Privacy Policy

1. Introduction

This Privacy Policy describes how MCP Bro ("we," "us," or "our") collects, uses, and protects your personal information when you use our AI chat platform and services (the "Service"). We are committed to protecting your privacy and handling your data in an open and transparent manner.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

When you register for and use our Service, we collect:

• Account Information: Email address, display name, and profile picture/avatar (if provided through OAuth)
• Authentication Data: OAuth provider information (Google or GitHub)
• Subscription Information: Subscription tier, payment status, and billing details
• User Preferences: Feature flags, organization settings (if applicable)

2.2 Automatically Collected Information

• Usage Data: Token quota usage, API interactions, timestamps of account creation, updates, and last login
• Authentication Tokens: Session tokens stored as cookies for authentication purposes
• Technical Data: User type, account status, permissions, and subscription status

2.3 AI Interaction Data

• Chat Messages: Your conversations with our AI models are processed to provide the Service
• Tool Usage: Records of which MCP tools you enable and use
• Model Preferences: Your selected AI models and system modes

3. How We Use Your Information

3.1 Service Provision

• To create and manage your user account
• To authenticate and authorize access to the Service
• To provide AI chat functionality and process your requests
• To track and enforce token usage quotas based on your subscription tier
• To enable MCP tool integrations as requested by you

3.2 Billing and Subscription Management

• To process payments through our payment processor (Stripe)
• To manage subscription changes, upgrades, and downgrades
• To handle billing inquiries and subscription cancellations

3.3 Service Improvement

• To monitor and analyze usage patterns to improve our Service
• To develop new features and functionality
• To troubleshoot technical issues and maintain system security

3.4 Essential Communications

• To send critical service notifications (e.g., system downtime, security updates)
• To communicate important changes to our terms or policies
• To respond to your support requests and inquiries

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide the Service you have requested
• Legitimate Interest: To improve our Service, prevent fraud, and ensure security
• Legal Obligation: To comply with applicable laws and regulations
• Consent: Where required by law, we will obtain your explicit consent

5. Third-Party Services and Data Sharing

We use the following third-party services to operate our platform:

5.1 Authentication and Data Storage

5.2 OAuth Providers

5.3 AI Service Providers

5.4 Payment Processing

6. Cookies and Tracking Technologies

We use the following cookies:

6.1 Essential Cookies

You can disable cookies in your browser settings, but this will prevent you from using our Service as authentication requires cookies.

7. Data Storage and Security

7.1 Data Location

All services and data storage are hosted in the European Union:

7.2 Security Measures

We implement industry-standard security measures including:

• Encrypted data transmission (HTTPS/TLS)
• Secure authentication protocols (OAuth 2.0, JWT)
• HttpOnly and Secure cookie flags to prevent XSS attacks
• Regular security updates and monitoring
• Access control and permission-based authorization
• Firestore security rules to protect user data

7.3 Data Retention

We retain your personal data for as long as:

• Your account remains active, or
• As necessary to provide you with our Service, or
• As required to comply with legal obligations

Token usage data is retained for billing and quota management purposes for the duration of your subscription and for up to 7 years thereafter for accounting and tax purposes.

8. Your Rights and Choices

Depending on your location, you may have the following rights:

8.3 Exercising Your Rights

To exercise any of these rights:

1. Self-Service: Use the account settings in your profile to update or delete your information
2. Email: Contact us at gdpr@mcpbro.ai for data access, deletion, or other privacy requests
3. General Inquiries: Use the contact information in Section 12 below

We will respond to your request within 30 days (or as required by applicable law). For security purposes, we may need to verify your identity before processing certain requests.

9. Children's Privacy

Our Service is not intended for children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately, and we will take steps to delete such information.

10. International Data Transfers

Our infrastructure is hosted in EU regions (specifically europe-west and europe-west1), ensuring that your data remains subject to European data protection laws at all times.

For users outside the EU: Your data will be transferred to and stored in the European Union, which the European Commission has determined provides an adequate level of data protection.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification to your registered email address for significant changes

Your continued use of the Service after such modifications constitutes acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For GDPR-related inquiries, complaints, or data deletion requests, please contact gdpr@mcpbro.ai. We will respond within 30 days.

13. Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with:

• Your local data protection authority (for EEA, UK, and Swiss residents)
• The supervisory authority in the jurisdiction where we operate

However, we encourage you to contact us first so we can address your concerns directly.

Appendix A: Data We Collect (Summary)

*Chat messages are processed in real-time to generate responses but are not permanently stored by us. AI providers may temporarily cache data according to their policies.

Appendix B: Third-Party Links

This Privacy Policy applies only to our Service. Our Service may contain links to third-party websites, MCP servers, or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.