MCPgap

Privacy notice

Last updated 31 October 2026

This notice explains what personal data MCPgap handles, why, and for how long. It covers the request-access list, enquiries from the contact form, visit counts on our public pages and in the app, accounts on this site and the MCP server that AI agents call.

Who we are

Tehidea Ltd runs MCPgap and decides how your personal data is used: under UK data protection law we are the controller. ICO registration number: ZC259665.

Tehidea Ltd, registered in England and Wales, company number 05902165. Registered office: 86–90 Paul Street, London EC2A 4NE, United Kingdom. Email: [email protected].

What we collect, and why

  • Request access. Your email address, the version of the consent words you agreed to, and when you asked, confirmed or unsubscribed. With them we keep a history of the emails we sent you and whether each was delivered, a hash of each link token in those emails, and, until it is sent, the email itself, encrypted. We use them to email you about your access request and nothing else. Lawful basis: your consent. We keep the record of your consent to show we had it (legitimate interests). Giving your email address is optional, but without it we can't handle your request.
  • Enquiries. If you use the contact form: your work email, your company, the offer you asked about and when you asked, plus your name and message if you give them. We use them to reply to your enquiry and discuss MCPgap with you. Lawful basis: legitimate interests in answering enquiries and discussing our service with the businesses that ask. The providers below handle them for us; useSend delivers each enquiry to our inbox. Your email address and company are required: without them we can't reply.
  • Visit counts. We use Umami, on our own server, to count visits to our public pages and the app, clicks on a few buttons, and whether our forms went through, to improve the site, without cookies. In the app each count sends a fixed page label, such as /gateways/:id or /other, the page you came from as a fixed label or another site's address without its path, your screen size, your language and our site's name. A count on our public site also carries the campaign tags in the link you followed, such as utm_source, and nothing else added to the page address. No count carries your email address or what you type into a form. Lawful basis: legitimate interests in understanding how the site is used. Stop counts below, or in the app on your profile page. Each keeps its own choice.
  • Your account. If you sign up: your name, email address and password (stored only as a hash), plus the IP address and browser of each sign-in session. We use them to run your account and keep it secure. Lawful basis: contract.
  • Questions from AI agents. When an agent calls our MCP server, we store the question it asks, what it says about itself and who it works for, the answer the person replies with, a hash of each reference the agent gets back, and the caller's IP address, which we use as its key for rate limits. We use them to deliver the question, return the answer and stop abuse. Lawful basis: legitimate interests in answering the question the agent was sent to ask. Agents are told not to include personal data about anyone else.
  • Telegram messages. Each update Telegram sends us in full: the reply, any question it quotes, and the sender's Telegram details. We use it to match the reply to its question. Lawful basis: legitimate interests in answering the question.
  • Abuse limits. We count requests per IP address to limit how often anyone can join, confirm, unsubscribe or send an enquiry, and how often anyone can sign up, sign in or use other account actions. Lawful basis: legitimate interests in keeping the service working.

We treat every question from an agent as untrusted text: before a person sees it, we remove its links and defuse its commands and mentions, and mark it as agent text.

Cookies

Our public pages set no cookies, and our visit counts use none. If you stop the counts, this browser stores that choice as umami.disabled. When you sign in, we set a session cookie to keep you signed in. Over HTTPS its name is __Secure-better-auth.session_token; otherwise better-auth.session_token. It expires 7 days after it was last renewed, and we renew it while you use the site, at most once a day. It is strictly necessary, so we do not ask for consent.

Who handles it for us

  • Cloudflare sits in front of this site and our MCP server. Every request passes through it, so it sees your IP address and what you send, agent questions included. Cloudflare may process this outside the UK. Cloudflare's data processing agreement provides for UK transfers under the UK–US Data Privacy Framework extension where applicable, and otherwise under EU standard contractual clauses with the UK Addendum.
  • Hetzner hosts our servers and database in Nuremberg, Germany, which the UK recognises as providing adequate data protection, and we manage those servers with Dokploy.
  • useSend sends our email, through Amazon Simple Email Service. It sees your address and the message.
  • When a customer connects Telegram, it carries questions and replies between MCPgap and staff and may process them outside the UK, but we have identified no published DPA or UK transfer safeguard covering these disclosures; public-site visits do not involve Telegram.

We plan to add Stripe for payments. This notice will name it before it handles your data.

How long we keep it

  • Agent questions and answers: deleted by a scheduled job once a retention period has passed since the question was asked. The period is 90 days by default. The customer sees them in their activity list until then. A keyed hash of the caller's IP address and the agent's description of itself, which can hold a person's name, stay with the question for the same period.
  • References: they stop working, and the job deletes them, 7 days after the question by default.
  • Telegram messages we receive: deleted from our database by the same job, 7 days after we received them by default. A reply can arrive after its question, so its copy can outlast the question. Telegram's own copies of the messages follow Telegram's retention.
  • Request access: your address, consent record, email history and link-token hashes stay until you ask us to erase them. When you unsubscribe we stop new sends; a message already being sent may still arrive. Records of emails we cancelled are deleted 30 days after the cancellation. Mail already sent stays in useSend's logs under its own retention.
  • Enquiries: an hourly job deletes each enquiry from our database six months after you sent it. Emails we exchange about it stay in our mailbox until six months after our last contact.
  • Request-access and enquiry limits: each IP address's counter is deleted by an hourly job once it has been idle for a day.
  • Account limits (sign-up, sign-in and other account actions): each counter is kept in our database and deleted when a later request finds it older than its window, about a minute. Without later requests, a counter can stay longer.
  • MCP request limits: counted in memory only, never written to our database. A caller's one-minute count is cleared by a later request once it ends, or when the server restarts.
  • Question limits: no separate counter. We count the stored questions themselves, so these go when the questions go.
  • Your account: until you delete it. Deleting it removes your profile, your password hash and your sessions. A few short-lived records can outlast it: an email-verification link keeps your email address for 1 hour, a password-reset link keeps your user ID for 1 hour, and an account-deletion link keeps your user ID for 24 hours unless you use it first. Once expired, any of these records still stored is deleted the next time anyone requests a password reset. A sign-in session expires 7 days after it was last renewed; that ends the session, not the account.
  • Visit counts: we keep them on our own server, and no job deletes them yet.

Your rights

You have the right to see the data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to take a copy with you. Where we rely on your consent, you may withdraw it at any time with the unsubscribe link in any request-access email, or by writing to us. Withdrawing consent doesn't affect processing before you withdrew. To use any right, write to [email protected] or to our registered office.

How to complain

You have the right to complain to us at [email protected], and to the ICO. You may complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes

The date at the top says when we last changed this notice.