Privacy Policy

Workspace content is used solely to run the service for you: the AI business analyst reads your business context, playbooks, thread history and the tool results it pulls (analytics, CRM contacts, connected data) to do the work you ask for. We do not train models on your data and we do not sell data to third parties.

The included AI tier is served by OpenRouter(openrouter.ai, United States). Every workspace that has not connected its own model key runs on it. What is sent per run: the prompt, the compacted thread, your business description and goals, workspace memory, and the results of the tools the assistant calls — which can include contact names and emails from your CRM. Processing happens in the US under OpenRouter’s own policy (which names the model provider it routes each request to); we do not make promises on a provider’s behalf beyond what its policy states.

Bring your own key:if you connect Anthropic, OpenAI, Google, Groq, DeepSeek, xAI, Mistral, OpenRouter, MiniMax or a custom endpoint, runs go to that provider on your key and under your contract with them instead — nothing reaches the included tier. The full list, with each provider’s location, is in the sub-processor table.

When you connect Gmail, Google Drive, Slack or GitHub, we read only what the connection authorises. Content from those sources is stored in your workspace knowledge base tagged as untrusted, meaning the assistant treats it as data, never as instructions.

Connected databases.If you connect your own PostgreSQL, MySQL, BigQuery or Snowflake, the credential is held in our encrypted vault and the connection is read-only. Two different things happen to what we read. The database’s shape— table and column names and types — is refreshed into your knowledge base every six hours; no sample rows are ever stored there. Query results are not stored by us at all: they are passed to whichever AI model your workspace is configured to use, in order to answer the question that was asked, and they appear in that conversation. Queries are logged (truncated) against the run that made them. You decide what the connection can reach by scoping the database role you create for it, and you can disconnect it at any time from Connections, which deletes the stored credential.

Gmail inbox sweep.With a connected mailbox, we check for new inbound mail every 15 minutes. Automated and bulk mail is filtered out. A reply from a known contact is logged on that contact’s timeline; a first email from a genuinely new human sender creates a CRM contact for that person (name, email, the message) and an assisted reply draft that you review before anything is sent.

Those senders are third parties whose data you, the workspace owner, are the controller of. Where GDPR applies you carry the Art. 14 duty to inform them (typically satisfied by your own privacy notice and the reply you send). Disconnect the mailbox at any time from Connections; stored contacts stay until you delete them.

For our customers (we are processor).On paid plans, company identification is on by default. When a visitor loads a page on a customer’s site, we store the IP address the request came from on that visitor’s pseudonymous enrichment record, look it up in our own in-house graph to find the organisation that uses that network, and link the company to the visit. A job that runs every three hours finishes any lookup the page view did not, and then deletes the address. A workspace can instead choose to keep addresses (“Store visitor IP”), or turn company identification off entirely, in Settings. On a site using our consent mode this only happens after the visitor consents.

For our own graph (we are an independent controller).Separately from the service we provide to any one customer, we use data from every site that runs our script — on every plan, Free included — to maintain the graph itself, which maps network ranges to the organisations that use them. Because we decide this purpose ourselves, we are the controller for it, not our customers’ processor. What we use:

• Network observations— the /24 (IPv4) or /48 (IPv6) network prefix a visitor was seen on, never the full address for this purpose, with the site’s pseudonymous visitor id, country, time zone and connection type. Kept for 30 days after the visitor was last seen on that network, at most 8 networks per visitor.
• Confirmations— when a visitor identifies with a business email (a form, a verified sign-up, a click on or reply to an outreach email), the network prefix, the email’s domain (never the part before the @), the site and that site’s pseudonymous visitor or contact id (never an email address). Unconfirmed entries expire after 30 days; a corroborated one becomes a company-level fact (“this network is used by this organisation”) that holds nothing about the visitor.
• A coverage benchmark — each day a sample of resolved addresses and network prefixes is checked against ipapi.is to measure how accurate the graph is. Only the address or prefix is sent, with no visitor or workspace attached, and results are deleted after 30 days.

Lawful basis:legitimate interests (GDPR Art. 6(1)(f)) — our interest, and our customers’, in accurate company-level identification of business visitors. We weighed it against visitors’ interests: the graph uses network prefixes and company domains only, reads nothing from the visitor’s device, is never used to identify, profile or contact an individual, does not link a person across sites, and expires within 30 days. It is disclosed to our customers in the DPA.

