Privacy Policy — Crisol MCP
1. Data Controller
- Owner: Sara Fernández Velasco
- NIF: 47528322H
- Address: Calle Carmen Burgos, n.º 96, 18100 Armilla, Granada
- Contact for privacy matters: privacidad@crisolmcp.com
2. What data do we process and where does it come from?
Crisol MCP is a subscription platform accessed by registering with your email address. Below we detail what data we process, organized by source:
2.1 Identity data (when you register and sign in)
Access is authenticated via a magic link sent to your email or, if you prefer, with your email and a password of your choosing; we do not use third-party sign-in. We store:
| Data | Description |
|---|---|
| Identifies your account and is the address to which the access link is sent | |
| Password (optional) | Only if you decide to set one. We do not store the password itself, but its cryptographic derivation via scrypt, which is not reversible: we cannot read, recover or display it. It is used solely to verify your access, and you can remove it whenever you want from your panel, at which point it is deleted |
| Name | Your name, recorded when you sign up |
| Internal account identifier | An identifier specific to Crisol MCP, not linked to any external provider |
| Registration date | When you signed up for Crisol MCP |
| Last sign-in | Date of your most recent access |
| Role | Whether your account is administrator, client or guest |
2.1.bis Subscription data
If you contract a paid plan, we store the minimum data necessary to manage your subscription; and, whether you contract one or not, the record of your acceptance of the legal documents:
| Data | Description |
|---|---|
Stripe customer identifier (stripe_customer_id) |
A reference that lets us associate your account with your subscription in Stripe |
| Subscription status and plan | Whether your subscription is active, paused or canceled, and which plan it corresponds to |
| Your subscription data in Stripe | What Stripe tells us about your subscription and its invoices: the identifiers of the subscription and of each invoice, the status, the start and end dates of each period and, where applicable, of the trial, whether you have scheduled the cancellation and for when, whether you contracted with or without a trial period, the expected amount of the first charge after the trial and, for each invoice, its amount, currency, status and payment date |
| Use of the Service to measure whether it delivers | When you connected your first source and when you made your first query (only those two dates, written once) and, during a trial, how many queries you made. Never what you queried |
| Data noted by the administrator | Whether your account counts as a market customer or is excluded (for example, for being an acquaintance or for having received a refund) and how you found us |
| Record of your acceptance | One record for each acceptance of the Terms, the Privacy Policy and the Data Processing Agreement, at purchase or in the panel: the record identifier, your account, where you accepted (purchase or panel), the date, the version of each document, the language in which you read them and, for a purchase, whether you asked for the Service to start immediately, whether you accepted the payment terms shown by Stripe and whether you are buying as a consumer or as a business; and, if you contracted with a trial period, that you did so and the date the trial ends |
We do not store your card data or your complete tax details (NIF/CIF, billing address): that data is collected and held by Stripe during the payment process (see Section 4). If you enter a business tax identification on the checkout page, we read it at that moment only to know whether you are buying as a consumer or as a business, and we store only that result, never the number.
Email address on the contracting page. When contracting offers a trial period, we ask for your email address on our contracting page, before moving on to Stripe, to check that you have not already had a trial and that you do not already have a subscription in progress. If you do not complete the contract, it is not added to our account database. When you continue, we pass it to Stripe, which shows it fixed on its checkout page and may keep it under its own policy (Section 4).
2.2 Credentials for marketing tools you voluntarily connect
If you decide to connect your own accounts of Google Search Console, Google Analytics 4, Google Ads, Google Merchant Center, Meta Ads, Bing Webmaster Tools, IndexNow or PageSpeed Insights (depending on the integrations available at any given time) or your online store (WooCommerce, PrestaShop), we store the necessary credentials (OAuth tokens, API keys) and the connection data that goes with them (for example, the ID of your Google Ads manager account or your store's address) always encrypted at rest:
- Encrypted using a Fernet token (AES-128 in CBC mode + HMAC-SHA256 authentication).
- The master encryption key is stored in the server environment, outside the database, never alongside the data it encrypts.
- None of these credentials is accessible in plaintext outside the server itself, not even by the artificial intelligence assistant integrated into the panel.
