Privacy policy

MCP Hosted is a trade name of Pixel Perfect (Pixel Perfect Agency B.V.), Watertoren 51a, 3247 CL Dirksland, the Netherlands, registered with the Dutch Chamber of Commerce under number 89660374. You can reach us at [email protected].

We are the controller for the personal data described here. This policy covers the website, the hosted service and the self-hosted server.

Like every website, our server receives what your browser sends with each request: your IP address, the page you ask for, the time and your browser. The server keeps these in its logs for 14 days, so we can keep the site running and secure, and then deletes them. Our legal basis is our legitimate interest in a website that works and is not abused (Article 6(1)(f) GDPR).

Every visitor gets a session: a random ID in a cookie, and in our database your IP address, your browser and the time of your last request. Once you sign in, it also holds which account is yours, and while a sign-in code is waiting to be used, the email address we sent it to. It keeps forms safe and keeps you signed in, and it ends 120 minutes after your last request.

These are the only cookies we set, and the only things we keep in your browser:

• mcp_hosted_session. Your session.
• XSRF-TOKEN. Protects forms against forged requests, and ends with your session.
• eyes_sid. A random ID for the website statistics, in session storage. Your browser forgets it when you close the tab.
• appearance. Whether you chose light or dark mode, in local storage. It never leaves your browser.
• mcp-hosted:last-used-auth-method. How you signed in last time, in local storage, to mark that option on the sign-in page. It never leaves your browser.

We count visits with Eyes, without cookies: the pages you view, the page you came from, how long you stay and how far you scroll, how fast pages load, and clicks such as starting a checkout. Eyes tells visitors apart by IP address and browser, and by that random ID. Our legal basis is our legitimate interest in knowing how the website is used (Article 6(1)(f) GDPR).

Your browser fetches the fonts from Bunny Fonts and the statistics script from Eyes, so both see your IP address.

The MCP check looks up the website you type in the official MCP Registry. If you leave your email address there, we keep it with the tool you asked for and your language, to count the most wanted tools and to email you when we build yours, and for nothing else. We keep it until you ask us to delete it. Our legal basis is your consent (Article 6(1)(a) GDPR), which you can take back at any time.

When you sign up for the hosted service, we keep what it needs to work. Our legal basis is the contract with you (Article 6(1)(b) GDPR).

• You. Your name and email address. You sign in with a code or link we email you, which works once and for 15 minutes, or with Google or GitHub. Google also sends your profile picture and GitHub your public profile, such as your username and picture, but we keep only your name, your email address and an ID.
• Your connections. The name you give each one, the tool, its API key or sign-in, encrypted with AES-256, when it was last used, and how many tool calls it got each day, without what was asked or answered. For Google Search Console, also the email address of the Google account you connect.
• Your AI assistants. The name each one gives itself, its login once you approve it, and which connections it used.
• Your support tickets. What you write, and the tool and error it is about.
• Your payments. Polar handles them, and your card details go to Polar, never to us. We keep which product you bought, the amount, the date and the ID Polar gives you, as the law requires (Article 6(1)(c) GDPR). Polar also sends us a message about each payment and subscription, with your name, email address, billing address, tax ID if you gave one, and the IP address and browser you checked out with. We keep those messages for 30 days, then delete them. When a payment comes in, we tell Eyes the amount and the IP address and browser you checked out with, so it can count the payment with your visit.
• Error reports. When something breaks, Sentry gets what went wrong and where in the code, without request bodies, tool arguments or API keys. Our legal basis is our legitimate interest in a service that works (Article 6(1)(f) GDPR).

We keep your account until you delete it under Settings, where you can also change your name and email address. Then we delete your keys and the logins of your AI assistants right away, and your subscriptions end when the period you paid for runs out. Your name, your email address, the names of your connections and your support tickets stay in our database, marked as deleted. Your invoices stay with Polar, the emails you sent us stay in our support mailbox, and error reports stay with Sentry until it deletes them.

When your AI assistant asks, we fetch the answer live from your tool and pass it straight on. We keep no copy, never pass it to anyone else, and run no AI model that could train on it. Once the answer reaches your assistant, its own privacy settings apply.

That data can hold personal data of other people, such as your customers. For that data you are the controller, and we process it only on your behalf, to answer your AI assistant. How we protect it is on our security page.

Some tools also run on your own computer, started with one npx command. Your API key and your data then never pass through our servers, and the server sends us no statistics and no error reports. Its log stays on your computer.

What the server does talk to:

• Your tool. The server calls the API of your tool directly, with the key you give it.
• Polar. The server checks your license key with Polar once, when it starts.
• The npm registry. npx downloads the server from npm, and when your license does not cover a newer build, the server asks npm which builds it does cover. npm sees your IP address, as it does for any package you install.

These companies help us run MCP Hosted. Some of them are based in the United States. Your AI assistant and the tools you connect are not on this list: you choose them, and their own terms apply.

• Cloudflare. The network in front of our server: DNS, HTTPS and protection against attacks. Every request passes through it.
• DigitalOcean. Hosts our server and database, in a data centre in the EU.
• Polar. Handles payments and licenses. It gets your name and email address, and the IP address and browser you check out with.
• Resend. Sends your sign-in emails and passes support tickets on to our mailbox.
• Namecheap Private Email. Hosts our support mailbox.
• Sentry. Receives error reports, stored in its EU region in Germany.
• Eyes. Website statistics: page views, clicks and completed payments.
• Bunny Fonts. Serves the fonts of this website.
• Google, GitHub. Only when you choose to sign in with them.

Under the GDPR you can ask us for access to the personal data we hold about you, and to correct, delete, restrict or transfer it, or object to how we use it. You can take back your consent at any time. Write to us at the address under Who we are, and we answer within a month.

If you think we handle your data wrongly, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

When we change this policy, we update this page and the date at the top. If a change matters for what we do with your data and you have an account, we email you before it applies.