Privacy Policy

When you create an MCPFeedback organization we collect your email address, name (if you provide one), authentication identifiers from your sign-in method (magic link, email and password, or Google OAuth), the organizations, projects, sites and apps you configure, team membership and roles, API key metadata (we store only a SHA-256 hash of the key itself, never the key), MCP client registrations and OAuth tokens, and your email notification preferences.

Billing data — company name, billing address, tax identifiers and card details — is collected and stored by Stripe. We never see or store full card numbers; we retain the Stripe customer and subscription identifiers, plan, quantity and invoice status needed to run your subscription.

We also record operational data about your use of the dashboard and API: request logs, error reports, rate-limit counters, webhook delivery attempts, and audit entries for sensitive actions such as role changes, API key creation and admin impersonation.

Our customers install the MCPFeedback widget on their websites and our iOS, Android and Flutter SDKs in their mobile apps. Depending on which features that customer enables, the following data about their end users is transmitted to and stored by MCPFeedback:

• Screenshots and annotations — a PNG or JPEG capture of the page or screen the end user was looking at, including anything visible on it, plus any drawings, highlights or text the end user adds. Up to 10 images per submission, 5MB each.
• Screen recordings — short recordings of the page or screen, captured on the end user’s device and attached to the submission (converted to an animated GIF for playback and for AI-agent consumption).
• Mobile session replays — for apps using our mobile SDKs, a short replay of the moments before a report: a sequence of frame screenshots with timestamps and screen names, interaction events (taps, scrolls, navigations, text-input events, including tap coordinates), and network event metadata (method, URL, status code, duration). Replays are captured with a privacy tier chosen by the app developer — mask-all, mask-sensitive or mask-none — which controls how much on-screen content is redacted before it leaves the device.
• Crash, ANR and hang reports — exception class and message, full stack traces, thread state dumps, app version, a crash fingerprint, and network logs from around the crash which may include request and response headers and truncated request and response bodies.
• Device and page metadata — page URL, referring URL, browser user agent, viewport and screen dimensions, platform, operating system and device model information, and app version.
• Captured JavaScript errors — console errors and unhandled exceptions recorded on the page before the feedback was submitted, including their messages and stack traces.
• Feedback content and contact details — the title, description and severity the end user writes, the email address they supply so the site owner can respond, and any subsequent messages exchanged through the support portal.

Screenshots, recordings, replay frames, crash traces and network logs can contain personal data that happened to be on screen or in flight — names, email addresses, message contents, account details. We do not inspect this content and we never use it to build profiles, train models, or for any purpose other than delivering the service to the customer who collected it.

The site or app owner is the controller of this data. They decide which capture features to switch on, what privacy tier and masking to apply, what notice and consent to present to their own users, and what the lawful basis for collection is. MCPFeedback processes it only to provide the service, only on their documented instructions, and deletes or returns it on their request. Our standard Data Processing Addendum sets these obligations out in full.

If you submitted feedback on someone else’s website or app and want to access or delete it, please contact that site or app owner first — they control the data. You may also write to us at support@mcpfeedback.com and we will route your request to them and assist as their processor.

We use account data to operate and secure the service, authenticate you, provide the dashboard and MCP server, run subscriptions and invoices through Stripe, send transactional email through Resend (verification, team invitations, trial and billing notices, feedback notifications and digests), respond to support requests, detect abuse and enforce rate limits, and comply with legal obligations.

We use end-user data solely to deliver it to the relevant customer: storing it, rendering it in their dashboard, forwarding it to destinations they configure (outbound webhooks, GitHub issues), and exposing it to the AI agents and MCP clients they have authorised.

We do not sell personal data, we do not share it with advertising networks, and we do not use customer or end-user content to train machine-learning models.

Strictly necessary cookies keep you signed in and protect the application; they cannot be switched off without breaking the service.

On our marketing site and dashboard we may run Google Analytics to understand usage. Analytics is optional and does not load until you accept it in the cookie banner; your choice is stored locally in your browser under the key mcpf-consent. Declining leaves the analytics tag unloaded entirely.

You can change your choice at any time: Cookie preferences clears the stored choice and reloads this page so the banner reappears. The same control is in the footer of our home page.

The MCPFeedback widget and SDKs do not set advertising cookies on our customers’ sites.

Data is stored in PostgreSQL databases and object storage operated by Supabase, and served by Vercel. It is encrypted in transit (TLS) and at rest, and isolated per organization by PostgreSQL row-level security policies.

We use a small, fixed set of subprocessors — Supabase, Vercel, Stripe, Resend and Google Analytics. Their purpose, processing location and privacy terms are listed on our subprocessors page, which we update before adding or replacing any of them.

Some of these providers process data in the United States. Where personal data of individuals in the EEA, UK or Switzerland is transferred outside those regions, the transfer is covered by the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), as incorporated into our Data Processing Addendum.

By default, feedback, screenshots, recordings, session replays and crash reports are retained for as long as the organization that collected them remains active, so that site owners keep their history.

Account owners can shorten that. Under Settings → General in the dashboard, an owner can set an automatic retention period of 90, 180 or 365 days (or keep the default, “keep forever”). Once a period is set, a daily job permanently deletes feedback, crash reports and session replays older than that window — the database rows and the associated files in object storage — with no further action needed. The setting applies to the whole organization and takes effect from the next daily run.

Customers can delete individual records at any time from the dashboard, and can delete an entire organization along with all of its projects, sites, feedback, attachments and stored files. Deleting a record removes the database row and the associated files in object storage.

When an organization is deleted, its records are purged from our production systems within 30 days. Encrypted backups roll off on their own schedule shortly afterwards. Invoices, tax records and other data we are legally required to keep are retained for the statutory period regardless of deletion.

If you need deletion sooner, or need written confirmation that deletion has occurred, email support@mcpfeedback.com.

Depending on where you live, you may have the right to access a copy of your personal data, correct inaccurate data, delete your data, receive it in a portable format, restrict or object to certain processing, withdraw consent you previously gave, and lodge a complaint with your local data protection authority.

If you are an MCPFeedback customer, you can exercise most of these directly in the dashboard (export your feedback, delete records, delete your organization) or by emailing support@mcpfeedback.com. We respond to rights requests within 30 days.

If you are an end user who submitted feedback on a customer’s site or app, direct your request to that site or app owner — they are the controller. We will assist them and will not act on their data without instruction, except where the law requires us to.

Multi-tenant isolation is enforced in the database with row-level security, API keys are stored only as SHA-256 hashes, outbound webhooks are HMAC-signed, MCP access uses OAuth 2.1 with PKCE, and the widget validates the requesting origin against the site’s registered domain. A fuller description is on our security page, including how to report a vulnerability.

MCPFeedback is a business tool and is not directed at children. You must be at least 18 to hold an MCPFeedback account. Customers who deploy the widget or SDKs in products used by children are responsible for the additional consents that requires.

We update this policy when our processing changes. Material changes are announced by email or dashboard notice before they take effect, and the “last updated” date above always reflects the current version.

Questions about this policy, a rights request, or a DPA signature request: support@mcpfeedback.com.