review connections every quarter.

How Adray draws the line

Adray's MCP server serves campaign performance and reconciled attribution, not customer identities. The list of buyers with names and emails that sits behind Revenue Recovery stays behind the merchant's own login and has no equivalent in the connector; the buyer profiles the connector can read are published only for groups of at least 20 people. Tools that change campaigns require a separate write permission from the read tools used for analysis. More about how the platform handles data is in the data and privacy section of our home page.