ChatMCPSpace

1. Data We Collect

When you use the Service, we may collect the following categories of information:

Account Data

Email address you use to register and log in.
Password, stored only as a bcrypt hash. We never store your plaintext password.
A unique API key and an encryption salt generated for your account.

Agent and Message Data

Agent names associated with your account.
Messages and questions sent by your agents, including content, priority, urgency flags, and optional free‑response hints.
Options attached to interactive questions (option text, benefits, downsides, and default flags).
Your responses to questions (selected options and optional free‑text explanations).
Free‑text messages you send back to your agents from the dashboard.
Timestamps and "read" status for messages and responses.

Usage and Log Data

HTTP request metadata such as IP address, request path, HTTP method, response status, and response size.
Security‑related logs for authentication attempts, API key usage, rate‑limit events, and unauthorized access attempts (including IP address, user ID where available, and user agent).
Error and performance logs used to debug and monitor the Service.

Voice and Audio Features

When server‑side text‑to‑speech is enabled, we may send short notification phrases (for example, "Received urgent message from <agent name>") to Google Cloud Text‑to‑Speech to generate audio files that are cached on our server.
Optional in‑browser speech recognition and speech synthesis use your browser's Web Speech APIs. Audio for speech recognition may be processed by the browser vendor or its providers; this is handled by your browser, not by our servers.

Cookies and Local Storage

Session cookies used to keep you signed in. These cookies are httpOnly and are required for basic functionality.
Local storage and session storage entries in your browser, such as voice notification preferences and a derived encryption key used for end‑to‑end encryption. These values are stored client‑side; we do not read them on the server.

2. How We Use Your Data

We use the data described above to:

Create and maintain your account and authentication sessions.
Deliver agent messages, questions, and responses to your dashboard and APIs.
Generate API guides, setup scripts, and integration helpers that embed your API key, base URL, and encryption salt.
Provide optional text‑to‑speech and voice interaction features.
Monitor and protect the Service through logging, rate limiting, and security auditing.
Troubleshoot issues, analyze performance, and improve the Service over time.

We do not sell your personal information or your message content to advertisers or data brokers.

3. Encryption and Message Privacy

The Service supports an optional end‑to‑end encryption workflow. When enabled in your agents and scripts:

Message content is encrypted on your side using your password and a user‑specific salt before being sent to the Service.
Our servers store the encrypted ciphertext and the per‑user encryption salt but do not store your password or the derived encryption key.
Decryption happens in your browser or agent runtime using your password or derived key.

Even when encryption is used, we still process unencrypted metadata such as timestamps, agent names, message type (message vs. question), priority, and whether a question has been answered. If you choose not to use the encryption helpers, message content may be stored in readable form in our database.

4. Legal Bases and Use Restrictions

We process your information to provide and operate the Service, to secure and maintain the platform, and to comply with applicable law. You remain responsible for ensuring that your use of the Service (including any personal data you send through it) complies with the laws that apply to you.

The Service is not intended for processing highly regulated categories of data such as payment card numbers, government‑classified information, or protected health information where specific legal regimes (for example, HIPAA) apply.

5. How We Share Information

We may share your information with:

Infrastructure providers that host our application, databases, and caches in order to deliver the Service.
Google Cloud or similar providers for server‑side text‑to‑speech, limited to short notification phrases.
Service providers who help us monitor, secure, and operate the platform (for example, log aggregation or alerting tools).
Law enforcement or other third parties when required by applicable law or to protect the rights, property, or safety of the Service, our users, or others.

We do not grant third parties the right to use your Content for their own advertising or independent data monetization.

6. Data Storage, Retention, and Deletion

Data is stored primarily in our PostgreSQL database and, for some features, in Redis caches and on disk (for example, cached audio files for text‑to‑speech).

In general:

Account data is kept for as long as your account is active, unless we remove it under the Terms or as required by law.
Messages, questions, options, and responses are kept while your account and relevant agents exist.
Deleting an agent from within the Service will also delete associated messages, options, and user responses for that agent, subject to any backups or logs kept for security and operational purposes.
Logs and backups may be retained for a period of time to support debugging, security investigations, and reliability, and may not be deleted immediately when you delete other data.

Because the Service is in beta, retention behavior may change as we refine the system. We aim to keep data no longer than reasonably necessary for the purposes described above.

7. Your Choices and Controls

You can configure how your agents use the API and decide whether to enable the end‑to‑end encryption helpers.
You can delete agents (and their associated conversations) from the dashboard.
You can enable or disable voice notifications in the settings page; this toggles voice playback in your browser.
You can clear local storage and session storage in your browser to remove locally cached encryption keys and preferences.
If you have questions about your data or need help with access or deletion beyond the in‑product controls, you can contact us using the support options in the application.

8. Children's Privacy

The Service is intended for use by adults and is not directed to children under the age of 13 (or any higher age required by applicable law in your jurisdiction). We do not knowingly collect personal information from children in those age ranges. If you believe we have collected such information, please contact us so we can investigate and take appropriate action.

9. International Data Transfers

The Service and its providers may process and store data in countries other than the one where you are located. By using the Service, you consent to the transfer of information to countries that may have different data‑protection laws than your own, while we continue to handle your data as described in this Policy.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above and may provide additional notice within the Service. Your continued use of the Service after the revised Policy becomes effective indicates that you have read and understood the changes.

11. Contact

If you have questions about this Privacy Policy or how your data is handled, please reach out using the contact form or support channels exposed in the application.

This Privacy Policy is a general template and may need to be reviewed or adapted by legal counsel to address specific regulatory requirements that apply to your use of the Service.