Legal
Privacy notice
What this site records, why, for how long, and what it refuses to. Revised 2026-09-09.
No cookies, no advertising or social trackers. Page views are counted with Plausible, without cookies or identifiers. Visiting leaves a server log line that is deleted after 14 days. The contact form becomes an email. Payment runs through Stripe, booking through a scheduling page that loads only when you open it. Project data you give us for a build stays on one server in Germany and is deleted 90 days after handover.
Controller
FINAL MASTER LLC, 7901 4th St N Ste 300, St. Petersburg, FL 33702, USA, hi@finalmaster.net. Questions about this notice go to hi@webmcp-tool.com.
The controller is a company in the United States. The server that stores everything described here stands in Germany (NexoSystems IT-Solutions, Niederzier, Germany), and the data stays there. The controller reaches it only over an encrypted administrative connection.
Visiting this site
The web server writes one line per request: the requested path, the time, the status, the size of the answer, the referrer if the browser sends one, the user agent string and the network address. The lines are used to run the site, to find faults and abuse, and to count how often AI agents fetch our pages; they are deleted after 14 days. Legal basis: our legitimate interest in a working and secure site (Art. 6 (1) (f) GDPR).
The page loads one script of our own from agenttracking.co, our sister site, which records whether the visitor is an AI agent and what it fetched. It sets no cookie and records no address or identifier. Fonts are served from this site, not from Google.
To see which pages get read we use Plausible Analytics in an installation we run ourselves at analytics.polymarkt.de. It works without cookies and creates no cross-device recognition. No full IP addresses are stored; to tell visits apart, Plausible derives a hash from IP address, user agent and domain with a key that rotates daily, so that after 24 hours at most even we cannot attribute a visit. No personal profiles are created and the data is not shared. Legal basis: our legitimate interest in data-minimising usage analysis (Art. 6 (1) (f) GDPR); no consent is needed because nothing is stored on or read from your device.
Writing to us
The contact form sends your name, email address, what you typed and, if you gave one, your product's address to our inbox as an email through Brevo (Sendinblue SAS, Paris, France), which also sends you a copy. Nothing is stored in a database on this site. We keep the email for as long as the conversation and any contract that follows require, and at most three years after the last message. Legal basis: steps prior to a contract at your request (Art. 6 (1) (b) GDPR).
Paying
Checkout runs on Stripe (Stripe, Inc., South San Francisco, USA, and Stripe Payments Europe Ltd., Dublin, Ireland). Stripe receives your card or bank details directly; we never see them. We receive your name, email address, company, billing address, tax ID if you enter one, the answers to the checkout fields, and the payment status. Stripe's own privacy policy applies to Stripe's processing. We keep invoices and payment records for the period tax law requires.
Booking a call
The booking link leads to a Cal.com booking page at book.agentifizierung.de, run by Agentifizierung UG (haftungsbeschränkt), a company of the same founder. It loads only when you open it, and its own privacy notice applies to what you enter there. The call itself runs on the conferencing tool named in the invitation.
Project data
To build or audit an MCP server we receive what the contract names: API documentation, credentials for a test account, sample data, the details of the people we work with. It is stored on the server in Germany, used only for that project, and deleted 90 days after handover, or immediately on request. Under Care we keep what the running service needs for as long as Care runs. If your API exposes personal data of your users, you remain the controller of that data and we act on your instructions; a data processing agreement is available on request. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR).
Your rights
You can ask what we hold about you, have it corrected or deleted, restrict or object to its use, and receive it in a portable form (Art. 15 to 21 GDPR). Write to hi@webmcp-tool.com. You can also complain to a data protection authority; in the EU, the one in your country.
Changes
When the site starts doing something new with data, this page changes first and the date at the top moves. Older versions are available on request.