Privacy Policy

Visor logo

Privacy Policy

MCP Manager by Usercentrics www.mcpmanager.ai

Last update: October 15, 2026

Your privacy is important to us. This Privacy Policy covers what we collect and how we use, disclose, transfer, and store your information in connection with the MCP Manager service.

I. NAME OF THE PERSON RESPONSIBLE

The person responsible within the meaning of the GDPR and other applicable data protection laws is:

Usercentrics GmbH
Sendlinger Straße 7
80331 Munich
Germany

E-mail: datenschutz@usercentrics.com | Website: www.mcpmanager.ai

II. DATA PROTECTION OFFICER

1. Contact Details

You can contact our data protection officer at:

SECUWING GmbH & Co. KG
Maximilian Hartung
Frauentorstr. 9
86152 Augsburg
Germany

E-mail: epost@datenschutz-agentur.de | Phone: +49 821 90786450

2. United Kingdom GDPR Representative

Our UK GDPR Representative is:

Rickert Services Ltd UK
– Usercentrics –
PO Box 1487
Peterborough PE1 9XX
United Kingdom

art-27-rep-usercentrics@rickert-services.uk

III. GENERAL INFORMATION ABOUT THE COLLECTION AND PROCESSING OF YOUR DATA

1. Scope of processing

In principle, we process personal data only insofar as this is necessary to provide the MCP Manager service and its content and features. The processing of personal data of our users takes place regularly only with the consent of the user or on another lawful basis set out below. An exception applies to cases where prior consent cannot be obtained for factual reasons and processing is permitted by law.

Where we rely on consent as the legal basis for processing, that consent is collected and managed through the Usercentrics Consent Management Platform (CMP), which is implemented on MCP Manager. The CMP provides you with granular control over which categories of processing you permit, and records your preferences for audit purposes. You may review or update your consent preferences at any time via the privacy settings link in the application footer.

2. Legal basis

Depending on the processing activity, the legal basis is your consent (Art. 6(1)(a) GDPR), contract performance (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) GDPR), or our legitimate interests (Art. 6(1)(f) GDPR), as specified in each section below.

3. Storage and deletion of your data

We store personal data for as long as is necessary to fulfil the contractual or legal obligations for which we collected the data, and for as long as we have a legitimate interest in retaining it.

We do not currently operate automated data retention or deletion systems. Personal data — including data held in analytics logs — may be retained for extended periods until we implement defined retention processes. For evidentiary purposes, we must retain contractual data for six years from the end of the year in which the business relationship ends. Certain data must also be retained for accounting and tax purposes for periods of two to ten years as required by applicable law.

Account and data deletion requests: If you wish to request deletion of your personal data, please contact us at datenschutz@usercentrics.com. We will process your request manually and fulfil it as promptly as practicable. We are committed to honouring all valid deletion requests in accordance with our obligations under Art. 17 GDPR and applicable law, and we are working to implement a self-service deletion capability in the future.

IV. ACCOUNT REGISTRATION AND AUTHENTICATION

1. Description and scope of data processing

When you create an account, log in to MCP Manager, or register for an event such as a webinar, we collect the following data:

  • Email address
  • First name and last name
  • Job title
  • Organization name and team membership
  • Internal account identifiers (user GUID, account GUID, organization GUID, team GUID)
  • Registration source (e.g., direct signup, referral)
  • Date of registration and date of terms acceptance
  • Email verification status

On successful login, this data is stored in your browser session and passed to active service components to identify you across the application.

2. Legal basis for processing

The legal basis for processing is the performance of a contract, Art. 6 para. 1 s. 1 lit. b GDPR, as registration is necessary to provide you with access to the MCP Manager service.

