01 Who we are
Sciensoft Technologies B.V., established in the Netherlands (Chamber of Commerce / KvK number 82570426), is the controller of the personal data described in this Policy. Contact for privacy queries: [email protected].
02 What we collect
Account data (when you sign in): email address, display name, avatar URL, and your OAuth provider's stable identifier. Operational data: session metadata (issued-at, IP-fingerprint hash, user-agent hash), usage events (which MCPs you registered, when they were called, request counts — never request bodies), and error logs redacted to remove sensitive fields. Content on your machine is not collected: files served over the tunnel are streamed to the requesting MCP client and never stored, cached, or logged on our side.
03 Lawful basis (GDPR)
We process account and operational data on the basis of contract (Art. 6(1)(b)) to provide the service, and legitimate interest (Art. 6(1)(f)) for security, abuse prevention, and product improvement, always balanced against your rights.
04 Retention
Account data is kept while your account is active and up to 30 days after deletion (for reversal / audit). Session metadata is kept for 30 days. Usage events are kept for 12 months for billing and quota enforcement, then aggregated and personal identifiers are stripped.
05 Sub-processors
We use Google (Google OAuth for sign-in), a Postgres-managed hosting provider (data storage), and a container hosting provider (compute). We do not sell your data or share it with advertisers. A current list of sub-processors is available on request from [email protected].
07 Your rights
Under GDPR (EU/EEA), UK GDPR, and comparable laws, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, and to data portability. Exercise any of these by emailing [email protected] — we respond within 30 days.
08 International transfers
Data is stored in the EU. If we ever transfer personal data outside the EU/EEA, we use Standard Contractual Clauses and equivalent safeguards.
09 Children
The service is not directed to anyone under 16 and we do not knowingly collect data from minors. If you believe a minor has provided us data, email [email protected] and we will delete it.
10 Changes to this Policy
We may update this Policy. Material changes will be announced at least 30 days in advance via the email address on your account.