Privacy Policy

Last updated 17 October 2026

This policy covers mcpspan.com and mcpspan Cloud, the hosted service at app.mcpspan.com. It says exactly what we keep, why, and what happens when you ask us to delete it.

It does not cover the self-hosted mcpspan you run yourself: what that stores stays on your own machine, and we never see it.

1. Who is responsible

mcpspan Cloud is run by Kacper Zatoń, a private individual based in Poland, who is the controller of the personal data described here. For anything in this policy, including a request to see or delete what we hold, write to [email protected]. A postal address is available on request.

No data protection officer has been appointed; the scale of this processing does not require one.

Where your MCP servers send us personal data of other people, you are the controller of that data and we are your processor, as set out in section 12 of the terms of service.

2. What we hold

Your account

• Your email address, used to sign in and to send you the mails described in section 10.
• Your password, stored only as a hash. We cannot read it and cannot tell you what it is.
• Which version of the terms you accepted, and when.
• When you confirmed your email address.
• Your organisation's name, its plan, and how many events it has stored this month.

Your subscription

• The identifiers Stripe uses for you and for your subscription, the state that subscription is in, and the end of the period you have already paid for.
• No card details. See section 4.

Your servers

• Each server's name, and a hash of its API key. We cannot read a key back once it has been shown to you.
• Your alert rules, and the address of the webhook alerts are sent to.

What your servers send

For each call an AI agent makes to one of your server's tools, resources or prompts, the SDK sends:

• the tool's name, or the name a resource or prompt was registered under, never the address a client read;
• how long the call took, whether it succeeded, the error type, and the error message cut short when it did not;
• how large the answer was in bytes, never its content;
• whether it repeated the previous call's arguments, worked out in your process;
• for a call refused for its arguments, the names of those that did not match the tool's schema;
• which client called (for example Claude or Cursor), the session it was part of, and the versions of your server and the SDK;
• a fingerprint of each tool's definition, and its size, when your server lists its tools;
• if you turn the option on, the names and types of the arguments.

The values of arguments and the content of answers never leave your server, in any mode.

The error messages are the one place personal data can arrive by accident, since they are whatever your tools say when they fail. The SDK can be told not to send them.

3. What we do not hold

We do not record the IP address your browser or your servers connect from. Cloudflare, which carries the traffic, sees it, under its own policy. We keep no audit log of sign-ins.

4. Paying for it

Payments are handled by Stripe. We never see your card: the details are entered on Stripe's own checkout page and never reach this service.

What we keep is listed in section 2: the identifiers that let us ask Stripe about your subscription, its state, and the end of the paid period. Everything else stays with Stripe: the payment method, the billing address they collect, and your receipts. Stripe's own policy governs what they hold and for how long, including the records they have to keep after you have gone.

We do not ask for a VAT number and do not issue invoices to companies.

5. Why we are allowed to hold it

• To provide the service you asked for: your account, your servers, what they send and the dashboard that shows it. Article 6(1)(b) of the GDPR, performance of a contract.
• To keep the service secure and unabused: limits on wrong passwords, mails and sign-ups. Article 6(1)(f), our legitimate interest in a service that can be defended.
• To take payment and know what you are entitled to. Article 6(1)(b), and Article 6(1)(c) for the records accounting rules require.
• To meet other legal obligations where any apply to us. Article 6(1)(c).

6. Where it is kept

On a server rented from OVHcloud in Warsaw, Poland, and in nightly backups in Cloudflare R2 in the European Union.

7. How long we keep it

• What your servers send: for as long as your plan keeps it, counted from when each call happened, after which it is deleted. Hourly totals, which hold counts and timings by name and no error messages, are kept for up to two years.
• After a trial ends without a plan: your servers and what they sent are deleted 14 days later.
• Account, organisation and server details: until you delete the account.
• Backups: each nightly copy of the database is deleted after 30 days.

8. Who else is involved

We do not sell your data and we do not share it for anybody's marketing. It is handled by a small number of providers acting on our instructions:

• OVHcloud: provides the server that runs the service and the database holding everything in section 2.
• Cloudflare: carries the traffic between you, your servers and us, and stores the nightly backups.
• Resend: delivers the emails we send you.
• Stripe: takes the payments, and holds the card details we never receive.

Some of these are established outside the European Economic Area, and where that is the case transfers rely on the European Commission's standard contractual clauses.

9. Cookies and tracking

One cookie, holding your session after you sign in to the dashboard. It is strictly necessary for the service to work, it cannot be read by scripts in your browser, and it is not used to follow you anywhere.

mcpspan.com sets no cookies. Neither runs advertising, tracking pixels or third party analytics.

10. Email

We send a link to confirm your address when you sign up, a link to choose a new password when you ask for one, and the messages about your account and subscription that the service needs to send, such as a trial ending or a payment failing. Alerts go to a webhook you choose, not to your email. We send no newsletters or marketing.

11. Your rights

Under the GDPR you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete it, which for the account as a whole is a button in Settings;
• restrict or object to a particular use of it;
• hand it over in a portable form. What your servers recorded can be exported from the dashboard at any time.

Write to [email protected] and we will answer within one month. If you think we have handled your data badly, you can complain to your local supervisory authority; in Poland that is the President of the Personal Data Protection Office (UODO).

12. Security

Traffic is encrypted in transit. Passwords and API keys are stored only as hashes. Each customer's data is reachable only through the servers of their own organisation. The database is not reachable from the internet; the address your servers send to accepts events and nothing else. Wrong passwords, mails and sign-ups are limited.

No arrangement is perfect. If we discover a breach affecting your data, we will tell you and the supervisory authority as the law requires, and we will say what we know rather than what is comfortable.

13. Children

The service is not intended for anyone under 18, and we do not knowingly hold data about children.

14. Changes to this policy

The version in force is the one on this page, with its date at the top. Where a change materially affects how we handle your data, we will email you before it takes effect.