AnythingMCP Cloud is live — 7-day free trial−30% for 3 months with START30
AnythingMCP

Privacy Policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

Data collection on this website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator: helpcode.ai GmbH, E-Mail: [email protected].

2. Hosting

This website is hosted on DigitalOcean. The servers are located in Frankfurt, Germany (EU). DigitalOcean is ISO 27001 certified. A data processing agreement (DPA) is in place.

3. General information and mandatory disclosures

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the applicable data protection regulations and this privacy policy.

4. Data collection on this website

Cookies and consent

This website uses cookies. When you first visit the site, a cookie consent banner is displayed. You can choose which categories of cookies to allow: essential (always active), analytics, functionality, and marketing. Your choice is stored in the "cc_cookie" cookie. You can change your preferences at any time via the "Cookie Settings" link in the footer or on our Cookie Policy page.

Contact form

When you send us inquiries via the contact form, your details from the form, including the contact details you provide, are stored by us for the purpose of processing the inquiry and for follow-up questions.

Error and performance monitoring (Sentry)

To detect and fix technical errors, this website uses Sentry, a service of Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. When an error occurs in your browser or on our server, a report is sent to Sentry; for about one in ten page visits, the loading times of the page are also measured. The legal basis is our legitimate interest in a stable, secure and error-free website (Art. 6(1)(f) GDPR). Sentry sets no cookies and is not used for analytics or advertising.

  • Transmitted: the address of the page (without personal URL parameters such as email addresses, keys or payment session IDs), browser, operating system and device type, the error message with its technical stack trace, the steps immediately before the error (pages visited, page elements clicked, requests made by the page) and, for measured visits, loading times.
  • Not transmitted: cookies, form contents, the contents of requests and responses, or information about you as a person. We do not pass your IP address on to Sentry, and storage of IP addresses is disabled in our Sentry account.
  • Reports are sent via our own domain (anythingmcp.com/monitoring) and stored in Sentry's EU region (Frankfurt, Germany). Sentry deletes error reports after 90 days at the latest; performance data is kept in full for 30 days and, depending on our plan, in sampled form for up to 13 months.
  • After an error, the page stores a timestamp in your browser's session storage (amcp_error_reload_at) so that it reloads itself at most once; it is deleted when you close the tab. This is technically necessary for the website to work (Section 25(2) no. 2 TDDDG).
  • Functional Software, Inc. is based in the USA, so this processing may involve a transfer to a third country. Sentry is certified under the EU-U.S. Data Privacy Framework; in addition, a data processing agreement (DPA) including the EU standard contractual clauses is in place. Privacy policy: https://sentry.io/privacy/.

5. Analytics and tracking

Google Tag Manager

This website uses Google Tag Manager (GTM) to manage tracking scripts. GTM itself does not collect personal data and does not set cookies. GTM operates with Google Consent Mode v2 – scripts are only activated after you give explicit consent via the cookie banner.

Google Analytics

If you accept analytics cookies, Google Analytics is loaded via Google Tag Manager. Google Analytics uses cookies (such as _ga, _gid) to collect anonymous usage statistics. IP anonymization is enabled. Data processing is based on your consent (Art. 6(1)(a) GDPR). You can revoke your consent at any time via the cookie settings.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

6. Marketing and advertising

If you accept marketing cookies, third-party services (such as Google Ads, Meta/Facebook) may be loaded via Google Tag Manager to serve relevant advertisements and measure campaign effectiveness. These services may set their own cookies (e.g. _gcl_*, _fbp). Data processing is based on your consent (Art. 6(1)(a) GDPR).

Google Ads Enhanced Conversions

We use the "Enhanced Conversions for Web" feature of Google Ads. If you have consented to marketing cookies and complete a conversion on our website (e.g. a registration or purchase), first-party data collected by us — such as your email address — is hashed using the SHA-256 procedure and transmitted to Google exclusively in this hashed (pseudonymised) form. Google uses the hash solely to match the conversion to Google accounts in a privacy-friendly way and to measure campaign performance; the plain-text data does not leave our systems. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can revoke at any time via the cookie settings. More information: https://business.google.com/privacy/products/enhanced-conversions/.