2.2.bis Your store's order and catalog data (if you connect an online store)
If you connect your online store (WooCommerce or PrestaShop), Crisol MCP reads, in read-only mode, your catalog data and your order ledger, so that you can analyze your real sales by cross-referencing them with your SEO and advertising data. Specifically:
| Category | What it includes |
|---|---|
| Product catalog | Product identifier and name, SKU, URL, status, type, prices, units sold, stock status, categories and SEO metadata |
| Orders | Order and line identifier, order number and date, status, currency, product identifier, quantities, and amounts (gross, refunded and net of taxes) |
| Buyer identifier | A pseudonymous identifier (an internal number assigned by your own store), which makes it possible to know that two orders belong to the same buyer without identifying who they are |
What we do NOT process. Crisol MCP extracts only a closed, predefined set of fields, and discards the rest of the order at the moment of reading, before any storage. We do not copy, transmit or store any identifying data of the buyer: neither their name, nor their email, nor their phone number, nor their address, nor their NIF, nor their IP address, nor advertising tracking identifiers (such as those that some store plugins might add).
About the pseudonymous buyer identifier. Although Crisol MCP cannot know who the person behind that identifier is, under the GDPR such an identifier is considered pseudonymized personal data (not anonymous), since you, as the store owner and with your own database, could re-identify it. That is why we treat it with the same security and isolation guarantees as the rest of the data, and its processing is further governed by the Data Processing Agreement (Annex I to the Terms), in which you act as controller and Crisol MCP as processor.
Retention periods for this data. The catalog is stored as a snapshot that is replaced on each synchronization (with no time-based expiration: whatever is no longer in your store is deleted). Orders are retained for 180 days and aggregated sales by product and day for 480 days, counted from the date of the order itself (not from the date on which they are copied); after that period, they are automatically deleted. This data is stored isolated per client, in accordance with Section 8.
2.2.ter Your account status
Besides credentials, we keep a few items about the status of your account that are not credentials: they let the panel show you what you have done and what is left, and let us apply the decisions that you or we have made about your access. They are stored encrypted alongside your credentials, with the same treatment described in Section 2.2, and are deleted with your account (Section 6).
| Data | Description |
|---|---|
| Connector authorisation | That an application — usually your AI assistant — completed the connector authorisation for your account at least once, and when it first did so. It is used to mark that step as done on your Home screen; it does not mean it is still connected, nor which application it was, nor anything you have queried |
| Google Ads access request | That you have requested access to Google Ads through Crisol MCP, and when, so that we can handle your request |
| Google Ads access | Whether we have granted you that access or revoked it |
| Opt-out from Google Ads access | Whether you have opted out of that access from your panel |
| Merchant Center registration | The IDs of the Merchant Center accounts in which you have registered our developer project (Section 2 bis), so that we can show you it is already done without asking Google. It is removed when you unregister it |
| Write operations | Whether you have enabled each of the write operations the Service offers (currently, submissions to IndexNow), which are disabled by default |
| Expiry of your Meta connection | The type of access Meta issued when you connected and its issue and expiry dates, to show you how long it is valid and to warn you before it expires (Section 2 quater). Unlike the rest, it is also deleted when you disconnect Meta |
2.3 Panel AI assistant history
The conversational AI assistant integrated into the panel, which helps you set up your connections and resolve questions about the product (what Crisol MCP does, the plans, the frequently asked questions or the glossary), does not store the content of the conversation on our servers. The history lives exclusively in the browser (local storage), with automatic deletion every 24 hours. The only thing we record in our audit log is technical metadata (date, user and number of tokens consumed), never the content of the messages.
2.4 Activity log (audit log)
For security and traceability reasons, we log certain relevant actions within your account: connecting or disconnecting tools, saving or deleting API keys, enabling or disabling features, submissions to IndexNow, use of the AI assistant (only the token count), and the number of daily requests that your account makes against the Google Ads API. This log never contains the value of any credential, only the type of action performed (for example, "Bing key updated").
2.5 Public contact form
If you fill out the Site's contact form before having an account, we store the name, email and message you provide, so that we can reply to you.
2.6 Waiting list
If access to the Service is not open at the time and you decide to join the waiting list so that we can notify you when a spot becomes available, we process the following data:
| Data | Description |
|---|---|
| Email address | The address to which we will send the notice that a spot is available. It is the only data we ask you for |
| Sign-up date | When you signed up. It also serves as a record of your consent |
| Notice date | When we sent you the notice that a spot was available, if we have already sent it |
What we use it for and on what legal basis. We use it for the sole purpose of notifying you when a spot becomes available. The legal basis is your consent (Article 6(1)(a) GDPR), which you give by checking the box on the sign-up form. We do not use your email to send you commercial communications, newsletters or any communication other than that notice, unless you expressly authorize us to do so separately.
