Privacy Policy

Effective and last updated: August 2, 2026

In short: MCPal never stores the content of your tool calls, uses no analytics or advertising tracking, does not sell personal data, and deletes your data on request.

This policy explains what personal data MCPal collects, why we use it, who receives it, how long we keep it, and the rights you have.

1. Controller

MCPal is operated by OCTOPUS SERVICES, 144 ALLEE DES CAILLOTIERES 69400 GLEIZE, France, the controller for the processing described here. Contact: [email protected]. Full company details are in the Legal Notice.

2. Scope and roles

This policy covers:

• people who join the MCPal waitlist;
• publishers who create an account and publish an MCP server; and
• end users who sign in to use a server published through MCPal.

MCPal is the controller for the personal data this policy describes — the account, sign-in, billing, security and usage data involved in running the platform — for all three groups above. A publisher independently controls its upstream server and the data it processes there. Each publisher must provide its own Terms and Privacy Policy before going live. If enabled by the publisher, MCPal forwards a pseudonymous user identifier — not your name or email — to that server.

3. Data we collect

Waitlist visitors:

• name and email address;
• IP address used for abuse prevention and rate limiting; and
• signup and email delivery events.

Publishers:

• name, email address, account and sign-in identifiers;
• payment, subscription, payout-account, product and pricing identifiers and statuses;
• limited Stripe onboarding and verification status. Identity and bank information is entered directly into Stripe; Stripe holds it and sends MCPal the account details and status needed to operate payouts; and
• server metadata and API credentials, which are stored encrypted.

End users:

• account details, including email, name and a password credential stored in hashed form by our login system;
• sign-in and device data, including IP address, browser information, session records and a device-recognition cookie;
• consent records, including the accepted version, timestamp, IP address and browser information;
• connected-app registration details, including app name, redirect URLs, software version and registration IP address;
• Stripe customer, connected-account and subscription identifiers, subscription status, renewal date and cancellation status; and
• tool name, time, duration, result status, client identifier and a pseudonymous caller identifier for each tool call.

We do not store the content of tool-call requests or responses. It is relayed in memory only. Gateway logs do not include request bodies, response bodies or authorization headers.

4. How we obtain data

• From you: when you join the waitlist, create or use an account, configure a server, connect an app, subscribe or cancel, or contact us.
• Automatically: your browser, client and our systems generate sign-in, session, device, security and tool-call metadata as you use MCPal.
• From service providers: Stripe sends us payment, subscription, onboarding and payout statuses, and our email provider reports whether waitlist emails were delivered.
• From publishers and connected apps: they provide the server or app registration details needed to route your requests.

5. Purposes and legal bases

Data-protection law allows us to use personal data only where a legal basis covers each purpose. This is what we do and why it is lawful:

• We create accounts, authenticate users, route requests, apply quotas, manage subscriptions and provide publisher statistics. Without this the service cannot be delivered, so the legal basis is the contract between us (GDPR Article 6(1)(b)).
• We send waitlist and product updates only to people who asked for them. The legal basis is your consent (Article 6(1)(a)), and you can withdraw it at any time.
• We process payments and payouts and keep tax and accounting records. Charging and paying out is part of our contract with you, and keeping the records afterwards is required by law (Articles 6(1)(b) and 6(1)(c)).
• We prevent abuse and quota circumvention, secure the service, diagnose faults and establish or defend legal claims. You did not ask for this, but no service stays safe or reliable without it, so the legal basis is our legitimate interest in running a secure and reliable service (Article 6(1)(f)); you can object to this processing (see "Your rights" below).
• We record which version of the terms you accepted and when, and your privacy choices. The law requires us to be able to demonstrate some of this, and we have a legitimate interest in resolving disputes about what was agreed (Articles 6(1)(c) and 6(1)(f)).

Account, authentication and routing data is required to provide MCPal. Billing data is required only for paid plans. If you do not provide required data, the relevant account, tool access, payout or subscription cannot be provided.

Automated entitlement, quota, fraud-prevention and rate-limit checks can allow or deny an individual request. They do not produce legal or similarly significant effects. Contact us if you believe an automated check was wrong.

