Privacy Policy

BusinessMCP, Inc. (“BusinessMCP”, “we”) is the data controller for the account and marketing data described below. For privacy questions or to exercise your rights, contact our privacy team at privacy@businessmcp.com or use the request form.

For your BusinessMCP account (your email, billing, workspace content) we act as the controller. For the end-visitor analytics your workspace collects through our tracking script and support widget, you are the controller and we act as your processor, handling that data only on your instructions under our Data Processing Agreement. You are responsible for having a lawful basis and appropriate notice/consent for the visitors you track.

• Account & billing: your email, workspace name, team membership, and subscription status. Payment card details are handled by Stripe and never stored on our servers.
• Workspace content: notes, playbooks, connections metadata, CRM contacts, and the messages you exchange with the AI assistant.
• Usage: agent runs, token counts, and cost — used for metering and abuse prevention.
• First-party analytics (pseudonymous):a random visitor id stored in the browser’s localStorage, a daily-rotating session hash that is one-way and re-identifiable only within a single UTC day (it cannot be reversed into a person or linked across days), page paths, coarse geo (country/region/city derived from IP then discarded), and device/browser type.
• IP addresses are not storedwith analytics events. IP is used transiently for geo and bot detection and then dropped. It is only retained when a workspace on a paid plan explicitly turns on company enrichment, and even then it is discarded after the company is resolved (“enrich then discard”).
• Visitor identification (business context): for paid workspaces that enable it, we identify the companybehind an anonymous business visitor from the network the visit originates on (in-house, no third party), and can surface a “likely person” from the workspace’s own contact records using page context — this uses company data only and no device access. Person-level identification(resolving an individual’s name and work email) is stricter: device/hashed-email matching runs only for US visitors under notice-and-opt-out, or elsewhere only where the visitor has given consent, is never performed for visitors in the EU/EEA/UK/Switzerland without consent, is disabled whenever a Global Privacy Control (GPC) signal is present, and every attempt is logged. A separate first-party mechanism recognizes a returning contact the workspace already knows (matching against its own records) — no third-party data is involved.

• Contract: to provide the service you signed up for — running your command center, storing your workspace, and billing you.
• Legitimate interests: operating cookieless, pseudonymous product analytics, securing the platform, and preventing abuse — balanced against your rights. This analytics is first-party and is not sold or shared for advertising (see Do Not Sell or Share below).
• Legitimate interests (company identification): identifying the company behind an anonymous business visit is a B2B, company-level operation carried out under Art. 6(1)(f) with no device access and no cookie: we process company data plus a truncated IP only (/24 · /48), never store the email local-part, and keep IP addresses separate from analytics events. It runs in every region on this basis; it is not person-level identification and can be turned off. Full detail is in our DPAand the “Do Not Sell or Share” section below.
• Consent: for marketing email you can withdraw at any time. Where your end-visitors require consent for tracking, obtaining it is your responsibility as their controller.

API keys and tokens you store in the vault are encrypted at rest, are never returned to the browser after saving, and are only decrypted server-side at the moment an integration call is made on your behalf.

Our database and analytics event store are hosted in the EU. Where data is transferred outside the EEA/UK — hosting, email, billing and the included AI tier are in the US — we rely on Standard Contractual Clauses and our providers’ data-protection frameworks to ensure an equivalent level of protection.

We do not sellyour personal information. Our first-party analytics is cookieless and pseudonymous and is not “shared” for cross-context behavioral advertising, so it is not gated by a privacy signal.

Where a customer enables our optional ad-platform integrations — server-side conversion measurement or audience matching that transfers data to networks like Meta or Google — that can constitute a “sale” or “share” under US state privacy laws (California, Colorado, Connecticut and others). For residents of states that recognize it, we honor a Global Privacy Control (GPC) browser signal as a valid opt-out: visitors who send GPC are excluded from those ad-platform transfers. First-party analytics is unaffected. Do-Not-Track is not an agreed legal standard and we do not rely on it.

Person-level visitor identification (US visitors, opt-in customers only) may use a third-party identity provider (BigDBM, LeadPipe, RB2B or Versium). That provider acts as a third party under US state law, not a service provider, under a contract limiting it to identity resolution with audit rights. GPC is honored as an opt-out for this processing, and it is never run for EU/EEA/UK/Swiss visitors absent consent. We do not resell visitor-identity data.

Where a customer uses our optional Sales Automationfeature to conduct business-to-business outbound outreach, that customer is the controller of the prospect data and is responsible for having a lawful basis (in the EU/UK, typically legitimate interest for B2B prospecting) and for honoring opt-outs. Every message carries the sender’s identity and postal address, a one-click unsubscribe link and List-Unsubscribe headers; recipients who unsubscribe, existing customers, and GPC opt-outs are suppressed automatically. Prospect enrichment draws on lawfully-sourced public and licensed B2B data.

BusinessMCP is a business tool not directed to children, and we do not knowingly collect personal data from anyone under 16.

We may update this policy; material changes will be announced by email. Questions? Email privacy@businessmcp.com.