Privacy Policy

1. Introduction

This Privacy Policy describes how MCP Bro ("we," "us," or "our") collects, uses, and protects your personal information when you use our AI chat platform and services (the "Service"). We are committed to protecting your privacy and handling your data in an open and transparent manner.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

When you register for and use our Service, we collect:

• Account Information: Email address, display name, and profile picture/avatar (if provided through OAuth)
• Authentication Data: OAuth provider information (Google or GitHub)
• Subscription Information: Subscription tier, payment status, and billing details
• User Preferences: Feature flags, organization settings (if applicable)

2.2 Automatically Collected Information

• Usage Data: Token quota usage, API interactions, timestamps of account creation, updates, and last login
• Authentication Tokens: Session tokens stored as cookies for authentication purposes
• Technical Data: User type, account status, permissions, and subscription status

2.3 AI Interaction Data

• Chat Messages: Your conversations with our AI models are processed to provide the Service
• Tool Usage: Records of which MCP tools you enable and use
• Model Preferences: Your selected AI models and system modes

2.4 Google Docs Add-on

When you choose Find Sources, the add-on sends your selected passage to MCP Bro. The model provider processes that passage to generate searches and rank results; search terms are sent to the selected source services. This source-search request does not upload the whole document. Google sign-in supplies identity information to authenticate your MCP Bro account. The add-on stores its MCP Bro session in your Apps Script user properties until sign-out or expiry.

Citation insertion reads the current document position and writes the citation you choose. Native footnotes use the Google Docs API after you select the active document in Google Picker. A short-lived Google access token is passed to Picker in the add-on sidebar for that permission flow and used by Apps Script for Google API operations. It is not sent to MCP Bro. The add-on requests access to the specific files you choose, not all your Google documents. Sign out through the add-on menu to revoke the MCP Bro session. You can separately remove the add-on and revoke its Google permissions from your Google Account. Contact hello@epmdev.no for account or data-removal requests.

For native footnotes, the add-on retrieves the active document through Google's API to locate the insertion point and check its revision. That response is handled within Apps Script. Citations and footnotes remain in your Google document until you edit or delete them there.

2.5 Google Workspace data and Limited Use

MCP Bro's use of raw and derived data received from Google Workspace APIs adheres to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. These commitments also cover aggregated and anonymized data derived from Google Workspace data.

We use this data for the source-search and citation features you request, account authentication, and access and usage management. We do not use it for advertising or creditworthiness decisions, or sell it to data brokers. We do not use Google Workspace data to train or fine-tune AI models, and do not authorize model providers to use it for model training.

For Google Docs searches, your selected passage is processed by Gemini or Claude through Google Cloud Vertex AI's EU endpoints. Source providers receive search terms and publication identifiers, not your document or Google access credentials. Those terms can include words from your selection. Our source service queries relevant research, library and statistics APIs, including NVA, the National Library of Norway, Statistics Norway, Semantic Scholar, Eurostat, PLOS and Crossref.

2.6 Google Docs retention and deletion

The source-search flow processes your selection and results for the current request, without creating a document copy or search history in our account database. We retain account identity, authentication sessions and usage totals to operate your account and quota. Signing out clears the add-on's saved session and account details; expired sessions cannot authorize requests. Our application's standard operational logs, which can include account identifiers and request metadata, are retained for 30 days. Account deletion follows Section 7.3. Removing the add-on does not itself delete your MCP Bro account or citations in your document.

Model and source providers may retain requests for service delivery, caching, security or abuse prevention under their applicable terms. This is separate from model training; we do not promise zero retention across those services. See Vertex AI data governance for Google's model-data protections and retention exceptions. Contact hello@epmdev.no or the privacy contact in Section 12 for data-removal requests.

3. How We Use Your Information

3.1 Service Provision

• To create and manage your user account
• To authenticate and authorize access to the Service
• To provide AI chat functionality and process your requests
• To track and enforce token usage quotas based on your subscription tier
• To enable MCP tool integrations as requested by you

3.2 Billing and Subscription Management

• To process payments through our payment processor (Stripe)
• To manage subscription changes, upgrades, and downgrades
• To handle billing inquiries and subscription cancellations

3.3 Service Improvement

• To monitor and analyze usage patterns to improve our Service
• To develop new features and functionality
• To troubleshoot technical issues and maintain system security

3.4 Essential Communications

• To send critical service notifications (e.g., system downtime, security updates)
• To communicate important changes to our terms or policies
• To respond to your support requests and inquiries

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide the Service you have requested
• Legitimate Interest: To improve our Service, prevent fraud, and ensure security
• Legal Obligation: To comply with applicable laws and regulations
• Consent: Where required by law, we will obtain your explicit consent

5. Third-Party Services and Data Sharing

We use the following third-party services to operate our platform:

5.1 Authentication and Data Storage

5.2 OAuth Providers

5.3 AI Service Providers

5.4 Payment Processing

6. Cookies and Tracking Technologies

We use the following cookies:

6.1 Essential Cookies

You can disable cookies in your browser settings, but this will prevent you from using our Service as authentication requires cookies.

7. Data Storage and Security

7.1 Data Location

Our core application infrastructure and EU model routes are hosted in the European Union:

7.2 Security Measures

We implement industry-standard security measures including:

• Encrypted data transmission (HTTPS/TLS)
• Secure authentication protocols (OAuth 2.0, JWT)
• HttpOnly and Secure cookie flags to prevent XSS attacks
• Regular security updates and monitoring
• Access control and permission-based authorization
• Firestore security rules to protect user data

7.3 Data Retention

We retain your personal data for as long as:

• Your account remains active, or
• As necessary to provide you with our Service, or
• As required to comply with legal obligations

Token usage data is retained for billing and quota management purposes for the duration of your subscription and for up to 7 years thereafter for accounting and tax purposes.

8. Your Rights and Choices

Depending on your location, you may have the following rights:

8.3 Exercising Your Rights

To exercise any of these rights:

1. Self-Service: Use the account settings in your profile to update or delete your information
2. Email: Contact us at gdpr@mcpbro.ai for data access, deletion, or other privacy requests
3. General Inquiries: Use the contact information in Section 12 below

We will respond to your request within 30 days (or as required by applicable law). For security purposes, we may need to verify your identity before processing certain requests.

9. Children's Privacy

Our Service is not intended for children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately, and we will take steps to delete such information.

10. International Data Transfers

This commitment describes model processing and our core hosting. External source lookups use the providers' APIs; they receive search terms and identifiers rather than the Google document. The separate Global chat option sends conversations to Anthropic's direct API and does not carry the EU model-routing commitment. Other third-party services listed in Section 5 operate under their own processing terms.

For users outside the EU: Your data will be transferred to and stored in the European Union, which the European Commission has determined provides an adequate level of data protection.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification to your registered email address for significant changes

Your continued use of the Service after such modifications constitutes acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For GDPR-related inquiries, complaints, or data deletion requests, please contact gdpr@mcpbro.ai. We will respond within 30 days.

13. Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with:

• Your local data protection authority (for EEA, UK, and Swiss residents)
• The supervisory authority in the jurisdiction where we operate

However, we encourage you to contact us first so we can address your concerns directly.

Appendix A: Data We Collect (Summary)

*Chat messages are processed in real-time to generate responses but are not permanently stored by us. AI providers may temporarily cache data according to their policies.

Appendix B: Third-Party Links

This Privacy Policy applies only to our Service. Our Service may contain links to third-party websites, MCP servers, or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.