Privacy Policy

HostMCP.dev ("we," "us," or "our") is operated by HostMCP Engineering and is committed to protecting the privacy of individuals who use our platform and website. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

This policy complies with the General Data Protection Regulation (GDPR), India's Digital Personal Data Protection Act 2023 (DPDP Act), and other applicable data protection laws.

We collect the following categories of information:

Account Information: Name, email address, company name, and password (hashed) when you register.

Usage Data: Pages visited, features used, tool executions, connector configurations, and platform interactions.

Technical Data: IP address, browser type, operating system, device identifiers, and session data collected via cookies and server logs.

Connector Metadata: Tool definitions, schemas, and configuration entries you create on the platform. Note: we store tool metadata, not your actual business data (e.g., database records).

Communication Data: Messages you send us via contact forms or support channels.

Billing Data: For paid plans, billing is handled by a PCI-DSS compliant payment processor. We do not store raw card numbers.

We use collected data for the following purposes:

• Service Delivery: To create and manage your account, authenticate you, and provide platform features.
• Security: To detect, investigate, and prevent fraud, abuse, and security incidents.
• Compliance: To maintain audit logs required by GDPR, DPDP Act, PCI-DSS, or HIPAA as applicable to your plan.
• Product Improvement: Aggregate, anonymised usage analytics to understand how features are used and prioritise development.
• Communications: Transactional emails (account activity, billing, security alerts) and, with your consent, product updates and marketing.
• Legal Obligations: To comply with applicable laws, court orders, or regulatory requests.

We do not sell your data to third parties.

For users in the European Economic Area (EEA), we process personal data on the following legal bases:

• Contract: Processing necessary to deliver the service you've signed up for.
• Legitimate Interests: Security monitoring, fraud prevention, and aggregate product analytics.
• Consent: Marketing communications (you can withdraw consent at any time).
• Legal Obligation: Compliance logging and regulatory reporting.

For users in India, we comply with the Digital Personal Data Protection Act 2023:

• We collect only the personal data necessary for the stated purposes (data minimisation).
• Data Fiduciary: HostMCP Engineering is the Data Fiduciary for Indian users.
• Data Principals (users) have rights to access, correct, and erase their personal data.
• We do not transfer Indian users' personal data to countries not notified by the Central Government without appropriate safeguards.
• Enterprise customers in India may opt for a dedicated `asia-south1` (Mumbai) deployment to ensure all metadata processing stays within India.
• To exercise your DPDP rights, contact: privacy@hostmcp.dev

We use the following types of cookies:

Essential Cookies: Required for authentication and security. These cannot be disabled.
Analytics Cookies: We use privacy-respecting analytics (no cross-site tracking) to understand platform usage. You can opt out in your account settings.
Preference Cookies: Store your UI preferences (e.g., theme, language).

We do not use third-party advertising cookies. You can manage cookie preferences via our cookie banner or browser settings.

We retain your data for as long as your account is active or as needed to provide services. Specific retention periods:

• Account data: Retained until account deletion + 30 days for backup purge.
• Audit logs: Enterprise customers: retained per their configured policy (default 90 days). Pro: 30 days. Community: 7 days.
• Billing records: Retained for 7 years for tax and legal compliance.
• Support communications: Retained for 2 years.

On account deletion, personal data is purged within 30 days, except where retention is legally required.

We share data with the following categories of third parties only as necessary:

• Cloud Infrastructure: Google Cloud Platform (GCP) — our primary cloud provider. Data is processed in GCP regions you select.
• Database: MongoDB Atlas — stores account and connector metadata.
• Authentication: Firebase Auth by Google.
• Payment Processing: A PCI-DSS Level 1 compliant processor (Stripe or equivalent). We share only what's required for billing.
• Legal Compliance: We may disclose data to law enforcement or regulators when legally required to do so.

All third-party processors are bound by data processing agreements (DPAs) consistent with GDPR and applicable law.

Depending on your jurisdiction, you have the following rights:

Access: Request a copy of all personal data we hold about you.
Rectification: Correct inaccurate or incomplete data.
Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal retention requirements).
Portability: Receive your data in a structured, machine-readable format.
Restriction: Ask us to restrict processing in certain circumstances.
Objection: Object to processing based on legitimate interests.
Withdrawal of Consent: Withdraw marketing consent at any time without affecting prior processing.

To exercise any right, email: privacy@hostmcp.dev. We will respond within 30 days.

We implement industry-standard security measures including:

• AES-256 encryption for data at rest; TLS 1.3 for data in transit.
• Credential secrets are never stored in plaintext — they are encrypted via GCP Secret Manager.
• Immutable audit logs for all platform actions.
• Regular vulnerability assessments and penetration testing.
• Access to production systems is restricted and logged.
• Employee background checks and security training.

HostMCP.dev is deployed on GCP. By default, data is processed in `us-central1`. Enterprise customers can select a specific GCP region to meet data residency requirements.

For transfers from the EEA to other regions, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. For transfers involving Indian data, we comply with DPDP Act requirements for cross-border data flows.

HostMCP.dev is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact privacy@hostmcp.dev and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the platform at least 30 days before they take effect. Continued use after the effective date constitutes acceptance of the updated policy.

For privacy-related questions or to exercise your rights:

Email: privacy@hostmcp.dev
Data Protection Officer (DPO): dpo@hostmcp.dev
Postal Address: HostMCP Engineering, [Address], India

For EU/EEA users, you also have the right to lodge a complaint with your local supervisory authority. For Indian users, complaints may be filed with the Data Protection Board of India once operational.