We do not cross-reference it with anything. The waiting list email is stored independently and is not associated with any user account, or with browsing data, or with any other information.
How long we keep it. We keep your email until the first of the following occurs: that you sign up for the Service, that you ask us to remove you from the list, or that 12 months elapse from your sign-up without our having been able to offer you a spot. In any of those cases, your email is deleted.
How to leave the list. You can ask us to delete your email at any time, without giving reasons, by writing to privacidad@crisolmcp.com. We will do so without delay. Withdrawing your consent does not affect the lawfulness of the processing carried out before its withdrawal. You are also entitled to the other rights described in Section 7.
2.7 Website usage analytics (only if you accept it)
If you accept the analytics cookies, we use Google Analytics 4 to understand how our website is used and to improve it.
| Data | Origin |
|---|---|
| Pseudonymous browser identifier | _ga and _ga_<our measurement property identifier> cookies, installed by Google only if you give your consent |
| Pages visited, browsing order and origin of the visit | Collected by Google Analytics during your browsing |
| Approximate location (country, region and city) derived from your IP address, and characteristics of your device and browser | Derived by Google Analytics during your browsing. Google does not provide us with your full IP address, and under no circumstances do we obtain your exact location |
Nothing is installed before you accept. If you do not consent, the page we serve you does not contain any Google tag: no analytics cookie is installed and no data is sent, not even anonymously.
Measurement of our advertising. If you additionally accept the advertising measurement category, that same measurement allows us to know whether you arrived at the Site from one of our Google Ads advertisements and whether that visit ended in a subscription sign-up. The purpose is to count which advertisements work; the legal basis is your consent (Art. 6(1)(a) GDPR), independent of the one you give for analytics, and the recipient is the same, Google Ireland Limited, on the terms of Section 5. Today this category does not install any additional cookie: the signal travels within the analytics measurement.
What we do not do, whatever you accept. We do not use Google Analytics advertising features, or Google Signals, or remarketing, or ad personalization, and we do not send Google any data of yours to match you with other accounts. We do not send Google any identifier linking you to your customer account, so that this data is never cross-referenced with your identity in Crisol MCP. Measuring how many sign-ups an advertisement brought and profiling whoever saw it are different things: we do the former if you give us permission, and we do not do the latter.
Do not confuse this with access to your Google Ads account. What is described here is the measurement of our own website, in order to know which of our advertisements work. It is completely independent of the read-only access to your Google Ads account, which is a data source of the Service, which you connect and control, and whose data we never use for our own marketing.
You can withdraw your consent whenever you want, from the "Cookie preferences" link in the footer of any page. Withdrawal does not affect the lawfulness of the processing carried out before withdrawing it. The full details are in our Cookie Policy.
2.8 Notices about the Service
When there is something you need to know about the Service (an incident, scheduled maintenance, a change that affects you), we can get it to you through three channels: an email to your account address, a notice in the panel, and a notice attached to the response that the tools return to your artificial intelligence assistant.
Regarding that third channel, which is less common and worth explaining:
- The text is written by us and contains no personal data of yours.
- It does not modify the tool's result: it travels attached, and the response you requested arrives intact. If the notice were to fail, you would still receive your response, without it.
- It has a limit: at most three notices, with a maximum of 120 characters of title and 600 of body each. We try not to repeat the same notice more than once a day, although we cannot guarantee this in every case.
- It is used to notify you of incidents, maintenance and changes affecting the Service, never for promotions or commercial news.
Bear in mind that this text reaches your artificial intelligence assistant and therefore consumes a minimal part of the token budget you have with whichever provider you use. That is why we keep it short and limited to what you really need to know.
2.9 Your IP address when you visit the Site or the panel
When you visit the Site or the panel, your browser sends us your IP address, as it does with any website. We use it only for the following:
- Limiting attempts. To curb abuse, we count, in the server's memory, the attempts that arrive from the same IP address when you sign in with a password, request the magic link, and submit the contact, waiting list and contracting forms. Each counter only takes into account the attempts of the last hour. The address is not written to any database or to our application's logs, and it disappears from memory when the server discards expired counters or restarts. Our edge server (the one that receives connections before the application) also applies its own per-minute request limit on some routes, likewise in memory.
