Terms of Service

Last updated 17 October 2026

These terms are the agreement between you and mcpspan Cloud, the hosted version of mcpspan at app.mcpspan.com. The short version: your MCP servers send us measurements of their calls, we store them and show them to you, we try hard to get it right, and what your servers send is yours.

They do not cover the self-hosted mcpspan you run yourself. That is open source software under the MIT licence, and its licence is the only agreement there.

1. Who you are dealing with

mcpspan Cloud is operated by Kacper Zatoń, a private individual based in Poland, reachable at [email protected]. In these terms, "we" and "us" mean the operator, and "you" means the person or organisation using the service.

Creating an account means you accept these terms. We record which version you accepted and when. If you do not accept them, do not create an account.

2. What the service is

You add the mcpspan SDK to an MCP server you run. Each time an AI agent calls one of its tools, resources or prompts, the SDK measures the call in your process and sends us a description of it. We store those descriptions and show them to you in a dashboard: which tools are called, from which client, how long they take, how they fail.

What the SDK sends, and what it never sends, is set out in the privacy policy and in the SDK's own documentation. In short: never the values of arguments or the content of answers, but names, timings, outcomes, and the error message of a call that failed, cut short.

It is a tool for understanding your servers, not a guarantee about them. We give no service level commitment: there is no promised uptime, and no promise that every call your servers make will be recorded. The SDK is built so that mcpspan being unavailable never stops your server working; it is not built to keep every measurement through every outage.

3. Who may use it

The service is intended for businesses, developers and other people using it in a professional capacity, and you must be at least 18 years old to hold an account.

If you are a consumer within the meaning of the law that applies to you, nothing in these terms takes away rights you have that cannot be taken away by agreement. Where a clause below goes further than the law allows in your case, it applies to the greatest extent it lawfully can, and no further.

4. Your account

Give a working email address and confirm it. Until it is confirmed, your account can store far fewer events each month than your plan allows.

Keep your password to yourself. Anything done through your account is treated as done by you. Each server's API key lets whoever holds it send data to that server: keep keys out of public repositories, and replace one from Settings if it may have been seen.

Tell us promptly at [email protected] if you believe somebody else has access to your account.

5. The data your servers send

You confirm that you are entitled to run the servers you connect and to have their calls measured and stored by us.

The error messages your tools produce are sent as they are, cut short. If a tool can fail with text you would not send anywhere, such as a path, a token or somebody's personal data, the SDK has options to stop sending error messages for it; using them is your responsibility.

Where what your servers send includes personal data of other people, you are the controller of that data and we process it on your behalf. Section 12 sets out how.

6. Limits and fair use

Each plan allows a number of servers and a number of events a month across all of them, and keeps those events for a number of days. All three are listed on the pricing page. Once the month's events are used up, new ones are refused until the month ends or your plan changes; the SDK drops what was refused and carries on, and your server is not affected. Events older than your plan keeps are deleted.

You must not:

• send data from servers you are not entitled to measure;
• use the service to place load on somebody else's systems, or to send anything other than what the SDK sends;
• attempt to gain access to parts of the service that are not yours, to other customers' data, or to the infrastructure behind it;
• probe, scan or test the service's defences without our written permission;
• resell the service or offer it to third parties as if it were your own, without our written permission;
• use it to store or transmit anything unlawful.

7. Trial and fees

A new account has a free trial of 14 days. It needs no card, and it never turns into a charge on its own: every charge starts with you choosing a plan and confirming it at the checkout, where the price and any tax that applies are shown before you agree to anything.

When a trial ends without a plan, new events are refused, and the dashboard keeps showing what was recorded. If no plan is chosen within 14 days of the trial ending, your servers and everything they recorded are deleted; the account itself stays until you delete it.

Paid plans are billed monthly in advance and renew automatically until you cancel them. Payments are taken by Stripe, who handle the card details; we never see or store them.

You can change or cancel your plan at any time from your account. Moving to a larger plan takes effect at once and you pay only the difference for the rest of the month. Moving to a smaller one, or cancelling, takes effect at the end of the month you have already paid for; we do not refund the remainder of a month you chose to leave part-way through.

