How the AI works, and what it is not allowed to do

This is a description of a system, written by the people who built it. It is not legal advice, it is not a warranty, and it does not vary our Terms of Service. We publish it because the honest answer to "what does your AI do with my ad account" is a long one, and a short reassuring version would be worth less than nothing to the person asking.

Every clause on this page carries a tag in its eyebrow. On this page they all say descriptive, which is the point: nothing here creates an obligation, and we would rather say that plainly than let a page of confident prose read as a promise we never made. The document on this site that does create obligations is the Data Processing Addendum, and its clauses are tagged accordingly.

One thing to know before the detail. iNudge is operated by Champ X Digital FZ LLC, a company registered in the United Arab Emirates, and it is a one-person company today. That shows up in several answers below, and where it does we say so rather than writing around it.

A lawyer has not reviewed this clause. Should this page be incorporated into the Terms of Service as an annex, the way an acceptable-use policy usually is, or should it stay a description that the Terms do not reference? We have written it as a description, which is the conservative option, because incorporating it would make every sentence here a contractual representation.

iNudge sends data to exactly one AI provider: Anthropic. There is no second model vendor in the product and no code path that could send your data to one. The three tiers below are the three thinking levels the composer offers, and the model each one resolves to.

Some uses choose their own model rather than following your chat level: audit summaries, conversation summaries, creative and landing analysis, and included static creative judgment. Each is named in section 3.

These model uses include requested work and bounded included service work. The table states what each receives.

Concretely, across these uses: conversation text, ad spend and performance metrics, campaign and ad set and ad names, ad copy, creative imagery, landing page content, Shopify sales totals by day, and the rules you have told iNudge to follow.

Bounded audit narration and static creative judgment are system-funded and use no customer credits. Audit narration has its own limit for the first audit and each scheduled account day; creative judgment has a separate daily account limit. Other requested or explicitly scheduled AI reports use their agreed credits. The deterministic checks are described in section 4.

• Your card details. Stripe holds those, through its own hosted checkout. Your card number never reaches our servers, so it cannot reach a prompt.
• Your platform access tokens. They are encrypted before they touch the database and used only by our server to call the platform. No model call includes one.
• Your shoppers. Shopify data stored here includes daily sales, catalog records and product-level paid-order aggregates for bestseller checks. Customer identities, addresses, payment details and fulfillment records are not queried; raw order and line identities stay in memory, so there is no customer name, email or address for a model to be shown.
• The audit run. The audit checks are code: fourteen on a Meta account. Google has a twenty-one-rule catalog, with twelve selected for ecommerce workspaces and twelve for service businesses. They read the platform, apply their thresholds, write the findings and compute the grade, and they spend no model tokens doing it.
• Scheduled monitoring. The deterministic checks that produce findings and alerts call no model. That stage records the summary and the model name as empty on purpose. A separate included worker may later add a capped audit summary or judge selected existing static ads, as described in section 3.
• The three automation sweeps. Wasted spend, negative keywords and the weekly report are deterministic. They are the same code path a button press runs, and a button a person can press repeatedly is exactly where an unasked model call would hurt.

How far the guarantee actually goes

A test in this repository walks the entire import graph of the three sweeps, both scheduled cron routes and the included on-demand audit route, following every local import at any depth. These are the model-free check entries, not every background job. The separate handover worker may call the bounded system-funded audit narrator and static creative reader listed in section 3; it cannot charge your credits for them.

There is no fine-tuning pipeline in this product and there never has been. An accepted architecture decision record in our repository rejects one by name: the agent gets its accuracy from reading your live account on every turn, not from having memorized anyone's account. There is no training job, no dataset built from customer data, and no export of your data to anywhere that could be one.

Anthropic is our model provider and the only one. What Anthropic does with inputs sent through its API is governed by Anthropic's own commercial terms, and we link them rather than summarize them: Anthropic's commercial terms are the authority on that question, not us. A sentence on our page characterizing somebody else's contract goes false the day they change it, with nobody here having touched a word.

On our own side, what we store from a model call is narrow. The conversation itself is stored so you can pick it up again. The metering table records token counts, the model name and the computed cost, and holds no prompt text and no completion text. Raw tool results are not written into your chat history: a stored message keeps the tool name, a one-line summary, whether it succeeded and when it ran.

