This policy explains what personal data Cloud Factory A/S processes when you use the MCP server at mcp.cloudfactorygroup.com, why, for how long, and what rights you have. It supplements Cloud Factory's general privacy policy and the Data Processing Agreement in your partner agreement.
Cloud Factory A/S
CVR 35393692
Dokken 10, 6700 Esbjerg, Denmark
Privacy questions: [email protected]
For the data described in section 3 (your identity as a partner user and the technical records of your use of the server), Cloud Factory is the data controller. For your end customers' data that you read through the server (section 5), you or your company is the data controller and Cloud Factory is your data processor under the Data Processing Agreement, exactly as when you use the Partner Portal.
This policy covers the MCP server only. Everything that applies to the Cloud Factory platform as a whole, including sub-processors, hosting, security measures, retention and audits, is in the documents listed in section 11 and is not repeated here.
The MCP server is an interface that lets an AI assistant of your choice (an MCP client such as Claude, ChatGPT, VS Code or Copilot Studio) read data from your Cloud Factory partner account on your behalf. It runs as part of the Cloud Factory platform and keeps no database of its own: it reads from Cloud Factory's services on each call and returns the result to your client.
| Data | Where it comes from | Why |
|---|---|---|
| Your user identifier, the client you connect from, the permissions you granted, and the partner your account belongs to | The access token issued by Cloud Factory's identity provider when you log in | To authenticate every request, to check that the client may call a tool, and to act on your behalf towards Cloud Factory's services |
| A short-lived token for Cloud Factory's internal services, exchanged from your access token | Cloud Factory's identity provider | To read data as your user with your permissions. |
| An audit record per tool call: your user identifier, your partner, the client, the tool name, the arguments the client sent, the result the server returned, the outcome, the duration, IP address and user agent. Requests refused for a missing scope, the rate limit or a rejected token are stored with the same identity fields and no result | Generated by the server | Security, incident investigation, abuse detection and support. Records are stored in Cloud Factory's API request log, the same store used for the Partner Portal and the Partner API, with the same access controls and retention |
| Request metadata: timestamps, status codes, IP address, user agent | Generated by the server and the hosting platform | Security and operations |
| Usage metrics: counts and durations per tool, per client and per partner | Generated by the server | Capacity planning and product improvement. Metrics never contain your user identifier |
The server does not set cookies and does not use tracking or analytics scripts.
When the assistant calls a tool, the server reads data about your end customers from Cloud Factory's services: company master data, contact details, and subscription data at the vendors you buy through Cloud Factory. The server returns this data to your MCP client and keeps a copy of each result in the audit record described in section 3, processed under the Data Processing Agreement like other Partner Portal and Partner API request logs.
From that moment the data is outside Cloud Factory's control. Your MCP client and the AI service behind it process the data under your agreement with that provider, not under Cloud Factory's Data Processing Agreement. You are responsible for choosing a provider, for the legal basis of that transfer, for any transfer outside the EU or EEA, and for informing your customers where required. Cloud Factory does not see, store or receive what the AI service does with the data.
The MCP server uses the same sub-processors as the rest of the Cloud Factory platform, for hosting, identity and monitoring. They are listed in the sub-processor overview and are not repeated here. The MCP server adds no sub-processor of its own.
One recipient is specific to the MCP server and is not a Cloud Factory sub-processor: the MCP client you connect and the AI service behind it. You choose and contract with that provider, and it receives whatever a tool returns. See section 5.
Cloud Factory does not sell personal data and does not share it with third parties beyond these processors and where the law requires it.
You have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability, within the limits of the GDPR. Write to [email protected]. You can also complain to the Danish Data Protection Agency, Datatilsynet, at datatilsynet.dk.
Specific to this server: all traffic is encrypted in transit, the server accepts only tokens issued for itself and never forwards your token to another service, and every call is limited to what your Partner Portal permissions allow. Cloud Factory's security programme, certifications and audits cover this server like the rest of the platform and are described on the compliance page.
We update this policy when the server changes in a way that affects your data, for example when a new tool reads a new kind of data. The date and version at the top tell you which edition applies. Material changes are announced to partner administrators by email. Changes to the platform-wide documents in section 11 are published by Cloud Factory separately.