- Diagnosing errors. If a request fails on our edge server, its error log may include your IP address. That log takes up at most 30 MB on each of our two edge servers: when it fills up, the oldest entries are overwritten.
The Site and the panel (crisolmcp.com), including the connection of your accounts, go through Cloudflare's network, which receives each request, with your IP address, in order to deliver it to our server and protect it from malicious traffic (see Section 4). The queries your AI assistant makes to your sources through the MCP connector (mcp.crisolmcp.com) do not go through Cloudflare.
2 bis. Use of Google API data (Limited Use)
Crisol MCP's use and transfer to any other application of information received from Google APIs adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Crisol MCP uses the information obtained from Google APIs solely to make it available to the artificial intelligence assistant that you connect and control. Two of the four permissions (Search Console and Analytics 4) are read-only. The other two (Google Ads and Merchant Center) are requested in their only available form, since Google does not publish a read-only variant, and Crisol MCP uses them solely to read, without creating, modifying or deleting campaigns, properties, products or configurations. The only write operation that Crisol MCP performs against Google's data APIs is the registration and deregistration of our developer project in Merchant Center (registerGcp / unregisterGcp), a step that Google requires in order to read performance data; it is executed by the user themselves from the panel and does not alter product listings, prices or commercial configuration.
Consistent with the Limited Use requirements, Crisol MCP affirms that the information received from Google APIs:
- Is not used or transferred to display advertising, including personalized, targeted or retargeting advertising.
- Is not sold or transferred to data brokers, information resellers or third parties for commercial purposes unrelated to the provision of the Service.
- Is not used to train, fine-tune or improve artificial intelligence or machine learning models, whether our own or third-party.
- Is not read by humans, except: (a) with your explicit consent for support purposes; (b) for security reasons (for example, investigating abuse); or (c) where required by law.
2 ter. Transfer to your artificial intelligence assistant (MCP connector)
The main purpose of Crisol MCP is to act as an MCP server (Model Context Protocol) that connects your data sources with the artificial intelligence assistant that you choose and control (for example, Claude or ChatGPT).
When your AI assistant requests a query, Crisol MCP performs the read in read-only mode against the corresponding platform (Google, Meta, Bing) and returns the result directly to your AI assistant, which runs outside Crisol MCP and under your control. This transfer of data to your AI assistant is initiated and controlled by you: it is you who decides which assistant to connect and which queries to run.
Under no circumstances does Crisol MCP use your Google data to train, fine-tune or improve artificial intelligence models, whether our own or third-party. When your AI assistant processes the data, it does so under your control and in accordance with its provider's policy; Crisol MCP never sends it for training purposes.
It is important that you understand this architecture:
- Crisol MCP does not process your Google data with any of its own artificial intelligence models. It acts as a channel: it performs the read and delivers the result to your assistant. The analysis is carried out by the model you have connected, over which Crisol MCP has no control and whose data processing is governed by the privacy policy of that assistant's provider (Anthropic, OpenAI, etc.).
- Most queries are performed live, without intermediate storage: the data goes from the source platform to Crisol MCP and from there to your assistant, without passing through any cache.
- There is an optional local cache layer that is only used if you deliberately activate it (via the synchronization tools). In that case, the data is temporarily stored in a local database (SQLite) on our own server, to enable faster recurring analyses. If you never activate this synchronization, no data from your sources passes through that cache. In the case of marketing metrics (for example, clicks, impressions, positions), the cache contains no credentials or personal data. In the case of store data, the cache may contain the pseudonymous buyer identifier described in Section 2.2.bis, but never identifying data or credentials. Unlike credentials, which are always stored encrypted, this cache is not encrypted.
This cache is purged automatically by two mechanisms:
- By expiration (TTL): the data is deleted once it exceeds its retention period (for example, those described in Section 2.2.bis for store data).
-
By your plan's disk quota: if the volume of data you have cached exceeds the size included in your plan, the oldest history is automatically deleted until it fits again. This mechanism affects only search engine performance data (Search Console): it does not touch your store data, or your Analytics, Google Ads or Merchant Center data. It also never retains less than 365 days (one year) of history no matter what, and does not happen silently: you are notified in the response of the synchronization that triggers it.