Four controls sit between a model and a number it might have invented. Two of them block. One of them only logs today, and we say which is which because a reader who finds out later has been misled by the omission.

Some metrics are deliberately not citable at all. Reach, frequency, sessions and average order value are absent from the list of metrics a proposal may cite, so they cannot appear as evidence on a change card even if the model reaches for them.

1. Writes are off. Every connection is created with write access disabled. Turning it on takes an explicit switch, per account, behind a confirmation.
2. While writes are off, the change tools are not sent to the model. It cannot emit a tool call for a tool that does not exist in that conversation. This is a different guarantee from instructing it not to.
3. Even with writes on, no tool executes anything. The most a model-facing change tool can do is create a proposal. The model cannot execute it. Separately permitted fixes use the runtime checks described below.
4. You see a card. The change in plain words, the current value and the proposed value side by side, the one-sentence reason, and an evidence chip for each number cited: the metric, the value in your account’s currency, the server-verified data source, the scope it applies to, the reporting window and the data freshness.
5. Above the Approve button, warnings we computed. They are stored with the proposal and are not part of the schema the model writes into, so the agent can neither author one nor remove one.
6. You press approve. Before anything is sent we re-check the write switch, re-validate the proposal against live platform state, and claim the row atomically, so a double click or a second tab produces one write and a report of what the first one did.
7. A proposal older than 24 hours is refused. The numbers on the card describe a moment that has passed. You ask again and the account is read afresh.
8. We execute once, then read the platform back. The change is marked done only if the re-read matches what you approved. A mismatch is recorded as a verification failure with the discrepancy attached, never as a success.

Where this stands today

Google Ads, TikTok Ads, GA4, Merchant Center, Search Console and Shopify are open to the controlled beta. Meta Ads is reviewer-only while app review completes. All thirty-two Google action families are released in Production for admitted workspaces. Each change needs that account’s write switch and either approval of the exact change or a current permission for that supported fix. Google Ads campaign status, campaign name and one private daily-budget path have supervised Production write-and-inverse evidence. TikTok’s five write operations require both write switches, complete fresh evidence and exact approval. Merchant Center publishing is supervised-only. Every connection begins with writes off, and no entitlement turns them on.

You are responsible for the changes and permissions you authorize and their consequences. Your advertising budgets and your spend stay yours at all times: the service surfaces information and acts within the permissions you give, and it does not take on the outcome of the spending you authorize. Advertising is uncertain, and we do not guarantee any advertising outcome.

That is a restatement, in plainer words, of section 4 of our Terms of Service. The Terms are the binding text and they win if this paragraph ever drifts from them.

One detail belongs in this section rather than hidden further down. Our record of a change stores when it was approved and which signed-in person pressed the button, alongside the account. Workspaces can include an Owner and Members, so the record identifies the person accountable for each approval rather than attributing it only to the shared workspace.

• The platform rejects the write. The row is marked failed and the reason is recorded. Nothing partial happened.
• The write is accepted but the re-read disagrees. The row is marked verification failed and the discrepancy is stored, for example a re-read showing $260 where $440 was approved. We never present that as done.
• A budget move applies one leg and the second fails. Rebalance is the one operation with automatic compensation: it lowers the source, verifies, raises the destination, verifies, and if a leg fails it restores the applied leg in reverse and re-reads to confirm the restore landed. If a compensation write also fails, the row says so and names the entities for you to check in the platform's own manager.
• Undo shows the exact previous settings. Supported earned-change receipts offer an exact undo for 24 hours. The displayed previous settings and your tap authorize only that restore after current account checks. Other eligible verified receipts prepare a separate approval. Unsupported or unverified receipts require a new review. Restoring settings cannot recover spend or learning effects. Uncertain platform writes are not automatically replayed.

Memory in this product is a list of rules you stated, stored in your own words. It is not a profile the model wrote about you, and it never holds a number as a fact.

