Privacy Policy

1. Who is responsible for your information

SourcetoMCP determines the purposes and means of processing your personal information as described in this policy, and is the controller of that information for the services this policy covers.

2. Scope

This policy covers our marketing website, the SourcetoMCP app and dashboard, our data connectors, and our MCP server. Where a linked service has its own privacy policy, that policy applies alongside this one.

3. Information we collect

We collect the following kinds of information:

• Account information: your name, email address and the credentials you use to sign in, including when you sign in with Google.
• Connected source data: when you link a tool such as Stripe, Google Search Console or Google Ads, we access data from that source to answer your agent's questions. The scope depends on what you connect and the permissions you grant.
• Usage and technical information: how you interact with the service, along with log data such as your device, browser and IP address.
• Billing information: where you are on a paid plan, records of your subscription. Card details are handled by our payment provider, not stored by us.

4. How we collect information

We collect information directly from you when you sign up, connect a source or contact us; automatically through cookies and similar technologies as you use the service; and from third parties such as the sources you connect and our payment processor.

5. AI agents and data handling

SourcetoMCP lets you connect an AI agent, such as ChatGPT, Claude or Perplexity, to your MCP server so it can query your connected data. We do not build or train the underlying AI models, and we are not responsible for how a connected agent or its provider handles data once it leaves our MCP server. We do not retain the content an AI agent generates beyond what is needed to return it to you.

6. How we use your information

• To provide and operate the service, including connecting your sources and returning answers to your agent.
• To create and manage your account and your plan.
• To keep the service secure and to detect and prevent misuse.
• To support you and respond to your requests.
• To improve the service and develop new features.
• To meet our legal obligations.

7. Legal bases

Where the GDPR or UK GDPR applies to you, we rely on the following legal bases: performing our contract with you, our legitimate interests in running and improving the service, your consent where we ask for it, and compliance with legal obligations.

8. Connected sources and authorisation

When you connect a source, you authorise us to access its data on your behalf. Refresh tokens and other connection credentials are encrypted at rest and only decrypted server-side to make the calls needed to serve your request. We use that access only to provide the service. You can disconnect a source at any time from your dashboard, which revokes our ongoing access to it.

9. How we share information

SourcetoMCP does not sell your personal information. We share it only in these situations:

• Service providers who help us run SourcetoMCP, such as our hosting, database and authentication provider, under agreements that protect your information.
• Providers of the tools and AI agents you choose to connect, to the extent needed to read the data you have authorised or to serve your query.
• Legal and safety reasons, where we are required to share information by law or to protect our rights, users or the public.
• A business transfer, such as a merger or acquisition, in which case we will let you know.

10. Cookies and tracking technologies

We use necessary, performance/analytics, functional, and (where enabled) advertising cookies. You can read more, and how to manage them, in our Cookie Policy.

11. Your choices and rights

Depending on where you live, you may have the right to access the personal information we hold about you, ask us to correct or delete it, object to or restrict certain processing, and request a copy of it. To exercise any of these rights, contact us using the details below and we aim to respond within 30 days. You may also complain to your local privacy regulator if you are not satisfied with our response.

12. Data security

We take reasonable administrative and technical steps to protect your information, including access controls and encryption in transit and at rest for connection credentials. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond quickly if something goes wrong.

13. Data retention

We keep your personal information for as long as your account is active and for as long as we need it to provide the service, meet our legal obligations, resolve disputes and enforce our agreements. Connection tokens and configuration data are kept until you disconnect the source or close your account. When information is no longer needed, we delete it or de-identify it.

14. International transfers

We and our service providers may store and process information in countries other than the one you live in. Where we transfer personal information across borders, we take reasonable steps to make sure it stays protected in line with this policy and applicable law.

15. Children

SourcetoMCP is not intended for people under 16, and we do not knowingly collect their personal information. If you believe a child has given us their information, please contact us so we can remove it.

16. Changes to this policy

We may update this policy from time to time. If we make a material change, we will take reasonable steps to let you know. The date at the top shows when it was last updated.

17. Contact us

If you have questions about this policy or how we handle your information, you can reach us at [email protected].