3. Purpose of data processing

We collect this information to:

  • Establish your account, verify your email address, and facilitate event or webinar registration to help prevent spam, fraud, and abuse
  • Provide you with convenient and personalised access to your account and deliver and support our products
  • Enable other users to collaborate with you according to your preferences
  • Communicate with you about your use of our products, product announcements, and software updates
  • Respond to your requests for assistance, including account verification support
  • Enable you to manage your account and preferences
  • Send you direct marketing emails and special offers, where you have consented — you may opt out at any time via the unsubscribe link in any email or by contacting mcpm-support-alerts@usercentrics.com.

V. PROVISION OF THE SERVICE AND COLLECTION OF USAGE DATA

1. Scope of processing

Each time you access and interact with MCP Manager, our systems automatically collect data about your device, browser, and usage behavior. This includes:

  • Operating system type and version (e.g., Windows 11, macOS 14.2)
  • Browser type and version (e.g., Chrome 122, Safari 17.3)
  • Screen resolution and browser window dimensions
  • Application version and environment (development or production)
  • IP address (derived from your connection to our servers)
  • Pages visited and navigation paths (page URLs within the application)
  • Actions performed within the service, recorded as event categories and action types — not raw input content
  • Timestamps of all interactions
  • License tier and trial status associated with your account
  • Pseudonymous user identifiers attached to usage events

This data is stored in Google BigQuery.

2. Legal basis for processing

The legal basis for processing is our legitimate interest in operating, securing, and improving the service, Art. 6 para. 1 s. 1 lit. f GDPR.

3. Purpose of data processing

This data is used for product analytics, debugging, performance monitoring, security and abuse prevention, and improvement of the service.

4. Duration of storage

Usage event data is stored in Google BigQuery. No automated purge or time-to-live policy is currently applied; data is reviewed and deleted upon request.

VI. DEVICE IDENTIFIER

1. Scope of processing

On your first visit to MCP Manager, a unique device identifier is generated and stored in your browser’s local storage. This identifier is transmitted with every analytics batch.

2. Legal basis for processing

The legal basis is our legitimate interest in associating events from the same device across sessions for analytics and abuse prevention purposes, Art. 6 para. 1 s. 1 lit. f GDPR.

3. Purpose of data processing

The device identifier is used to associate usage events from the same device across sessions, calculate aggregate statistics on unique device counts, and detect and prevent misuse of the service.

VII. IP ADDRESS

1. Scope of processing

Your IP address is captured from your connection to our servers and stored alongside usage events in Google BigQuery, together with your account identifier and email address.

2. Legal basis for processing

The legal basis is our legitimate interest in maintaining the security and integrity of the service, Art. 6 para. 1 s. 1 lit. f GDPR.

3. Duration of storage

IP addresses are currently stored indefinitely alongside usage event records. We intend to implement a defined retention period in line with applicable data protection requirements.

VIII. SESSION RECORDINGS (FULLSTORY)

1. Description and scope of data processing

We use FullStory, a session replay service provided by FullStory, Inc., 1745 Peachtree St NE, Suite G, Atlanta, GA 30309, USA, to record and analyze user sessions within MCP Manager. On user identification, the following data is passed to FullStory:

  • Email address
  • Account identifier
  • Display name (first and last name)
  • Registration source

Session recordings may capture mouse movements, clicks, scrolling behavior, keyboard input, DOM content visible during your session, network requests, and navigation between pages. Session recordings are associated with your account identifier and email address. The analytics data may be used for product improvement, including the training and machine learning of MCP Manager and its underlying models.

Please note that FullStory’s session recording technology is capable of capturing DOM content including form field interactions. You should ensure that any sensitive data you enter into the service is treated accordingly.

2. Legal basis for processing

The legal basis is your consent, Art. 6 para. 1 s. 1 lit. a GDPR, collected and managed via the Usercentrics CMP.

3. Third-country transfer

FullStory is based in the United States. Transfers of personal data to FullStory are governed by Standard Contractual Clauses in accordance with Art. 46 GDPR. For more information, see FullStory’s privacy policy at www.fullstory.com/legal/privacy-policy.