Your choices: as a visitor you can object to this processing at any time by writing to privacy@businessmcp.com with the network or address concerned; we will stop using it and delete the related observations. As a customer, turning company identification off in Settings stops your site contributing, on any plan where that switch is available to you; on any plan you can also ask us to stop it by email.

Separately from our customers’ data, we compile business-contact records about people in their professional capacity: name, job title, employer, work email, work phone where published, LinkedIn profile URL and the employer’s firmographics. They come from public company websites, public company registries and search-engine results, and businesses using our sales and CRM features can look up the people at a company they are researching. We are the controller of these records. For people in the EU/EEA and UK we rely on legitimate interests (Art. 6(1)(f)) in business-to-business contact, and you can object at any time.

We also offer these records through our Data API, to business customers under our Hub Terms, except records about people in the EU/EEA, the UK or Switzerland, or people we cannot place, which we never sell. The full disclosure, including sources and recipients, is on our data-broker page. To take your record out, use the opt-out form: no account or ID is needed, matching records are removed within about 24 hours, and we keep only a one-way hash so we do not collect you again.

To keep form spam out of your CRM and out of automated outreach, we score the domainof a newly captured lead email. We look up the domain’s registration age through RDAP (IANA bootstrap, rdap.org and the TLD registry) and its MX and A records through Google Public DNS (dns.google). Only the bare domain is sent — never the address, the person’s name, or their IP.

Verdicts are cached per domain for 180 days and shared across workspaces, so a domain is looked up once. A poor verdict flags the contact and keeps it out of automated outreach; it never deletes data, and a workspace owner can override it. We deliberately do not consult IP or country reputation lists for this purpose.

We are the controller for everything in this section. Our marketing site runs three kinds of measurement: our own cookieless tracker (in the consent mode described on the Cookie Policy), Vercel Web Analytics (a cookieless page-view count), and the two cookie-setting tags below — DataFast and Google Ads.

DataFast(datafa.st, operated by JustShipIt Pte. Ltd., Singapore) is a second analytics tool we use to see which pages and channels bring sign-ups. It sets two first-party cookies — a visitor id kept for a year and a 30-minute session id — and receives your IP address and browser details with each request. It loads only after you accept, or automatically outside the EU/EEA and UK, and never inside the app or on a customer’s website.

We buy ads on Google, so businessmcp.com loads Google’s advertising tag (gtag.js) to measure which ads produce sign-ups and subscriptions, and to build remarketing audiences. Google acts as our advertising processor for that measurement and is listed in the sub-processor register under its Ads Data Processing Terms.

Three boundaries, and they are enforced in code rather than promised: it never runs on a customer’s website (the script our customers install is a different, cookieless one), it never runs inside the logged-in app at /dashboard, and in the EU/EEA, the UK, or wherever we cannot determine your location it is not requested at all until you accept the notice. Outside those jurisdictions it runs under legitimate interest with Google Consent Mode set from your Global Privacy Control signal. DataFast follows the same three boundaries. Cookie names and lifetimes are in the Cookie Policy.

We also record a sign-up or subscription to Google from our own servers, so the measurement works when the tag is blocked. That upload carries the ad click identifier and a hashed email — never a plain address, and never anything about a customer’s own workspace data.

How long each kind of data is kept. Shorter on request where the law allows.

The vendors below process data to run the service. Core rows apply to every workspace; optional rows only see data when a workspace connects or enables that vendor. Each is bound by a data-protection agreement no less protective than our DPA.

We email workspace owners at least 30 days before adding a new core sub-processor so you can object as described in the DPA. Any MCP server, ad platform or tool you connect yourself is your own choice and is not listed here.

Under the GDPR and similar laws you have the right to access, rectify, erase, port, restrict, and object to the processing of your personal data, and to withdraw consent at any time.

To exercise any of these, email privacy@businessmcp.com or use the request form. We respond within 30 days. We will first verify that you are the person the request concerns — usually by replying to the email address on record, or by asking for a detail only the account holder would know. Workspace owners can export or delete any contact directly from the CRM without contacting us.

If your request concerns end-visitor data held on behalf of one of our customers, we will refer you to that customer (the controller) or assist them in responding. You also have the right to lodge a complaint with your local supervisory authority.