6. Marketing

We send waitlist and product updates only when you consent. We do not give your contact details to third parties for their own marketing. You can withdraw consent at any time through the unsubscribe link in an email or by contacting us. Withdrawal does not affect processing that took place before it. Account, security, billing and legal notices are service communications, not marketing.

7. Cookies

MCPal uses only strictly necessary sign-in, session and security cookies. The device-recognition cookie is kept for up to one year and helps prevent abuse of free quotas. The marketing site sets no cookies. We use no analytics, advertising technology or cross-site tracking.

You can review, block or delete cookies in your browser settings. Blocking strictly necessary cookies can prevent sign-in, session continuity or security controls from working. Because MCPal does not use optional cookies, there is no optional-cookie consent control.

8. Recipients

• Stripe — payment, subscription, onboarding and payout processing;
• Resend — waitlist contact storage and email delivery;
• Hetzner — infrastructure hosting in Germany and Finland; and
• the relevant publisher — aggregated usage statistics and, when enabled, a pseudonymous identifier accompanying relayed tool calls.

Our database and login systems are self-hosted on EU infrastructure. We disclose data to professional advisers, courts or authorities only when reasonably necessary to establish or defend claims or when legally required. We do not sell personal data or share it for cross-context behavioural advertising.

9. International transfers

MCPal's primary infrastructure is in the EU. Our use of Stripe and Resend can involve processing in the United States. Transfers rely on the EU–US Data Privacy Framework where the recipient's certification covers the processing and, otherwise, the European Commission's Standard Contractual Clauses with supplementary safeguards. You can request information or a copy of the applicable safeguards at [email protected].

10. Retention

• Waitlist contacts: until consent is withdrawn or 24 months after the last interaction, whichever comes first.
• Account and server records, such as profile details, settings and server configuration: kept while the account or server exists, then deleted or anonymised within 30 days after closure unless a more specific period below applies.
• Detailed tool-call usage records: up to 45 days. Non-identifying aggregated request totals and unique-user counts are kept for the life of the server so publishers can view historical trends.
• Routine security and diagnostic logs: up to 30 days. Records isolated for an identified security incident may be kept for up to 12 months or while a related claim is pending.
• Consent evidence: while the account or server is active and for five years afterward where needed to establish compliance or defend claims.
• Connected-app registrations and stored credentials: for the life of the registration or server, then deleted within 30 days.
• Subscription and transaction records: for the relationship and then as required for accounting, tax, fraud prevention and legal claims; accounting evidence may be archived for ten years under French law.

When a publisher deletes a server, MCPal first cancels its end-user subscriptions and then removes its end-user accounts, stored keys, registrations and platform usage data. Server deletion is paused until every subscription is confirmed cancelled. Deleted data may remain in encrypted routine backups until those backups are overwritten, normally within 30 days.

11. Your rights

Depending on the processing and the conditions in data protection law, you have the right to:

• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• request deletion or restriction of processing;
• receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller;
• object to processing based on our legitimate interests, including any direct marketing; and
• withdraw consent at any time without affecting processing that was lawful before withdrawal.

Email [email protected] to exercise a right. Requests are ordinarily free of charge. We respond within one month; complex or numerous requests can take up to two further months, and we will tell you within the first month if we need more time. We can request information needed to verify your identity and will provide the response in an accessible electronic format unless you request another available format.

You may complain to your local supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL).

12. Publisher services and other websites

This policy covers MCPal, not the upstream services operated by publishers or third-party websites linked from MCPal. Publishers independently decide how their servers process request and response content and must provide their own privacy notice. Review that notice before using a server. Other websites have their own privacy policies and controls.

13. Children

MCPal is not directed to children under 16 and we do not knowingly collect their personal data. Contact us if you believe a child has provided data.

14. Security and changes

We use access controls, encryption, data minimisation and operational safeguards appropriate to a small hosted software service. No system is completely secure.

We will post changes here and update the effective date. We will give reasonable notice of material changes and, where the law requires fresh consent, ask for it.

15. Contact

OCTOPUS SERVICES — [email protected]. Full company details are in the Legal Notice. See also our Terms of Service.