Google Ads conversion measurement for purchases

If you have consented to marketing cookies and reach our website through a Google ad, we store the Google click identifier contained in the link (gclid, gbraid or wbraid) in your browser's local storage (amcp_ad_click, deleted after 90 days) and, if you buy a subscription, pass it to our payment provider Stripe with the order. Once the purchase is completed, our server sends Google the click identifier, the order number, the time and value of the purchase, your consent status and your email address hashed with SHA-256. Google uses this data only to attribute the purchase to the ad click and to measure and optimise our campaigns; your email address is never transmitted in plain text. Without marketing consent neither the click identifier nor a hashed email address is stored or transmitted. We keep no plain email address for this purpose; the hash is deleted after a successful upload, or after 60 days at the latest. The legal basis is your consent (Art. 6(1)(a) GDPR; for storage on your device Section 25(1) TDDDG). You can withdraw your consent at any time with effect for the future via the cookie settings (link in the footer). Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-U.S. Data Privacy Framework.

ChatGPT Ads conversion measurement

If you have consented to marketing cookies and reach our website through an ad in ChatGPT, we store the click reference that OpenAI adds to the link (oppref) in your browser's local storage (amcp_ad_click, deleted after 90 days) and pass it on with your registration to AnythingMCP Cloud and, if you buy a subscription, with the order to our payment provider Stripe. When you confirm your email address, when your workspace makes its first successful tool call and when you complete a purchase, our server sends OpenAI the click reference, an event identifier, the time of the event, for a purchase its value and currency, and your email address hashed with SHA-256. OpenAI uses this data only to attribute these events to the ad click and to measure our campaigns; your email address is never transmitted in plain text, and we do not load any OpenAI script on our pages. Without marketing consent neither the click reference nor a hashed email address is stored or transmitted, and nothing is sent for visitors who did not come from an ad in ChatGPT. We keep no plain email address for this purpose; the hash is deleted after a successful transmission, or after 7 days at the latest. The legal basis is your consent (Art. 6(1)(a) GDPR; for storage on your device Section 25(1) TDDDG). You can withdraw your consent at any time with effect for the future via the cookie settings (link in the footer). Recipient: OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. A transfer to OpenAI OpCo, LLC in the USA cannot be ruled out; such a transfer is based on the EU standard contractual clauses.

7. Payment provider

Stripe

We use Stripe (Stripe Inc.) for payment processing. Stripe processes payment data in accordance with PCI DSS Level 1. Data processing takes place in the EU. Privacy policy: https://stripe.com/privacy.

8. Email delivery

Resend

We use Resend for sending transactional emails. A data processing agreement (DPA) is in place.

Mailgun (EU)

Emails sent from the AnythingMCP Cloud application (invitations, email verification, system notifications) are delivered via Mailgun's EU region (Mailgun Technologies, Inc.). Delivery runs on EU infrastructure. A data processing agreement (DPA) is in place. If you configure your own SMTP server in your workspace, it is used instead and no email data reaches Mailgun.

9. AI-assisted features (Knowledge Graph and AI Skills)

Two optional features use a large language model provided by Anthropic PBC: Knowledge Graph enrichment, which proposes relationships between the entities your connectors expose, and AI Skills, which turns recurring tool usage into reusable rules. Both are switched off by default and require an explicit opt-in per workspace. While they are off, no data is transmitted to an AI provider.

  • Transmitted: connector and tool metadata (names, descriptions, parameters) and, where intent capture is enabled, the pattern of the requests made. The business records your connectors return are not transmitted.
  • Before transmission, captured request texts are automatically scrubbed of e-mail addresses, telephone numbers, IBANs, card-like numbers and long digit sequences.
  • The model's output is a suggestion. It becomes effective only once a person in your workspace approves it.
  • Model used: Claude Haiku (Anthropic PBC). If you host AnythingMCP yourself, you choose the provider and supply the key; nothing is transmitted until you do.
  • Anthropic PBC is based in the USA, so this processing involves a transfer to a third country. Anthropic's Data Processing Addendum, which its commercial terms incorporate by reference, applies. Under those terms Anthropic does not use content submitted through the API to train its models.

10. AnythingMCP Cloud and connections from AI assistants

When you use AnythingMCP Cloud (cloud.anythingmcp.com) and connect it to an AI assistant such as ChatGPT or Claude, we process the following data to provide the service. We do not sell it, do not use it for advertising and do not use it to train AI models.