IX. COOKIES AND LOCAL STORAGE

1. Use, legal basis and purpose

When you first access MCP Manager, you are presented with a consent banner powered by the Usercentrics Consent Management Platform (CMP). The CMP records your consent preferences and ensures that third-party analytics, marketing, and session recording technologies are only activated where you have given your consent, or where another lawful basis applies. You may update or withdraw your consent preferences at any time via the privacy settings link in the application footer.

Technically necessary cookies and local storage (session authentication, CSRF protection, device identifier) are processed on the basis of our legitimate interest in providing a functioning service, Art. 6 para. 1 s. 1 lit. f GDPR. These cannot be disabled without affecting core service functionality.

Analytics, marketing, and session recording technologies (HubSpot, Google Analytics, Heap, FullStory, LinkedIn Insight Tag) are only activated on the basis of your consent, Art. 6 para. 1 s. 1 lit. a GDPR, collected and managed via the Usercentrics CMP. You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

2. Cookies and storage used by MCP Manager

NameProviderPurposeTypeSecurity
Session cookieUsercentrics (rvstats)AuthenticationSessionSecure, HTTPS-only
CSRF cookieUsercentrics (rvstats)CSRF protectionSessionSecure, HTTPS-only, HttpOnly
hubspotutkHubSpotMarketing attributionPersistentSet by third-party script
Local storage (us.mcpm.app.*)UsercentricsEvent queue state, preferences, device identifierPersistentBrowser-local

X. THIRD-PARTY SERVICES — SUB-PROCESSORS

All third-party providers listed below are based in the United States. Where data is transferred outside the EU/EEA, Standard Contractual Clauses pursuant to Art. 46 GDPR are in place unless otherwise noted. Where the legal basis is consent, this is collected and managed via the Usercentrics CMP. Where you have concerns about international data transfers, you may contact us or our Data Protection Officer using the details in Section II above.

ProviderPurposeData SharedLegal BasisPrivacy Policy
HubSpotMarketing automation, CRM, live chatEmail, account identifier, HubSpot cookie, page navigation, form submissionsConsenthttps://legal.hubspot.com/privacy-policy
Google Analytics / Google AdsWeb analytics, advertising attributionPseudonymous account identifier, page navigation, conversion eventsConsenthttps://policies.google.com/privacy
FullStorySession replayEmail, account identifier, display name, registration source, session recordingsLegitimate Interesthttps://www.fullstory.com/legal/privacy-policy
LinkedInAdvertising, web analytics serviceDevice information, IP address, referrer URL, timestamp, browser information, hashed email addressesConsenthttps://www.linkedin.com/legal/privacy-policy
RedditAdvertising serviceIP address, user agent, referrer URL, advertising cookie information, standard event data, device information, browser information, OS version, screen width/height, hashed email addressesConsenthttps://www.reddit.com/policies/privacy-policy
SalesforceCRM, sales pipelineAccount identifier, event identifiers, conversion dataLegitimate interesthttps://www.salesforce.com/company/privacy
Slack (Slack Technologies, LLC, a Salesforce company)Workspace messaging and collaborationPseudonymous user labels, event categories and action types, pages visited within the application, and timestamps of signed-in usersLegitimate interesthttps://slack.com/trust/privacy/privacy-policy

Usercentrics does not sell or rent personally identifiable information. Data is shared with the sub-processors listed above solely to the extent necessary to operate, analyze, and improve the MCP Manager service. All sub-processors are contractually bound by data processing agreements and required to implement appropriate technical and organizational measures.

Disclosure may also take place in connection with official enquiries, court orders, and legal proceedings. When governments make a lawful demand for user data, Usercentrics will strive to limit the disclosure to what is strictly mandated and will, where legally permitted, notify affected users promptly.

XI. DIRECT MARKETING AND EMAIL COMMUNICATIONS

1. Newsletter and product communications

If you have registered for MCP Manager or subscribed to our newsletter, we may contact you with information about product announcements, software updates, and relevant offers. The legal basis is your consent, Art. 6 para. 1 s. 1 lit. a GDPR, or our legitimate interest in informing existing customers about related services, Art. 6 para. 1 s. 1 lit. f GDPR in conjunction with applicable national law.

