What your assistant can see, and what it can’t do.

Sign-in and tokens

• You sign in on teraads.co, never inside the assistant, so your password never reaches it.
• Sign-in uses OAuth 2.1 with PKCE: a sign-in code is useless without a one-time secret held only by the assistant that asked for it.
• Tera Ads stores tokens only as one-way hashes, so a copy of the database can’t be replayed as a login.
• Access tokens last 1 hour. A connection lasts 30 days, then you reconnect.
• Each refresh token works once. If an old one is ever used again, Tera Ads revokes the whole connection.
• Sign-in codes go only to a fixed list of assistant addresses, plus your own computer for desktop apps.

One business per connection

• A connection belongs to one owner and one business. Every call is checked against it, so it can’t read another business, even one you also own.
• Only the business owner can connect.
• Sign-ins and calls are rate-limited per address and per connection.

You decide what your assistant may change.

• When you connect, you choose: let your AI make changes, ask you first, or read only. You can switch a connection between the first two at any time under AI connections.
• Each change is checked against Meta right before it is made, made once and read back. Everything new starts paused and spends nothing until it is turned on.
• One budget change can at most triple a budget or cut it to a tenth, and assistants can make at most 50 changes a day to one business.
• Every change is logged in Tera Ads with who made it. A pause, turn-on or budget change can be undone for 7 days.
• Text from your ad accounts, such as campaign names, reaches the assistant as data. Tera Ads tells the assistant to treat it as data, not instructions. To see every change before it happens, choose Ask me first.

Your data

• Our privacy policy says: “Your individual data is never used to train AI models for other users. We only use anonymized, aggregated patterns to improve our algorithms.”
• What Tera Ads sends back becomes part of your chat, which the assistant’s provider handles under its own terms.
• Tera Ads logs every call: which tool, when and for which business. How long the log is kept is set out in our privacy policy.

How to revoke access

1. In Tera Ads, open AI connections from your dashboard.
2. Find the assistant’s connection, choose Revoke access, then Confirm revoke.
3. It stops working straight away. To use it again, you sign in and approve a new connection.

If you disconnect Tera Ads in the assistant’s own settings and the assistant revokes its sign-in, that ends the connection too. Not every assistant does, so revoking in Tera Ads is the sure way.