Privacy Policy

The controller for the processing described in this policy is Laya Studio, Avenue Dumas 7, 1206 Genève, Switzerland, which operates MCP Guard at mcp-guard.ai (“MCP Guard”, “we”, “us”), a hosted API that checks AI-agent tool calls before they run. For any privacy question or request, contact support@mcp-guard.ai. Full operator details are in the Imprint.

As controller we decide how your account, billing, website and usage-metadata data is processed. This policy covers that.

As processor we process the content of API and MCP requests (the proposed actions, tool arguments, user messages, conversation excerpts and other context you or your application send for checking) only on behalf of the customer who sends it and only to return a verdict. For that content the customer is the controller. A Data Processing Agreement is not available yet; until we publish one, our Terms govern that processing. If your data reaches us through someone else’s agent or application, their privacy notice explains that processing; please contact them first.

• Account data: email address, name (optional), workspace name, membership and role, authentication identifiers, and sign-in records kept by our authentication provider (time, IP address, user agent). If you sign in with Google, we receive your name, email address and Google account identifier from Google.
• API keys: stored only as a SHA-256 hash with a short display prefix.
• Billing data: handled by Stripe. We store a Stripe customer reference, subscription reference, plan, credit balance and a ledger of credit grants and purchases, never card numbers. Stripe may collect your billing address and tax ID for invoicing and tax.
• Request metadata: timestamp, request id, API key id, endpoint, model, status and error code, number of checks, credits charged, latency, and the backend that served the request. It does not contain request content or the verdict.
• Request content: the actions and context you send are processed in memory to produce a verdict and are not stored, logged or used for training. Tool arguments can contain personal data (for example an email recipient or a customer id); what they contain is decided by the customer.
• Technical and security data: when you visit the site or call the API, our hosting provider Cloudflare processes your IP address, request URL, time, status and user agent to deliver the service, rate-limit abuse and protect against attacks.
• Communications: emails you send us and our replies; transactional emails we send you (sign-in links, account and billing notices).
• Acceptance records: which version of the Terms and this policy you accepted, when, and the IP address and browser user agent you accepted from.

You provide account data to create an account; without it we cannot provide the service. Everything else is generated by your use of the service.

Under Swiss law we process personal data in line with the principles of the nFADP. Where the GDPR applies, our legal bases are:

• Providing the service (account, API, MCP server, dashboard, checking requests, metering and billing usage, transactional emails): performance of our contract with you, Art. 6(1)(b) GDPR.
• Security and abuse prevention (rate limits, logs, fraud and misuse detection): our legitimate interest in a secure, reliable service, Art. 6(1)(f) GDPR.
• Keeping accounting and tax records: legal obligation, Art. 6(1)(c) GDPR, including the Swiss bookkeeping duties of Art. 958f of the Code of Obligations.
• Service and policy notices (for example material changes to these documents): contract and legitimate interest.
• Sign in with Google: your choice to use it; you can use email sign-in instead.

We do not sell personal data, do not use it for advertising, do not send marketing emails without your consent, and do not make decisions about you based solely on automated processing, including profiling. The verdicts the service returns concern proposed software actions, not people; how a customer uses them is the customer’s responsibility.

• Request content: not retained; discarded from memory when the verdict is returned.
• Request metadata: deleted after 30 days.
• Daily usage totals (per workspace and key: requests, checks, credits, errors, latency): for the life of the account, for billing and your usage history.
• Account data: until you delete your account. Deleting it in the dashboard (Settings) takes effect immediately: your login and profile are deleted, the API keys of the workspaces you own are revoked and those workspaces are anonymised. A deletion requested by email is carried out within 30 days.
• Acceptance records: for the life of the account; on deletion we remove the IP address and user agent and keep the record of which versions were accepted, as evidence of the contract.
• Billing and accounting records (invoices, payments, credit ledger): 10 years, as required by Swiss law, even after account deletion.
• Hosting and security logs at Cloudflare: a few days, then deleted by the provider.
• Emails with us: as long as needed to handle the request, then deleted unless they are business records we must keep.

• Checks (API and MCP requests): Checks run on GPU servers we operate in Switzerland. If those are unavailable or overloaded, checks from workspaces without Swiss-only processing may be answered by the same model on RunPod (Runpod, Inc., USA) GPU workers in EU data centres (Czech Republic, France, Netherlands and Sweden), which process the request content in memory and keep nothing. Workspaces with Swiss-only processing are never failed over: they get a 503 instead. Requests reach the GPUs through Cloudflare’s network; request content passes through Cloudflare in transit and is not stored there.
• Account database and authentication: Supabase, AWS eu-central-2 (Zurich, Switzerland).
• Payments: Stripe. Transactional email: Resend.

Every provider, with what it receives and where, is listed on the Subprocessors page.

We share personal data only with service providers that help us run MCP Guard (processors bound by data processing terms), with Stripe and Google where they act as independent controllers for payments and sign-in, and with authorities where the law requires it. The full, current list, with what each receives and where, is on our Subprocessors page. In short:

• Cloudflare (website and API hosting, DNS, TLS, security, queues; global network, US company)
• RunPod (failover inference only, for workspaces without Swiss-only processing; EU data centres in Czech Republic, France, Netherlands and Sweden; US company)
• Supabase (authentication and database, hosted in AWS eu-central-2 (Zurich, Switzerland); US company)
• Stripe (payments, invoicing and tax; US/Irish entities)
• Resend (transactional email; United States)
• Google (Sign in with Google, only if you use it; independent controller)

Our account database and our primary inference servers are in Switzerland; failover inference runs in EU data centres. Some providers above are based in, or may process data in, other countries, including the United States. Switzerland and the EU recognise each other as providing adequate protection. For countries without an adequacy decision, such as the United States, we rely on the recipient’s certification under the EU-U.S. and Swiss-U.S. Data Privacy Framework where available, and otherwise on the European Commission’s Standard Contractual Clauses with the adaptations required for Swiss law, together with supplementary measures such as encryption in transit and not storing request content. You can request a copy of the relevant safeguards from support@mcp-guard.ai.

We use no advertising or analytics cookies. We use only what the service needs:

• Sign-in cookies set by our authentication provider to keep you logged in to the dashboard (strictly necessary).
• Local storage in your browser for interface preferences such as a collapsed sidebar or a chosen code language. It never leaves your device.
• Third-party pages and resources: Stripe Checkout and the billing portal (payments), Google’s sign-in script (on the login and signup pages), and the API reference viewer loaded from jsDelivr (on /docs/api). These providers receive your IP address and may set their own cookies under their own policies.

We use TLS on every connection, hash API keys, isolate tenants with database row-level security, keep GPU servers off the public internet, and restrict access to production systems. No system is perfectly secure; if we become aware of a breach affecting your personal data we will notify you and the competent authority as the law requires. See Security.

Subject to the applicable law, you have the right to information about and access to your personal data, to rectification, to erasure, to restriction of processing, to receive your data in a portable format, to object to processing based on legitimate interests, and to withdraw any consent at any time with effect for the future. A workspace owner can export their data and delete their account directly in the dashboard (Settings). To exercise any right, you can also email support@mcp-guard.ai from the address on your account; we may need to verify your identity and will reply within 30 days. For request content we process as a processor, we will pass your request to, or help, the customer responsible for it.

You may also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch); in the EU/EEA the authority of your place of residence or work; in the UK the Information Commissioner’s Office.

MCP Guard is a developer service not directed at children. You must be at least 16 years old (or the age of digital consent where you live, if higher) to create an account.

We will post changes here and update the date above; material changes are notified by email in advance.