-
Set-aside files due to a technical incident. Exceptionally, if the local database of your cache were to become corrupted, the system does not delete it: it sets it aside (renames it) and creates a clean database for you on your next access, so as not to destroy data due to a false positive. In that clean database, the retention periods apply again completely normally. The set-aside file is a static copy that is no longer processed; it contains data from your account and is retained until an administrator reviews and deletes it as part of an operational routine (it does not expire on its own). If you cancel your account, that file is deleted along with the rest of your data, within the period committed to in Section 6.
- The only internal AI model in Crisol MCP is the panel assistant described in Section 2.3 (which helps you set up your connections and resolve questions about the product), which only receives metadata about your account: which sources you have connected, your contracted plan and the panel screen you are on. It never receives the data from your sources or your credentials.
2 quater. Meta (Facebook) data and how to delete it
If you connect your Meta (Facebook/Instagram) account to Crisol MCP, we only store the access token Meta issues when you connect and, alongside it, its type and its issue and expiry dates, so that we can warn you before it expires. Both are always stored encrypted at rest with the same treatment described in Section 2.2 (Fernet / AES-128-CBC + HMAC-SHA256 encryption, with the master key outside the database).
We do not store any data from your Facebook or Instagram profile: neither your name, nor your photo, nor your Facebook user identifier, nor your friends list, nor any other personal data from the social network. By connecting, you authorise Crisol MCP to read, in read-only mode, the ad accounts your Meta user has access to. Meta acts solely as the source platform for the performance metrics of your ads, which Crisol MCP reads in read-only mode and returns to the artificial intelligence assistant that you control, in accordance with Sections 2 ter and 4 of this policy.
Because Meta asks you to reconnect periodically, we email you before your access expires, so that you can renew it without losing the connection.
You can delete the Meta data we store (your access token and its dates) through any of these three routes:
- Immediate disconnection from the panel. On the Meta Ads screen of the Crisol MCP panel you will find a "Disconnect from Crisol" button. When you press it, we immediately delete your encrypted token and its dates, and stop reading any Meta data. The record of which expiry notices we have sent you, which contains neither the token nor its dates, is deleted with your account. This action does not modify or delete your Meta account; it only cuts off Crisol MCP's access.
- Cancellation of your Crisol MCP account. If you close your account, all your data (including the Meta token) is deleted in accordance with the periods described in Section 6 of this policy.
- Request by email. You can request deletion by writing to privacidad@crisolmcp.com, as described in Section 7 ("Your rights").
3. Why do we process your data? (purposes and legal basis)
| Purpose | Legal basis (GDPR) |
|---|---|
| Manage your account and authenticate you, via a magic link to your email or via a password if you have activated it | Performance of a contract/service relationship (Art. 6(1)(b)) |
| Manage your paid subscription (status, plan and customer reference in Stripe) | Performance of a contract/service relationship (Art. 6(1)(b)) |
| Keep the record of your acceptance of the legal documents (Section 2.1.bis), so that we can demonstrate what you accepted and when, and apply the protection the law gives consumers | Compliance with a legal obligation (Art. 6(1)(c)) |
| Provide the Service: allow you to connect your tools and have them queried through AI | Performance of a contract/service relationship (Art. 6(1)(b)) |
| Store in encrypted form the credentials you connect | Performance of a contract/service relationship (Art. 6(1)(b)) |
| Record the status of your account (Section 2.2.ter) to show it to you in the panel and apply the decisions about your access | Performance of a contract/service relationship (Art. 6(1)(b)) |
| Maintain the security audit log | Legitimate interest in ensuring the security of the Service and detecting misuse (Art. 6(1)(f)) |
| Limiting the attempts that arrive from the same IP address and keeping the edge server's error log (Section 2.9) | Legitimate interest in ensuring the security of the Service and detecting misuse (Art. 6(1)(f)) |
| Respond to messages from the contact form | Data subject's consent when submitting the form (Art. 6(1)(a)) |
| Notify you when a spot becomes available, if you join the waiting list | Data subject's consent when checking the box on the form (Art. 6(1)(a)) |
| Measure website usage through Google Analytics 4 in order to improve it | Data subject's consent when accepting the analytics cookies (Art. 6(1)(a)) |
| Retain the record of your decision about cookies, in order to be able to demonstrate it | Compliance with a legal obligation (Arts. 6(1)(c) and 7(1)) |
| Notify you of incidents, maintenance and changes affecting the Service, including the notice that your Meta access is about to expire | Performance of the contract (Art. 6(1)(b)) |
| Check, before moving on to payment, that the email address you contract with has not already had a trial and has no subscription in progress, and pass it to Stripe for the payment | Taking steps at your request prior to entering into a contract (Art. 6(1)(b)) |
