Affise MMP MCP server › Data notice
This notice covers the Affise MMP MCP server — the hosted endpoint at mcp-mmp.affise.com. It supplements the Affise privacy policy rather than replacing it: where the two overlap, this page is the more specific of the two, because the MCP server handles one thing the website never does — an API key you hand to it so an AI assistant can read your attribution data.
Your Affise MMP API key, entered once in the sign-in form. Before the key is accepted it is checked with the Affise MMP reporting API; a key that fails the check is not stored.
The parameters of each question your assistant asks on your behalf: dates, filters, app and partner identifiers, event names, and — when you trace one device — the device identifier you gave (GAID, IDFA, click ID, customer user ID and the like). These are derived from what you asked, so they can contain anything you put in the question.
Ordinary request metadata: your IP address, your client’s user agent, a timestamp, and a request identifier that is echoed back to you in the X-Request-ID response header.
No account is created. Your name, your email address and your contact details are not collected and not stored — the server never asks for them.
A session record: a session identifier, an internal user identifier derived from a one-way hash of your key, your API key encrypted with AES-256-GCM, and creation, last-use and expiry timestamps. The key is decrypted for the duration of a single request and never written to a log.
The sign-in records — the browser session, the PKCE verifier, the authorization code and the refresh token — are encrypted the same way, and codes and refresh tokens are looked up by a hash rather than by their value. The registration of your MCP client app (its name and redirect address) is kept so it can sign in again. All of it lives in Redis.
A security event log of sign-ins, failed sign-ins, client registrations and rate-limit hits, with the IP address, user agent and a non-reversible fingerprint of the key — never the key itself.
Answers from Affise MMP are not cached. Your attribution data itself is not copied, warehoused or analysed: the server forwards a request, hands the answer to your assistant, and keeps nothing.
Every store the server keeps, and how long each record lives:
| Sign-in flow (browser session) | 15 minutes |
| PKCE verifier | 10 minutes |
| Authorization code | 10 minutes |
| Answers from Affise MMP | Not kept |
| Session record, including the encrypted API key | Up to one year — the access-token lifetime set at sign-in |
| Refresh token | 90 days |
| MCP client app registration | Until removed |
| Security event log | In the server logs, with no fixed expiry |
When your MCP client revokes its access token on disconnect, the session record and the encrypted key are deleted at once, together with every refresh token issued for that session. A client that does not revoke leaves them to expire — write to support to have them deleted sooner.
The Affise MMP reporting API. That is the destination: every request goes to your own Affise MMP account, authenticated with your own key, and returns only what that key is allowed to see.
The AI provider you chose. This is the boundary worth understanding. Answers are handed to your assistant, so they become part of your conversation with whoever runs it — Anthropic, OpenAI, or another provider. Raw rows and device traces can carry device identifiers, IP addresses and the parameters your app sent with each event. What happens to that conversation is governed by your agreement with the provider, not by Affise. Business and enterprise plans from the major providers exclude API traffic from model training by default; consumer plans may not.
Affise’s internal alerting. Sign-ins and security events are posted to the team’s Slack with the IP address, user agent and the non-reversible key fingerprint — never the key and never your attribution data.
Nobody else. No analytics, no advertising, no third-party trackers, no data brokers.
Every tool is read-only, so connecting an assistant cannot change or delete anything in your Affise MMP account.
The key you supply sets the ceiling on what an assistant can read. An agency key reaches only the apps and partners its clients granted it.
You can revoke access at any time from your MCP client; a client that revokes its token deletes the stored session with it. Rotating the key in Affise MMP cuts off every session that holds the old one.
To ask what is held about you, or to have it deleted, write to support@affise.com. Rights that apply across the Affise platform are described in the Affise privacy policy.
Report a vulnerability to support@affise.com with SECURITY at the start of the subject line. Never include a live API key or access token in a report.