Privacy Policy

Last updated: 19 June 2026

This Privacy Policy explains how SociallyMCP ("SociallyMCP", "we", "us") collects, uses and protects personal data when you use our website and our hosted Model Context Protocol (MCP) server for account-free social media data (the "Service"). We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable Polish law.

1. Data controller

The data controller is SociallyMCP, VAT ID PL1182252988, ul. Marcina Kasprzaka 31/119, 01-234, Poland. For any privacy request you can reach us at hello@sociallymcp.com.

2. What data we process

  • Account data — your email address and authentication identifiers, managed by Supabase Auth. Passwords are never stored by us in readable form.
  • API keys — stored only as salted hashes; we cannot recover the original key after it is shown to you once.
  • Usage & billing logs — for every tool call we store the search query / parameters, the tool name, status and timing. We need this to meter usage, enforce quotas and bill correctly.
  • Payment data — billing is handled by Stripe. We store only a Stripe customer reference and your subscription status, never card numbers.
  • Support data — if you contact us, we store your name, email, category, subject and message.
  • Analytics data — if (and only if) you accept analytics cookies, Google Analytics 4 collects pseudonymous usage statistics.

We do not require or store any social media account credentials, and we do not retain the social media content returned by the Service beyond what is technically necessary to deliver a response. The only request data we keep is the search query / parameters you send, and only for metering and billing.

3. Why we process it and our legal basis

  • To provide the Service (accounts, API keys, tool calls) — performance of a contract, Art. 6(1)(b) GDPR.
  • To meter usage, bill and keep accounting records — contract, Art. 6(1)(b), and compliance with legal (tax) obligations, Art. 6(1)(c).
  • To secure the Service and prevent abuse — our legitimate interest, Art. 6(1)(f).
  • Analytics cookies — your consent, Art. 6(1)(a), which you can withdraw at any time.

4. Processors and sub-processors

We share data only with processors that help us run the Service, under data-processing agreements:

  • Supabase — database, authentication and storage (EU region).
  • Stripe — payment processing and subscription management.
  • Autosend — transactional and account emails.
  • OVHcloud — server hosting for the MCP endpoint (EU).
  • Google Analytics — web analytics, only after you consent.

We never sell your personal data and never share it for third-party advertising.

5. International transfers

Our core infrastructure (Supabase, OVHcloud) is hosted in the EU. Where a processor such as Stripe or Google processes data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism.

6. Retention

We keep account data for as long as your account is active. Usage and billing records are kept for as long as required by accounting and tax law. Support messages are kept for as long as needed to handle your request and a reasonable period afterwards. When you delete your account, we delete or anonymise personal data that we are not legally required to retain.

7. Your rights

Under the GDPR you have the right to:

  • access your personal data and obtain a copy;
  • rectify inaccurate or incomplete data;
  • erase your data ("right to be forgotten");
  • restrict or object to processing;
  • data portability;
  • withdraw consent at any time (without affecting prior processing).

You can exercise most of these directly from your dashboard (export or delete your account) or by emailing hello@sociallymcp.com. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).

8. Cookies

We use strictly necessary cookies to run the site and keep you signed in. Analytics cookies (Google Analytics) load only after you accept them in our cookie banner; you can change or withdraw your choice at any time. Declining analytics does not affect access to the Service.

9. Security

We protect data with encryption in transit, hashed API keys, row-level access controls and least-privilege service credentials. No system is perfectly secure, but we work to keep your data safe and will notify you and the relevant authority of a breach where the law requires it.

10. Children

The Service is not directed to children under 16, and we do not knowingly process their data.

11. Changes

We may update this policy from time to time. We will post the new version here and update the "Last updated" date; material changes will be communicated where appropriate.

12. Contact

Questions about this policy or your data? Email hello@sociallymcp.com.