| Offer the trial period only once per person, keeping a pseudonymised mark of your email address (Section 6) | Legitimate interest in preventing abuse of the offer (Art. 6(1)(f) and Recital 47) |
| Measure whether the Service delivers: when you connected your first source and when you made your first query, and how many queries you make during a trial | Legitimate interest in knowing whether the Service provides value to those who contract it (Art. 6(1)(f)) |
| Produce monthly statistics on trials and customers (how many start, cancel, pay and become active) | Legitimate interest in measuring the results of our offer (Art. 6(1)(f)) |
| Manage a subscription that is never linked to any account (for example, a second purchase with the same email address) while it is in progress: recognise it, cancel it or refund it | Performance of a contract and taking steps at your request prior to entering into a contract (Art. 6(1)(b)) |
| Keep the records of that subscription until 14 days after it ends, so as not to treat an already settled purchase as a new one if Stripe repeats a notice (Section 6) | Legitimate interest in processing payments correctly and avoiding undue charges or sign-ups (Art. 6(1)(f)) |
| Keep a technical record of each notice Stripe sends us, so as not to process the same notice twice and to count how many payments are started without being completed (Section 6) | Legitimate interest in processing payments correctly and in measuring the results of our offer (Art. 6(1)(f)) |
3.1 Automated decisions
We do not carry out automated decisions, including profiling, that produce legal effects on you or similarly significantly affect you. The artificial intelligence assistant integrated into the Service generates analyses and guidance-only recommendations directed at the user who uses it, but it does not make automated decisions about natural persons.
4. Who do we share your data with?
We do not sell or transfer your data to third parties for commercial purposes. We work with the providers listed below. Those that process personal data on behalf of Crisol MCP (OVH, Cloudflare, Resend, OpenRouter and, if you accept the analytics cookies, Google Ireland Limited) do so as data processors, under contract and in accordance with our instructions. Google, Meta and Microsoft are not processors of Crisol MCP: they are the source platforms of your own data, which you connect and control, and each one processes the information in accordance with its own privacy policy.
| Provider | Function | Location |
|---|---|---|
| OVH | Server hosting (dedicated server) and its encrypted backups | Gravelines (server) and Roubaix (backups), France (EU) |
| Cloudflare, Inc. | Delivery and protection network for the Site and the panel (crisolmcp.com), including the connection of your accounts: it receives each request, with your IP address and what you send in it, in order to deliver it to our server and filter malicious traffic. It plays no part in your AI assistant's queries to your sources (mcp.crisolmcp.com). It acts as data processor under its Data Processing Addendum | United States (see Section 5) |
| Resend | Delivery of the transactional emails generated by the Service (for example, the magic access link or the contracting confirmation). It processes your email solely to deliver them, and for no other purpose | United States, subject to verification of the international transfer mechanism (see Section 5) |
| OpenRouter and the AI model provider to which each query is routed | Inference of the panel's AI assistant. It only receives metadata about your account: which sources you have connected, your contracted plan and the screen you are on, never credentials or your marketing data | Typically United States, subject to verification of the international transfer mechanism (see Section 5) |
| Google Ireland Limited | Website analytics (Google Analytics 4), only if you accept the analytics cookies. It acts as data processor under Google's Data Processing Terms | Dublin, Ireland (EU) |
| If you connect your accounts, the source of the Search Console, Analytics 4, Ads and Merchant Center data that we query on your behalf in read-only mode | United States / EU depending on the service | |
| Meta, Microsoft (Bing) | Source of the data we query on your behalf, if you connect those tools | United States |
Payment and billing data — independent controller
When you contract a paid plan, Crisol MCP does not receive, store or process any data from your card or your payment method. Payment takes place through Stripe Managed Payments, in which Sold through Link, LLC ("Link"), a Stripe group company, acts as Merchant of Record for the payment transaction: it handles the charge, the taxes and the receipts (Clause 8 of the Terms). The Service is provided to you by Crisol MCP.
For payment and billing data (name, billing email, payment method, tax address), the Stripe group entities act as data controllers independently of Crisol MCP. For people located in the European Economic Area, Stripe's Privacy Policy states that these may be Stripe Technology Company, Limited, Stripe Payments Europe, Limited (SPEL) and the relevant Stripe regulated entity, individually or jointly depending on the service; that policy, available at stripe.com/privacy, governs their processing, and we recommend that you review it before completing a subscription. Of that data, Crisol MCP only keeps your email and, if you enter a business tax identification, that fact, for the purposes described in Section 2.1.bis; the notice Stripe sends us when the payment completes may include other billing details, which we do not keep. We never receive your card or payment method details.