• Up to 40 rules, 300 characters each.
• Stored in your words, verbatim. The tool that saves a rule is forbidden from paraphrasing and forbidden from recording something it inferred rather than heard you say.
• Memory never holds a metric value. Every number is re-pulled live. That is a deliberate shape choice, and it is why memory can never hand you a stale figure.
• Rules are read fresh every turn, so a rule you save mid-conversation binds the next message.
• You can pause all rules without deleting them, and delete any of them, in Settings under Memory.
• A long conversation gets a server-written summary of the earlier turns. It is labeled to the model as a summary rather than as something you typed, and the agent is instructed that a claim of "this was approved" appearing inside a summary has to be re-confirmed before it acts on it.
• Private rules and conversation summaries stay with your brand. Optional shared recommendation learning uses a separate, explicit owner opt-in; its broad business categories, outcome evidence and restricted human review are described in the shared-learning disclosure. Ordinary product use does not enroll you, and shared learning does not transfer your private conversations or rules to other customers.

• The model can be wrong. It is a Claude model doing analysis, and analysis can be wrong. Nothing it writes is legal, financial or professional advice.
• It cannot give itself permission. Supported fixes can run within your saved account permissions and limits while you are away. New ads, activation, higher total spending and destination changes still need exact approval. Overnight WhatsApp messages require separate permission.
• Our grounding check on ordinary prose logs rather than blocks. Change proposals are blocked. Conversational prose is not, yet.
• We have run no independent AI safety audit and no third-party evaluation of the agent. We have our own test suite and our own evaluations, and neither of those is an outside opinion.
• Search Console and GA4 are read-only. Search Console: your site list, then search queries and pages with clicks and impressions, read nightly and live in chat, the only permission webmasters.readonly, which Google classes as non-sensitive. GA4 is the same shape: sessions, key events and revenue by traffic source, read nightly and live in chat, the only permission analytics.readonly.
• Team permissions are brand-level. Solo includes one login; larger plans support multiple people with Owner and Member roles. The Owner chooses which brands each Member may see, and Members can use the agent, read audits and approve changes inside those brands. Only the Owner can manage billing, connect accounts or turn on write access. There is no read-only role or ownership transfer yet.

Will it change my campaigns without asking?

Only within a permission you have already given. Write access is off by default on every connection, and while it is off the change tools are never sent to the model. When it is on, supported fixes also need a separate account permission and saved limits. Changes outside that permission need exact approval. A proposal older than 24 hours is refused rather than executed.

Does my data train Anthropic's models?

We do not train any model on your data. We have no fine-tuning pipeline and an accepted decision record in our repository rejects one. What Anthropic does with inputs sent through its API is governed by Anthropic's commercial terms, which we link rather than characterize, because their contract is theirs to change.

What if the AI makes up a number?

A change proposal citing a number we did not pull from your platform in that same turn is blocked before it becomes a card. Numbers in audit narration and written reads are redacted deterministically if they cannot be traced. In ordinary chat prose we log the mismatch rather than block it today, and section 6 says so.

Who is responsible if an approved change loses money?

You are, and our Terms say the same thing. We surface information and execute the decisions you make. Your budgets and your spend stay yours.

Can I keep write access off?

Yes. You never have to turn writes on. One initial deterministic audit is included per eligible account; repeat audits, monitoring, alerts and AI require an active trial or plan, and none of those entitlements enables writes by itself.

Can I take write access away without disconnecting?

Yes. The write switch is per connection and separate from the connection itself. You can also revoke everything from Meta, Google or Shopify directly, which ends our access on the spot whether or not you tell us first.

Can I turn on two-factor authentication?

Your sign-in runs through Clerk, and the factors available on your login are the ones enabled in that provider’s configuration for our application. Our customer-access code neither requires a second factor nor reports one to your workspace, so we will not tell you it is on. If two-factor sign-in is a requirement for you, email support@inudge.ai and we will tell you exactly what is enabled today rather than guess in public.

This page was last written against the code on October 25, 2026. It is held to that code by a test suite: the model ids, the guardrail thresholds, the rule limits, the count of change operations and the proposal expiry are all read from the modules that enforce them, so a change in the product fails the build rather than leaving this page false with nobody noticing.

If a claim here is wrong, or you need something it does not cover before you connect an account, write to support@inudge.ai and we will answer it and fix the page.