Netmore Marketing

How I handle your access and your data

Last updated: September 24, 2026

To do the work, I need to see your numbers: your ad accounts, your CRM, and sometimes your sales data. This page covers how I get that access, where it's kept, what I do with it, and how you shut it off. If anything here doesn't answer your question, ask me.

Why I ask for an API key

For years, the normal way to give an agency access was to share your login or add them as a user. That still works for some tools. More and more, though, software connects to other software directly, through API keys. It's how the tools you already use talk to each other, and it's how I get your data without ever logging in as you.

This is where things are going. As more routine work gets handled by software and AI, access is moving from shared logins to keys that each do one job and can be switched off on their own.

An API key is a long code your software creates for one purpose. You make it inside your own account, you choose what it's allowed to do, and it sits in your settings under a name you pick. I'll ask you to name it "Netmore." Some tools use a different name for the same thing: in GoHighLevel it's a Private Integration, and in Stripe it's a restricted key.

If nobody has asked you for one before, that's normal. Most business owners haven't made one. It takes a few minutes, and I'll walk you through it.

Compared with sharing a password, a key gives you more control:

• You decide what it can reach. If I only need to read your sales pipeline, the key can be read-only and limited to that.
• You can see it. It's listed in your settings with my name on it.
• You can shut it off in one click, any time, without changing your own password or telling me first.
• Your login stays yours. Nobody signs in as you, and your two-factor codes never leave your phone.

The one thing a key doesn't have is two-factor authentication. Whoever holds it can use it. That's why most of this page is about where I keep it.

What I ask for, in this order

I ask for the least access that gets the job done.

1. Partner or user access, where the platform offers it. Meta and Google Ads both let you give me access from your own settings. No password or key changes hands, and you can remove me the same way.
2. A user seat of my own, with its own login and two-factor, for tools where a person has to log in.
3. An API key made for me, for tools where my systems pull your data on a schedule. I'll tell you exactly which permissions to switch on, and which to leave off.
4. Your own login: I don't ask for it. If a tool offers no other way in, we'll talk it through first.

How to send me a key

Send it to me in a direct message. Once I've saved it, I'll confirm, and you can delete the message. Please don't put it in a shared document or a group chat.

Where your key is kept

• On my computer, in a separate file kept apart from my notes and working files.
• Never in a shared document, a spreadsheet, or the files I back up to the cloud. My setup automatically blocks anything that looks like a key from being saved into them.
• In one encrypted backup, on a separate drive, refreshed weekly, so a dead computer doesn't mean asking you for new keys.
• Only I have access to it.

What I do with your data

• I use it to do your work: reporting, finding what's working, and deciding what to change next.
• I never sell it, rent it, or trade it.
• I never show it to or share it with another client.
• I do learn from the work. When something works for one business, like an ad angle or a follow-up sequence, I use that lesson with others. I never pass on your numbers, your customers' details, or your name.
• I don't use your name or results in a case study unless you say yes.

The one place your data goes outside my own tools is back into your own accounts. For example, I may send a booked sale back to your Meta or Google ad account so your ads learn who actually buys. That data goes to your account, not mine.

The tools your data passes through

Your data lives in the tools I run the business on. The main ones:

• My computer, where the work happens.
• A private cloud backup of my working files, on GitHub. Keys never go into it.
• Google Workspace, for email and shared documents.
• Cloudflare, which hosts the reports I send you.
• The AI tools I use for analysis: Claude, made by Anthropic, and ChatGPT, made by OpenAI.

About AI: I use AI tools for a lot of the analysis. The accounts are mine, and I've turned off model training on every one of them, so your data isn't used to train their models.

How to shut off my access

You don't need to ask me first. You can do it any time:

• API key: delete it in your settings. It stops working right away.
• User seat or partner access: remove me from your account's users or partners.

When we stop working together, I delete your keys and confirm it in writing. Deleting them on your side is still the real off switch, because a deleted key can't be used by anyone.

I keep my notes from our work together unless you ask me to delete them. If you ask, I will, and I'll confirm when it's done.

If something goes wrong

If I ever think one of your keys has been exposed, I'll tell you the same day, and we'll replace it together.

Want this in writing?

Most of my work runs on a handshake, and this page is what that handshake covers. If you'd like it as a signed agreement, ask and I'll send you a copy to sign.

Questions