5. International transfers
Some of the above providers (in particular, the transactional email delivery provider Resend, and the AI inference provider of the panel's assistant) may be based in the United States. When this occurs, the transfer relies on the EU-US Data Privacy Framework (if the specific provider is certified) or, failing that, on Standard Contractual Clauses approved by the European Commission. You can ask us for information about the safeguards applied in each case by writing to privacidad@crisolmcp.com.
Delivery network (Cloudflare). Our counterparty is Cloudflare, Inc., headquartered in the United States. The transfer relies on the Standard Contractual Clauses of the European Commission, incorporated into its Data Processing Addendum, and on its certification under the EU-US Data Privacy Framework.
Website analytics. Our counterparty for Google Analytics 4 is Google Ireland Limited, domiciled in Ireland, so that the analytics data is communicated to a recipient located within the European Union and that communication does not constitute an international transfer. Google Ireland Limited may in turn process that data in the United States through Google LLC as its sub-processor; in that case it is Google that carries out the transfer and is answerable for it, relying on the EU-US Data Privacy Framework (Google LLC is certified) and, where applicable, on the Standard Contractual Clauses provided for in its own Data Processing Terms.
6. Retention period
We retain your data for as long as your account remains active and it is necessary to provide you with the Service.
Account closure or cancellation. When you cancel your subscription or request closure, your account and its data are deleted from our system within a maximum of 14 days from the end of your access, except for the data detailed below, with its period. Within that process, the purge of the encrypted backups is completed within a maximum of 7 days: we make a daily copy of the database, encrypt it before it leaves the server, store it in OVH's backup storage in Roubaix (France) and delete each copy before it is 7 days old. This includes your identity (email, name, internal account identifier), your subscription management data, the record of your acceptance of the legal documents, the encrypted credentials of the tools you may have connected, the status of your account (Section 2.2.ter), the data from your store that we may have cached (catalog, orders and aggregated sales), and the audit log entries associated with your account.
What we keep after your account is closed, and for how long. In addition to the record of your decision about cookies (below), we keep:
- The trial mark. If you contracted with a trial period, we do not keep your email address in clear, but a code calculated from it with a secret key, which lets us check whether an email address matches that of a previous trial, together with the reference of that subscription and the date we recorded it. It is pseudonymised data, not anonymous. We keep it for 730 days from the date we recorded it, and it is then deleted automatically.
- Monthly statistics. Before deleting your account, we add its outcome to monthly statistics without your email address, your name or any identifier: for a trial, the month it started, whether it was cancelled, charged or activated, and how many queries it had; if you ever paid, the month of the first charge, whether you count as a market customer and how you found us. With so few cases per month, someone who knows it was you could recognise you, so we treat them as pseudonymised data. They are deleted automatically once the month they refer to is more than 730 days in the past; if we do not know that month, once 730 days have passed since the month we added it.
- Payment records without an account. If a subscription is never linked to any account (for example, a second purchase with the same email address that is cancelled), we keep what Stripe told us about it —customer, subscription and invoice references, statuses, dates and amounts— until 14 days after it ends. And we keep a technical record of each notice Stripe sends us (its identifier, its type, the date, whether it was a trial and the environment), without your email address or your account, so as not to process the same notice twice and to count how many payments are started without being completed, for 730 days.
The access links we send you by email (your email address and a fingerprint of the link) are deleted when they are used or expire, and in any event together with your account.
Your right to object. You may object to the processing operations based on our legitimate interest (Section 3) by writing to privacidad@crisolmcp.com (Section 7). For three of them the effect is direct: if you object, we stop measuring your activation (your first source, your first query and the queries of your trial) and delete what has already been measured, we do not add your account to the monthly statistics, and we delete the trial mark of your email address and do not store it again. Once added, the statistics no longer show which part is yours: if you object before your account is closed, we do not add yours. For the other processing operations based on legitimate interest —the security audit log, the limit on attempts per IP address, the counter of requests to Google Ads, the retention of payment records without an account after the subscription ends and the technical record of Stripe notices— we will consider your objection and give you a reasoned reply: we will stop processing your data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need it for the establishment, exercise or defence of legal claims.
