Privacy Policy

1. Who we are

The controller of your personal data is BKTY LTD, a company registered in England and Wales (Company No. 12845913), 29 Watts Lane, Rugby, England, CV21 4PE.

We are registered with the Information Commissioner’s Office (ICO) under registration number ZC165481.

For any privacy question or request, email [email protected].

2. The personal data we process

Account data

Your email address, whether it has been verified, the sign-in provider you used (Google or Apple) and the unique identifier that provider assigns to you, and the date your account was created. We receive this from our sign-in service when you sign in. We never receive your Google or Apple password.

Device data

For each computer you pair: its name (the computer’s network name, for example “Alex’s MacBook”), its platform (for example macOS), the device’s public key, when it was paired and last connected, and whether it is enabled.

Conversation data

The conversations you have in MCPtoAI: titles, the messages you send and the replies you receive, the provider and model used, and the names, inputs and outputs of tools used in a conversation. Tool outputs can include file names, file contents, command output or results from MCP services that you have allowed or approved. We store this so that you can continue a conversation on another device or in the browser.

Messages in transit

Our relay passes messages between the web app and your device. Messages are processed in memory to deliver them and are stored only as conversation data, as described above.

Technical and security data

Short-lived connection tickets, one-time security values used to prevent captured requests from being replayed, rate-limit counters, and server logs containing the time, address and outcome of requests and your browser’s user agent. Our servers receive traffic through Cloudflare and do not generally record your IP address in their logs; Cloudflare processes IP addresses to deliver and protect the service.

Correspondence

If you contact us, we keep your message and our reply so that we can deal with your request.

3. Data that stays on your device

The following is stored on your computer and is not sent to us:

• your AI provider API keys, kept in your operating system’s credential store (the Keychain on macOS);
• your device’s private signing key;
• sign-in tokens and secrets for MCP services you connect;
• your permission settings and MCP server configuration;
• the files and applications on your computer.

If a tool reads a file or runs a command and its result is shown in a conversation, that result becomes part of your conversation data and is stored as described in section 2.

4. How we use your data and our lawful bases

We do not use your data for advertising, we do not sell it, and we do not use your conversations to train AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. AI providers and MCP services you choose

When you send a message, your device sends the conversation, including any tool results, to the AI provider you selected, using your own API key and your own account with that provider. When the AI uses an MCP tool, the request is sent to that MCP service.

These providers act on your instructions and under their own terms and privacy policies; they are not our processors. Please review their policies before you connect them. If you use a local model, for example through Ollama or LM Studio, the request is processed on your computer; the conversation is still saved to your conversation history.

6. Service providers we use

We use the following service providers to run MCPtoAI. They process personal data on our behalf and under contract:

Our own servers are operated by BKTY LTD and located in the United Kingdom. If you sign in with Google or Apple, that company handles your account with them as an independent controller under its own privacy policy.

We may also disclose personal data if the law requires it, to protect the rights and safety of our users or others, or as part of a sale or reorganisation of our business, in which case we will tell you in advance.

7. International transfers

Some of our service providers process personal data outside the UK, including in the United States. Where this happens, we rely on safeguards recognised under UK data protection law, such as the UK Extension to the EU–US Data Privacy Framework or the International Data Transfer Addendum to standard contractual clauses. You can ask us for more information about these safeguards.

8. How long we keep data

Where data is held in backups, it is removed when those backups are overwritten, within 30 days.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use your data;
• receive your data in a portable format and have it transferred to someone else.

You can delete conversations in the web app and remove a device from MCPtoAI Desktop at any time. To use any of the other rights, including deleting your account, email [email protected]. We will respond within one month and may need to confirm your identity first.

If you are unhappy with how we handle your data, please contact us first so that we can try to put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

10. Cookies and similar technologies

• app.mcptoai.com uses strictly necessary cookies, set by our sign-in system, to keep you signed in and to protect sign-in against forgery. The service cannot work without them, so they do not require consent.
• mcptoai.com remembers the language you choose in your browser’s local storage. It does not use cookies.
• We do not use analytics, advertising or tracking cookies.

11. Security

We protect personal data with measures that include keeping API keys on your device, encrypting all connections, signing every device connection with a key unique to that device, and letting you control every action through Off, Ask and Allow permissions. Read more on our Security page.

No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the ICO as required by law.

12. Children

MCPtoAI is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has created an account, please contact us and we will delete it.

13. Changes to this policy

We may update this policy as MCPtoAI develops. We will change the date at the top of this page and, if the changes are significant, let you know by email or in the app before they take effect.

14. Contact us

BKTY LTD, 29 Watts Lane, Rugby, England, CV21 4PE. Email: [email protected]. ICO registration number: ZC165481.