Privacy Policy

1. Our Core Privacy Commitments: We Do Not Sell or Rent Your Data

2. Information We Collect

To provide multi-tenant remote MCP services and maintain account security, we collect the following categories of information:

• Account Credentials & Identity Data: When registering, we collect your verified email address, hashed passwords, and cryptographically generated API bearer tokens used for tool authentication.
• Customer Application Payloads & Stored Records: Depending on the MCP tools you invoke, our cloud microservices receive and store the content you provide. This includes:
  • Notes, markdown entries, and tags (Note tools).
  • Calendar entries, attendee metadata, and iCal schedules (Calendar tools).
  • Task summaries, descriptions, priority levels, and todo lists (Task tools).
  • Address book contacts, phone numbers, and vCard records (Contact tools).
  • Inbound and outbound email bodies, MIME headers, and attachments (Email tools).
  • Structured analytical datasets, table schemas, and queries (Data & BI tools).
  • Original URLs and custom aliases (ShortURL tools).
• Billing & Payment Data: Payment details (credit card tokens, billing address) are collected and processed directly by our payment processor, Stripe. We do not store raw credit card numbers on our servers.
• Operational Telemetry & Resource Usage: We collect system audit logs, compute execution runtime (CPU/memory minutes), storage volumes, IP addresses, browser user-agents, and timestamps to calculate metered billing fees and detect unauthorized attacks.

3. Absolute Prohibition on AI Model Training

We acknowledge the sensitive nature of LLM agent workflows and business data.

4. How We Use Your Information

We process information strictly for the following operational purposes:

• Service Delivery & Execution: Forwarding authenticated tool calls to remote workers, executing automated background workflows, and committing records to persistent cloud storage.
• Strict Multi-Tenant Isolation: Enforcing strict tenant isolation boundaries so that your records are accessible solely by your authenticated user identity.
• Usage Metering & Plan Enforcement: Tracking aggregate compute seconds, storage gigabytes, and transaction quotas according to your subscription tier.
• Infrastructure Protection & Security: Detecting rate-limit violations, brute-force attempts, unauthorized access, and malicious payloads.
• Customer Communications: Sending essential transactional notifications, password reset links, verification codes, and security bulletins.

5. Multi-Tenant Architecture & Data Sharing Controls

All persistent services (Notes, Calendar, Tasks, Contacts, Email, Data) are engineered with logical multi-tenant isolation. Your records are tagged with your unique user identity and are never viewable by other users or anonymous visitors unless you explicitly initiate an authorized sharing action.

When you grant sharing permissions on a dataset to another user, we enforce your specified column restrictions and row filters before serving the data to the designated recipient. You may revoke access at any time.

6. Third-Party Subprocessors & Service Providers

We rely on vetted infrastructure subprocessors to provide reliable, highly available cloud hosting:

• Cloud Infrastructure & Storage: Amazon Web Services (AWS) for secure object storage (S3), distributed queues, and compute infrastructure.
• Payment Processing: Stripe, Inc. for secure, PCI-compliant payment billing and subscription processing.
• Analytics: First-party or privacy-focused analytics (Google Analytics on production marketing pages) to evaluate visitor navigation. Analytics are not embedded in raw API tool calls or private database queries.

Subprocessors operate under strict confidentiality and data protection obligations consistent with this policy.

7. Security Safeguards & Inherent Internet Risks

We implement industry-standard administrative, physical, and technical controls to safeguard customer data, including modern encryption in transit, encrypted storage at rest, token-based authentication, and hashed credentials.

Notice Regarding Inherent Internet Risks: While we maintain rigorous defensive measures, no transmission over the Internet, wireless network, or electronic storage system is 100% impenetrable. Consequently, Got Simplified LLC cannot guarantee absolute security against sophisticated unauthorized breaches, third-party cyber attacks, or zero-day vulnerabilities. Please review our Terms of Service for liability limitations concerning data transmission and storage.

8. Data Retention, Portability & Deletion

• Active Accounts: We retain your stored application records and datasets for as long as your account remains active and in good standing.
• User Deletion: You may delete specific records (notes, tasks, calendar entries, tables) at any time using the respective MCP management tools.
• Account Closure: Upon terminating your account or requesting deletion, your stored data is purged from our primary production databases in accordance with our system decommission schedules, except where retention is legally mandated.

9. Children's Privacy

Our services are designed exclusively for business professionals, software developers, and individuals aged 18 and older. We do not knowingly solicit or collect personal information from children under the age of 16. If we become aware that a minor has created an account, we will promptly delete their information.

10. Updates to This Policy

We may revise this Privacy Policy periodically to reflect enhancements to our MCP microservices, legal requirements, or infrastructure updates. When modifications occur, we will update the "Effective & Last Updated" date at the top of this document. Continued use of the platform after updates constitutes acceptance of the amended terms.