Privacy Policy
This privacy policy explains how safe-mcp processes personal data when you use our website and services. It applies to safe-mcp.com, app.safe-mcp.com and the safe-mcp gateway at api.safe-mcp.com.
Last updated: 11 October 2026.
Controller
DAVIA Ventures UG (haftungsbeschränkt)
Kaiser-Wilhelm-Str. 16
c/o Daniel Albrecht
20355 Hamburg
Email: daniel@davia.ventures
The service
safe-mcp is an MCP gateway: one door in front of a team's MCP servers that applies policy and keeps history, goals and learning. The Google Analytics 4 reporting product continues as the Marketing Reporting server the gateway connects to.
Data we process
- Account data: name, email address, and authentication identifiers.
- OAuth data: per-user OAuth tokens for the MCP servers you connect, such as Google authorization tokens to access GA4 on your behalf when you connect Marketing Reporting.
- Project data: project configuration and a per-project log of tool calls (arguments, outcomes and responses). The members of your own account can see it, and so can we as the operator of the service (see below).
- Billing data: subscription status, billing records, and payment metadata from PayPal.
- Support data: communications and requests you send to us.
- Technical data: IP address, device data, timestamps, and log files.
How we use data
- Provide, operate, and maintain the safe-mcp service.
- Authenticate users and connect to the MCP servers you choose, such as Marketing Reporting for Google Analytics.
- Process subscriptions and payments.
- Secure and monitor the service, prevent abuse, and debug issues.
- Respond to support requests and legal obligations.
Legal bases (GDPR)
- Contract performance when delivering the service.
- Legitimate interests to secure, improve, and operate the service.
- Consent where required for specific processing activities.
Sharing and disclosures
We share data only with service providers that help us operate the service:
- Amazon Web Services (AWS): hosting, in the eu-central-1 region (Frankfurt).
- Google: sign-in, Google APIs only when you connect Marketing Reporting, and Google Analytics on this website if you accept analytics cookies.
- PayPal: subscriptions and payments.
Data from one account is not shared with another account. We may disclose data if required by law or to protect our rights.
As the operator of the hosted gateway, our administrators can read the data of every account, including project logs, for support, security and to keep the service running. We do not copy our own sign-ins or tokens into a customer's project.
Transfers to third countries
Google and PayPal may process data in the United States and other countries outside the EU/EEA. AWS hosts the service in the EU (Frankfurt), but as a US company may access data from outside the EU for support and operations. Where data leaves the EU/EEA, the transfer relies on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU standard contractual clauses.
Data retention
Project logs are not pruned: every recorded tool call is kept for as long as the service runs, so that the history stays complete. Deleting a project removes it from the app, but its data stays on our servers. Backups are kept for 30 days. Billing records are kept as long as tax law requires. To have an account's data erased, contact us at the address below.
Security
We use technical and organizational measures to protect data, including access controls and encryption where appropriate. No method of transmission or storage is 100% secure.
Your rights
Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal data, and to object or request portability. You may also lodge a complaint with a supervisory authority.
Cookies
We use necessary cookies for sign-in and security, and analytics cookies only on safe-mcp.com and only if you accept them. You can control which cookies you accept:
- Necessary cookies: Required for authentication, security, and basic website functionality. These cannot be disabled.
- Analytics cookies: Only on the public website (safe-mcp.com), and only after you accept them. Google Analytics 4 sets cookies with a client identifier and receives your IP address, pages visited and device data. This is personal data, and Google may process it in the United States. You can withdraw consent at any time below.
You can manage your cookie preferences at any time:
Updates to this policy
We may update this policy from time to time. Changes will be posted on this page with the updated date shown at the top.
Contact
If you have questions about this policy, contact us at daniel@davia.ventures.