We do not keep any backup copy of your store cache. The data we cache from your store (catalog, orders and aggregated sales) does not live in the backed-up database, but on a separate disk that is not copied. The 7-day period in the previous paragraph does not affect it: when it is deleted, it is deleted definitively and no copy remains anywhere. This means fewer copies of your data, not an oversight: that cache can be rebuilt at any time by reading your store again, so it does not need a backup.
Record of your decision about cookies. The consent record is retained for 36 months from the decision and is then automatically deleted. That period covers the 24 months of validity of the consent plus the time during which we may still be required to demonstrate that we obtained it correctly. If you withdraw your consent, the record is not deleted at that moment: the withdrawal date is noted and it is retained for the same period, because we need to be able to prove both that you consented and that we acted on your withdrawal. This record does not contain your IP address or any data that would make it possible to identify you, and it is independent of the life of your account: it is retained even if you are not a customer, and also after you close your account. The details are in the Cookie Policy.
Measurement data for our advertising. The conversion data associated with our own Google Ads campaigns (not yours) is retained in accordance with Google's retention policies for its advertising platform, which we do not set; you can consult them in Google's privacy policy. The record we do control is the Google Analytics one, with the period indicated below.
Analytics data in Google Analytics. The user and event data collected by Google Analytics 4 is retained for 14 months, a period that allows us to compare the evolution of the site over a full annual cycle. Once that period has elapsed, Google deletes it automatically. The standard aggregated reports, which do not make it possible to identify any specific user, are not subject to that period.
Counter of requests to your Google Ads account. The daily request count described in Section 2 is retained for 90 days from the day to which it refers, and is then automatically deleted. It contains only your account identifier, the date and the number of requests: never the content of the queries or any data from your campaigns. We process it in order to measure consumption of the shared Google Ads quota per account, handle your queries about it, and protect that quota against abusive use (legitimate interest, Art. 6(1)(f) GDPR). It is also deleted, without waiting for that period, when you close your account.
Your IP address. The attempt counters in Section 2.9 live only in the server's memory and are never stored on disk. The edge server's error log has no period in days but a size cap (Section 2.9): when it fills up, the oldest entries are overwritten. Whatever Cloudflare retains is governed by its Data Processing Addendum.
Billing records in Stripe. The billing records of your subscriptions are retained by Link and the Stripe group entities involved in Stripe Managed Payments (Section 4), in accordance with their own legal and tax obligations. These records are not under our control and are not deleted by us.
Legal obligations. If there were a legal obligation to retain certain information for a longer period (for example, at the request of a competent authority), we would retain only that specific information for the legally required period, and nothing more.
7. Your rights
As a user, you have the right to:
- Access your personal data.
- Rectify inaccurate data.
- Erase your data when it is no longer necessary.
- Object to the processing or restrict its scope; in particular, to processing based on our legitimate interest (Section 3).
- Portability: receive your data in a structured format.
You can exercise these rights by writing to privacidad@crisolmcp.com, attaching a copy of a document that proves your identity. We will respond within one month of receiving your request.
If you consider that we have not properly addressed your request, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
8. Security measures
We apply, among others, the following technical and organizational measures:
- Encryption at rest of all third-party credentials (Fernet/AES-128-CBC + HMAC-SHA256), with a master key separate from the database.
- Strict data isolation between users: one user's data is never accessible to another user.
- The integrated artificial intelligence assistant never accesses real credentials or the data from your sources, only metadata about your account (connected sources, contracted plan and the panel screen you are on).
- A strict Content Security Policy (CSP) in the panel, with no unauthorized third-party JavaScript.
- Encrypted communications (HTTPS) across the entire Site and panel.
- Limit on attempts per IP address at sign-in and on the public forms, and on requests per minute at the edge server.
9. Minors
The Service is directed at people who manage digital assets (websites, campaigns, online stores), whether for professional or personal purposes, and its use is reserved for adults, in accordance with Clause 3 of the Terms and Conditions. We do not knowingly collect data from minors; if we detect that an account has been created in a minor's name, we will delete it.
10. Changes to this policy
We may update this Privacy Policy to adapt it to regulatory changes or changes to the Service itself. We recommend that you review it periodically. The date of the last update appears at the end of this document.
This is a courtesy translation of the Spanish original. In the event of any discrepancy, the Spanish version published at https://crisolmcp.com/legal/privacy prevails.