You may withdraw your consent and opt out of marketing communications at any time by clicking the unsubscribe link in any email or by contacting us at mcpm-support-alerts@usercentrics.com. You will continue to receive essential account-related communications even after unsubscribing from marketing emails.

2. Webinars and events

We offer webinars and events from time to time, which you can sign up for via our website. Data entered in the sign-up form will be used for the purposes of the webinar or event and for communication regarding the webinar and other relevant topics. If a webinar or event is organised together with a partner, data may be shared with that partner. The legal basis is consent, Art. 6 para. 1 s. 1 lit. a GDPR. You have the right to withdraw your consent at any time by clicking the unsubscribe link in any email or contacting unsubscribe@usercentrics.com.

XII. ONLINE PRESENCE IN SOCIAL NETWORKS

We maintain online presences in social networks to communicate with customers and interested parties and to provide information about MCP Manager. Where we operate pages on social platforms, the platform provider may process your data for its own purposes, including market research and advertising. For details of that processing, please refer to the relevant platform’s privacy policy. Data protection requests are best directed to the platform provider directly, as only they have access to the data.

The legal basis for our own processing is Art. 6 para. 1 s. 1 lit. a and b GDPR.

We operate online presences on the following platforms:

XIII. U.S. STATE PRIVACY RIGHTS

In addition to the information provided above, this section applies to residents of U.S. states that have enacted comprehensive consumer privacy laws. These laws provide residents with certain rights regarding their personal information, subject to applicable limitations and exceptions.

For purposes of this section, “personal information” (or “personal data,” where applicable) has the meaning assigned under relevant state law.

1. Your Privacy Rights

Residents of certain U.S. states may have the following rights under applicable state privacy laws:

Right to Confirm and Access

You have the right to request the following information about the personal information we have collected about you:

  • The categories of personal information we have collected about you
  • The categories of sources from which we collected the personal information
  • The business or commercial purposes for which we collected or sold the personal information
  • The categories of third parties to whom we sold or shared the personal information, by category or categories of personal information for each category of third parties to whom the personal information was sold or shared
  • The categories of personal information about you that we disclosed for a business purpose, and the categories of persons to whom we disclosed that information for a business purpose
  • California residents may request the specific third parties to whom we have disclosed personal information

Right to Delete

You have the right to request deletion of personal information we have collected from or obtained about you, subject to certain legal exceptions (such as where retention is required to comply with legal obligations, exercise legal claims, detect security incidents, or fulfil contractual obligations).

Upon verification of your request, we will delete your personal information and direct our processors or service providers to do the same, unless an exception applies. Please note that we do not currently operate an automated deletion system; valid requests are processed manually and fulfilled as promptly as practicable.

Right to Correct

You have the right to request correction of inaccurate personal information that we maintain about you or to update the information we have on file.

Right to Data Portability

You have the right to obtain a copy of your personal information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another controller without hindrance.

Right to Opt Out

Depending on your state of residence, you may have the right to opt out of:

  • The sale of your personal information
  • The sharing of personal information for cross-context behavioral advertising
  • The processing of personal information for targeted advertising
  • Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you

Usercentrics does not sell personal information, including personal information of minors under the age of 16, for monetary compensation. However, we may share personal information with partners for purposes of cross-context advertising.

Where applicable, you may exercise your opt-out rights by updating your preferences via the Usercentrics CMP, accessible through the privacy settings link in the application footer, or by contacting us as described below.

Right to Non-Discrimination For The Exercise Of Your Privacy Rights

We will not discriminate or retaliate against you for exercising your privacy rights. This means we will not deny goods or services, charge different prices, provide a different level or quality of services, or otherwise penalise you because you exercised your rights.

