Privacy policy
Last updated 2026-11-02
1. Who is responsible
MCPify
Emsdettener Straße 10, 48268 Greven, Deutschland
Email: Legal@getmcpify.app
This policy explains how MCPify for WooCommerce ("MCPify", "we") processes personal data when merchants connect a WooCommerce store with the MCPify plugin and use the service at woo.getmcpify.app, and when anyone visits this website.
2. Our role
For data about the merchant's account (store, WordPress users who use MCPify, plan) we are the controller. For data from the merchant's store that passes through MCPify on the merchant's instruction, such as product, order or customer data, the merchant is the controller and we process it on their behalf as a processor (Art. 28 GDPR) under our data processing agreement.
3. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Store address and name, WordPress, WooCommerce and plugin versions, the WooCommerce REST API key the merchant approves (encrypted) and a secret shared with the plugin (encrypted) | Provide the service and call the store's REST API on the merchant's behalf | Contract (Art. 6(1)(b) GDPR) |
| WordPress user ID, display name, email address and role of the people who connect the store, open the MCPify dashboard or approve an AI client | Sign-in to the dashboard, roles (owner, manager), showing who approved which AI client | Contract; legitimate interest in secure access control (Art. 6(1)(f)) |
| Connection settings, hashed API keys, OAuth client registrations, consent records and token hashes | Authenticate AI clients and enforce the merchant's rules | Contract |
| Audit log: time, connection, AI client name, user, requested tool and REST route, result, reason and a shortened copy of the request arguments, with customer names, email addresses, phone numbers and addresses removed (IDs are kept) | Let the merchant see and verify every AI request; security and abuse prevention | Contract; legitimate interest in security |
| Monthly request counters, plan status, and the Paddle customer and subscription IDs of the store's subscription | Plan limits and billing | Contract |
| Issue reports an AI client sends after the user approved them (with store and connection ID; keys, tokens, email addresses and phone numbers are filtered out) | Support and fixing bugs | Contract; legitimate interest in improving the service |
| Server logs (IP address, time, requested URL) and a session cookie for the dashboard | Operating and securing the service, rate limiting, keeping you signed in | Legitimate interest (Art. 6(1)(f)); the cookie is strictly necessary |
Store data the AI client requests (for example products, orders or customers) is passed through to the AI client and not stored by us. Customer names, email addresses, phone numbers and addresses are removed from the request arguments before they are written to the audit log. Responses kept for safe retries are deleted after 24 hours. While the merchant keeps customer data switched off for a connection, names, addresses, email addresses, phone numbers and IP addresses are removed before the response leaves MCPify.
4. AI clients
The merchant chooses which AI client (for example Claude, ChatGPT, Cursor or Codex) connects to their store. Data the AI client receives is processed by its provider under the merchant's agreement with that provider. We do not send store data to AI providers on our own and do not use store data to train AI models.
5. Recipients
- Hosting: Render Services, Inc. (region Frankfurt, EU). Data is stored in the EU.
- Paddle.com Market Ltd (United Kingdom), our online reseller and Merchant of Record for paid plans. When you buy a plan you enter your payment and billing details directly with Paddle, which processes them as an independent controller under its own privacy policy (paddle.com/legal/privacy). We receive the subscription status, your customer and subscription IDs and the email address you used, not your payment details.
Where a provider is located outside the EU/EEA or may access data from there, transfers rely on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
6. How long we keep data
- Audit log: 7 days (Free), 30 days (Starter), 365 days (Pro and Agency).
- Issue reports: 30 days.
- Stored responses for safe retries: 24 hours.
- OAuth consents: up to 90 days (shop managers: up to 7 days), or until revoked.
- Dashboard sessions: 12 hours. Single sign-on links: 60 seconds, usable once.
- When the merchant disconnects the store or deactivates the plugin, all AI client access ends immediately and the REST API key is deleted, in the store and at MCPify. All other data of the store is deleted 30 days later, unless the store is connected again before then. On request we delete it earlier.
7. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). Contact us at Legal@getmcpify.app. You may also lodge a complaint with a data protection supervisory authority. Customers of a store contact the store; we help the merchant answer such requests.
8. Security
Connections use HTTPS. The store's REST API key and the secret shared with the plugin are encrypted; API keys, OAuth tokens and codes are stored only as hashes. Every AI request is checked against the merchant's rules before it reaches the store. Details: security.
9. Changes
We update this policy when the service changes. The date at the top shows the latest version.