If a payment fails, Stripe retries for several days and your plan continues while it does. If it never succeeds, the subscription ends and the account is treated as one whose trial has ended.

If we change what a plan costs, we will tell you by email before it applies to you, and you will have the chance to cancel before the new price is charged.

8. Availability, changes and suspension

The service is provided as it is and as it is available. We may change how it works, add or withdraw features, and take it down for maintenance. Where a change materially reduces what you get, we will tell you by email in advance if we reasonably can.

We may suspend or close an account that breaches these terms, that puts the service or other customers at risk, or that we are required to act against by law. Where it is reasonable and lawful to do so, we will tell you first.

9. Ending it

You can delete your account at any time from Settings. Deleting it removes your organisation, every server in it and everything they recorded, and it cannot be undone. Export anything you want to keep before you do it. Copies in our nightly backups age out within 30 days.

If you have a paid plan, deleting your account cancels the subscription at the same time, so nothing continues to be charged afterwards. It is cancelled immediately, and the remainder of that month is not refunded.

If we close the service, we will give you reasonable notice by email so that you can export your data.

10. No warranties

To the fullest extent permitted by law, the service is provided without warranty of any kind, whether express or implied. In particular we do not warrant that it will be uninterrupted, timely, secure or error free, that every call will be recorded, or that the figures it shows will meet any requirement you have in mind.

11. Limitation of liability

To the fullest extent permitted by law, we are not liable for indirect or consequential loss, nor for loss of profit, revenue, goodwill, business or anticipated savings, nor for business interruption, however caused.

Where we are liable in spite of the above, our total liability for all claims arising in any twelve month period is limited to the amount you paid us for the service in that period, or one hundred euro if you paid us nothing.

Nothing in these terms excludes or limits our liability for death or personal injury caused by our negligence, for fraud, for intentional harm or gross negligence, or for anything else that cannot lawfully be excluded or limited, including, if you are a consumer, your mandatory rights.

12. Processing personal data on your behalf

This section applies where what your servers send includes personal data, for example in an error message, and it is the data processing agreement between us under Article 28 of the GDPR. You are the controller of that data and we are the processor.

• Subject and duration. We process it to provide the service, for as long as your plan keeps it or until you delete it or your account.
• Nature and purpose. Storing what the SDK sends and showing it back to you. Nothing else: we do not analyse it for ourselves, combine it with other data, sell it or use it to train anything.
• Types of data and data subjects. Whatever your tools put in an error message or a tool, resource or prompt name, about whoever your servers serve. The SDK never sends argument values or answers.
• Instructions. We act only on your documented instructions, which are these terms and what you do in the service, unless the law requires otherwise, in which case we will tell you first if the law allows.
• Confidentiality. Only the operator has access to the systems that hold it.
• Security. The measures in section 12 of the privacy policy.
• Sub-processors. Those listed in section 8 of the privacy policy. You authorise them generally; we will tell you by email before adding or replacing one, and you may object by ending the agreement.
• Assistance. We will help you answer requests from data subjects and meet your obligations on security, breach notification and impact assessments, as far as the nature of the service allows.
• Breaches. We will tell you without undue delay after becoming aware of a breach affecting this data.
• Deletion. Deleting your account deletes the data; backups age out within 30 days.
• Audits. We will give you the information needed to show these obligations are met, and answer reasonable questions about them in writing.

13. Your responsibility to us

If a third party brings a claim against us because of data your servers sent, or your breach of these terms, you will cover the loss and the reasonable costs that claim causes us, except to the extent it was our fault.

14. Changes to these terms

We may change these terms. The version in force is always the one on this page, with its date at the top. Where a change materially affects you we will email you before it takes effect; continuing to use the service after that means you accept the new version. If you do not, delete your account.

15. Law and disputes

These terms are governed by Polish law, and disputes are for the courts having jurisdiction over the operator's place of residence. If you are a consumer, this does not deprive you of the protection of the mandatory rules of the country you live in, nor of the right to bring proceedings in the courts there.

If any part of these terms is found unenforceable, the rest stays in force and the unenforceable part is read down to what is allowed.

16. Getting in touch

Write to [email protected]. How we handle personal data is in the privacy policy.