Right to Limit the Use of Sensitive Personal Information

Certain states grant the right to limit the use or disclosure of sensitive personal information. Usercentrics does not process sensitive personal information as defined under U.S. state privacy laws for purposes that would require offering such a limitation right under applicable law.

Right to Appeal

If we decline to take action on your request to exercise a privacy right, we will notify you of our decision and the reasoning behind it within the applicable legal timeframe. Depending on your state of residence, you may have the right to appeal our decision. To initiate an appeal:

  • Submit your appeal: Contact us at privacy@usercentrics.com within 45 days of receiving our decision. Please use the subject line “Privacy Request Appeal” and include your original request ID or the email address associated with your original request.
  • Our response: Within 45 days of receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision.
  • Further action: If your appeal is denied, you may have the right to contact your state’s Attorney General to submit a complaint. We will provide such contact information in our response.

2. How to Submit a Request

You may submit your request by sending an email to privacy@usercentrics.com. We will verify your identity before processing your request. Authorised agents may submit requests on your behalf subject to identity verification requirements.

3. Response Timing and Format

We will respond to verifiable consumer requests within the timeframe required by applicable state law, generally within 45 days of receipt. If additional time is required (up to 90 days where permitted), we will notify you in writing and explain the reason for the extension.

Where required by law, responses will cover the 12-month period preceding receipt of the request unless a longer period is required. We will explain the reasons if we cannot comply with a request. Data portability responses will be provided in a readily usable format.

We do not charge a fee to process or respond to your request unless it is excessive, repetitive, or manifestly unfounded. If a fee is permitted and warranted, we will inform you of the reason and provide a cost estimate before completing your request.

4. Children Under the Age of 16

MCP Manager is not directed at children under the age of 16 and Usercentrics does not knowingly collect or disclose the personal information of children under the age of 16. Usercentrics does not sell or share personal information of children under the age of 16. If you are under 16, please do not use the service or submit any personal information. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at datenschutz@usercentrics.com.

5. Global Privacy Control

Some U.S. privacy laws require businesses to process Global Privacy Control (GPC) signals — referred to in some states as opt-out preference signals or universal opt-out mechanisms – which communicate an individual’s choice to opt out of the sale and/or sharing of personal data, or the processing of personal data for targeted advertising. We have configured the Usercentrics CMP to receive and process GPC signals on www.mcpmanager.ai. GPC signals are not currently processed within the MCP Manager application itself.

XIV. YOUR RIGHTS

Where we process your personal data, you have — following successful identification — the following rights:

  • Right to information (Art. 15 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to withdraw consent (Art. 7(3) GDPR)
  • Right to object to certain data processing activities (Art. 21 GDPR)

To exercise your rights, please submit your request to: privacy@usercentrics.com. We will respond within 30 days of receipt of a verifiable request. We reserve the right to charge a fee for requests that are clearly unfounded, repetitive, or excessive.

You also have the right to complain to the data protection supervisory authority responsible for us. You can contact the data protection authority in your place of residence, which will then forward your request to the competent authority.

XV. SECURITY AND INTEGRITY OF THE DATA

Protecting the information you give us is a priority. We take appropriate technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, alteration, disclosure, or destruction, including encryption of data in transit and appropriate access controls. We have established breach notification protocols to notify affected parties and the competent supervisory authority within 72 hours of becoming aware of a qualifying incident.

XVI. UPDATES TO THIS PRIVACY POLICY

We reserve the right to update this Privacy Policy from time to time to reflect changes in our products, business, and applicable law. In the event of material changes, we will publish a clear notice on this page and indicate the date of the last update at the top of this document. Where required by applicable law, we will seek your consent to such changes. Your continued use of MCP Manager following publication of an updated Policy constitutes acceptance of the revised terms.

XVII. CONTACT

If you have any questions, please contact us:

Usercentrics GmbH
Sendlinger Straße 7
80331 Munich
Germany

E-mail: datenschutz@usercentrics.com

© 2026 Usercentrics GmbH — All rights reserved.