  • Account data: name, email address, password hash or single sign-on identity, workspace memberships and roles. Purpose: sign-in, access control and support. Kept until you delete your account or workspace.
  • Sign-in with Google, Microsoft or GitHub: if you choose to sign up or sign in with one of these accounts, the provider sends us your account ID there, your name, your email address and whether it has verified that address. We use this only to create your account and sign you in; we never receive your password there and no other data from that account, and we post nothing on your behalf. The link is kept until you disconnect it in the settings or delete your account. Providers: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) and GitHub B.V. (Prins Bernhardplein 200, 1097 JB Amsterdam, Netherlands). A transfer to their parent companies in the USA cannot be ruled out; they are certified under the EU-U.S. Data Privacy Framework. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
  • Workspace configuration: connectors, MCP servers, roles, workspace notes and approved skills. Credentials for the systems you connect (API keys, tokens) are stored encrypted (AES-256-GCM) and deleted together with the connector.
  • Tool calls: when an AI assistant calls a tool, we record the time, the tool, the user, the result status, the duration, the input and an excerpt of the output, as the workspace's audit log and for troubleshooting. Inputs and outputs are shortened to excerpts after 14 days, and the records are deleted after 90 days.
  • Data from your connected systems is fetched only when a tool is called and is passed to the AI assistant you use; apart from the call record above it is not stored.
  • Recipients: the systems you connect (called with your credentials), the AI assistant you connect (which processes the results under its own terms), our hosting provider DigitalOcean (Frankfurt, Germany), our email providers (Section 8) and Stripe for payments (Section 7). Payment, banking and trading connectors are not offered to AI assistants on the shared endpoint.
  • Your controls: you choose which workspace or server an AI assistant may reach when you connect it and can change or revoke this at any time; administrators set roles per person; you can delete connectors, the workspace and your account in the settings, or ask us at [email protected].
  • Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

11. Support chat and support requests

When you are signed in to AnythingMCP Cloud, or to a dedicated AnythingMCP instance that we operate for your organisation, you can contact us through the support chat in the application or by email to [email protected]. The support desk runs on our own server at DigitalOcean in Frankfurt, Germany, using the open-source software Libredesk; no external chat provider is involved. Installations that customers host themselves do not load the chat.

  • Processed: your name, email address and user ID, the messages and files you send us and, so that we can help without asking first, a snapshot of your workspace: workspace name and ID, plan and end of the trial, your role, the number of connectors and, for connectors with problems, their name, sign-in status and the number and last error message of failed calls in the last 24 hours. Credentials, tokens and API keys are removed from error messages before they are sent.
  • Sorting and suggested replies: each new conversation is categorised and given a suggested reply by Claude Haiku (Anthropic PBC). Before the messages are sent to Anthropic, email addresses, phone numbers, IBANs, card-like numbers and long digit sequences are removed. The suggestion is only visible to our support team.
  • AI assistant in the chat: questions about setting up connectors and connecting AI assistants can be answered first by an AI assistant that uses our documentation (OpenAI, GPT models; the documentation is indexed with OpenAI embeddings). For this, your messages and the workspace snapshot are sent to OpenAI. Answers from the assistant are marked as such, and you can ask for a person at any time; billing, refunds, deletion and data protection requests are always handled by a person.
  • Anthropic PBC and OpenAI OpCo, LLC are based in the USA, so this processing involves a transfer to a third country. Their data processing addenda, including the EU standard contractual clauses, apply, and under their API terms neither uses the content submitted to train its models.
  • Replies by email are sent via Resend (Section 8). In the application the chat stores a session identifier in your browser (libredesk-session and libredesk-visitor); it is needed for the chat to work and is removed when you sign out.
  • Retention: conversations are kept as long as needed for your request and for follow-up questions; you can ask us to delete them at any time at [email protected]. Backups of the support desk are deleted after 14 days.
  • Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering support requests quickly and accurately (Art. 6(1)(f) GDPR); the session identifier is strictly necessary for the chat you use (Section 25(2) no. 2 TDDDG).

12. Your rights

You have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of data processing, as well as the right to rectification or deletion of this data. You can contact us at any time for this purpose and for further questions regarding personal data.