MM Lab
Log inStart free

Privacy Policy

Last updated: October 13, 2026 | Effective Date: January 1, 2026

1. Introduction & Overview

MM Lab ("MM Lab", "we", "our", or "us"), operated by TwoSquares Limited, provides automated marketing reporting, multi-account budget pacing, and performance analytics tools for agencies and marketing teams.

We are committed to maintaining the confidentiality, integrity, and security of personal and client data. This Privacy Policy explains how we collect, use, store, and disclose information when you access our platform (https://mmlab.io or associated domains) and connect third-party advertising and analytics services.

2. Information We Collect

We collect only the minimal data required to provide and administer our reporting platform:

  • Account Information: Your name, business email address, workspace name, and encrypted authentication credentials when you register or sign in.
  • Billing Information: Payment method details, billing address, and subscription tier processed securely via our payment provider (Stripe). We do not store raw credit card numbers.
  • Third-Party Data Sources (Google APIs): When you explicitly connect your accounts to MM Lab via OAuth 2.0, we access advertising and analytics data on your behalf, as detailed in Section 3.
  • Technical & Usage Data: IP addresses, browser user agent, session timestamps, and system logs collected automatically to safeguard system integrity and diagnose errors.

3. Google API Services & User Data Policy Disclosure

MM Lab integrates with Google APIs (including Google Ads API, Google Analytics 4, Google Search Console, and Google Business Profile) to allow users to generate automated reports, monitor campaign budget pacing, and audit account health.

3.1. Google Data Accessed

When you grant permission through Google OAuth 2.0, MM Lab requests read access to the following scopes:

  • openid, userinfo.email, userinfo.profile: To identify your authorized Google account and link it to your MM Lab workspace.
  • https://www.googleapis.com/auth/adwords (Google Ads API): To retrieve customer account IDs, campaign structures, ad group data, and performance metrics (impressions, clicks, spend, conversions, cost-per-conversion) for budget pacing and client reports.
  • https://www.googleapis.com/auth/analytics.readonly (Google Analytics 4): To aggregate session volumes, conversion events, and traffic acquisition channels.
  • https://www.googleapis.com/auth/webmasters.readonly (Google Search Console): To read site performance indicators including clicks, impressions, CTR, and search queries.
  • https://www.googleapis.com/auth/business.manage (Google Business Profile): To read local business performance insights.

3.2. How We Use Google User Data

Google user data is used solely to provide user-facing features within the MM Lab application:

  • Calculating monthly budget pacing against user-defined spend targets.
  • Generating automated, scheduled client performance reports and executive summaries.
  • Auditing campaign setup health (e.g., tracking status, budget exhaustion, quality indicators).

3.3. Google Limited Use Compliance Statement

MM Lab's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.4. Explicit Prohibitions

  • No Selling or Renting: We never sell, lease, or monetize Google user data under any circumstances.
  • No Advertising Use: We do not use Google user data to serve targeted advertisements, build consumer profiles, or retarget users.
  • No AI Model Training: We do not use Google user data to train, fine-tune, or develop generalized artificial intelligence (AI) or machine learning (ML) models.
  • No Human Access: No human reads or reviews your Google data unless you explicitly request customer support, it is necessary to resolve security incidents, or required by law.

4. Data Storage, Security & Encryption

We adhere to rigorous architectural standards to ensure your connected data remains secure:

  • Encryption at Rest: All OAuth tokens (refresh tokens and access tokens) are encrypted at rest using AES-256-GCM encryption with unique key management.
  • Encryption in Transit: All communication between your browser, our servers, and third-party API endpoints uses modern TLS (HTTPS) protocols.
  • Minimal Data Footprint: Raw third-party advertising datasets are retrieved in-memory via authenticated API endpoints during report generation and budget calculation cycles. We do not maintain an unbounded long-term copy of raw external advertising log data.
  • Database Isolation: Data is segregated by workspace, enforcing strict role-based access controls (RBAC) to ensure tenant isolation.

5. Data Retention & Deletion

You maintain full sovereignty over your data at all times:

  • Disconnecting Data Sources: You can disconnect any connected Google data source at any moment directly from the MM Lab application by navigating to Data Sources > Disconnect.
  • Revoking Access via Google: You can revoke MM Lab's access to your Google account at any time via Google's security settings at: https://myaccount.google.com/permissions.
  • Account Deletion: Upon workspace cancellation or written request, all associated tokens, client mappings, and stored configurations are permanently deleted from our active database within 30 days.

6. Third-Party Service Providers

We work with trusted third-party cloud infrastructure providers who comply with industry security standards:

  • Google Cloud Platform (GCP): Server infrastructure, task queues, and storage.
  • Neon Database: Managed PostgreSQL database hosting with encryption at rest.
  • Vercel: Web application hosting and edge delivery.
  • Stripe: Payment and billing processing.

7. Your Rights

Depending on your jurisdiction (such as under the UK GDPR, EU GDPR, or CCPA/CPRA), you have the right to:

  • Access the personal information we hold about you.
  • Request rectification of inaccurate data.
  • Request erasure of your personal data ("right to be forgotten").
  • Restrict or object to our processing of your information.
  • Export your data in a structured, commonly used format.

8. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory updates. When changes are posted, we will revise the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

9. Contact Us & Privacy Inquiries

If you have questions, requests, or concerns regarding this Privacy Policy or our handling of Google user data, please contact our Data Protection team at:

TwoSquares Limited / MM Lab

Attn: Privacy & Data Protection Officer

Email: privacy@twosquares.co.uk / hello@muave.digital