Privacy Policy
Last updated: 20 October 2026
This Privacy Policy explains how the MCP Rating website, API and MCP endpoint (the "Service"), operated by SoshiteAI ("we", "us"), handle information. We have designed the Service to collect as little personal data as possible.
We act as the data controller for any personal data processed via the Service. This policy is written to align with the UK GDPR / EU GDPR principles. (Confirm jurisdiction-specific obligations with an adviser before relying on this as a compliance document.)
1. What we collect
We do not require accounts, we set no cookies, we use no third-party analytics or trackers, and we do not sell data or run advertising.
| Data | Why | How long | Basis |
|---|---|---|---|
| Server logs: IP address, time, requested URL (which includes a search phrase typed on the website or sent to the API), user agent | Security, abuse prevention and operating the Service | Rotated automatically; normally the last few weeks | Legitimate interest |
| Searches on the website and through the API: the search text, the number of results, the time, and whether it came from the website or the API | To see what people look for and improve search | Text deleted after 12 months; the count is kept | Legitimate interest |
| Searches through the MCP endpoint: the number of results and the time; not the search text | To count how much the endpoint is used | Kept | Legitimate interest |
| Button clicks on the website ("Ask Claude", "Ask ChatGPT", install and copy buttons): a total per day and per server | To see which buttons are used | Kept | Legitimate interest |
| Your email address, if you ask to watch a server: the address, the server, when you asked and confirmed, and when we last emailed you and why | To send the link to confirm, and then the alerts you asked for: the server stopped working in our test, works again, or changed its tools | Until you stop watching (a link in every email), then deleted. Requests nobody confirms are deleted within two weeks | Consent |
| Correspondence (if you email us) | To respond to your message | As long as needed to deal with it | Legitimate interest |
None of the searches or click counts is linked to an IP address, an account, a cookie or any other identifier. We also count watch requests, confirmations, stops and alerts sent, per day and per server, the same way: no address.
We email a watch address only the link to confirm and the alerts about that server: no newsletters, no marketing, and nothing about other servers. Nothing is sent after the confirmation email until the link in it is clicked.
2. MCP endpoint and API
The MCP endpoint (https://mcprating.io/mcp) and the API answer questions about
MCP servers listed in our index. They need no account and no key.
When an AI assistant or app calls the MCP endpoint, we receive the name of the tool it calls and the tool's arguments, for example a search phrase or a server's name. We use them only to answer that call. We count MCP searches but do not keep their text (see section 1).
We do not receive your conversation, your chat history or files, or any account information from the AI assistant, and we cannot see who you are unless you put it in a search. For a request from an AI assistant, the IP address in our server logs is usually the assistant provider's (for example Anthropic's or OpenAI's), not yours.
3. What we do NOT do
- We do not create user profiles, for advertising or anything else.
- We do not sell or rent personal data.
- We do not use cookies, third-party analytics or trackers.
- We do not send marketing email, or use a watch address for anything but that watch.
- We do not knowingly collect data from children.
4. Public MCP server data
Information about MCP servers shown on the Service is collected from public sources (the official MCP registry, npm, PyPI, Docker Hub, GitHub). This is public, non-personal project metadata (names, descriptions, statistics) plus our own derived scores and the results of our own tests. Where an author's public username appears, it is shown for attribution and links back to the public source. See Listing removal below.
5. Sharing
We share data only with infrastructure providers needed to run the Service, acting as our processors under appropriate terms: hosting (Hetzner), database (Neon), content delivery and protection (Cloudflare, which handles every request to the Service before it reaches us), and email delivery (Resend, which sends the watch emails and so receives the address and the message). We may disclose data if required by law.
6. Retention
Server logs are rotated automatically by size and normally cover the last few weeks of traffic. The text of website and API searches is deleted after 12 months; the counts in section 1 are kept because they identify no one. A watch address is deleted when you stop watching, or within two weeks if the watch was never confirmed.
7. Your rights
Subject to applicable law, you may have the right to access, correct, delete, or restrict processing of your personal data, to object to processing, and to data portability. To exercise any right, contact us at [email protected]. You also have the right to lodge a complaint with your local data protection authority (in the UK, the ICO; in Poland, the UODO).
8. Listing removal / takedown
If you are an MCP server author and want your listing corrected or removed, or if public information shown about you should be amended, contact [email protected] and we will review and respond in good faith.
9. International transfers
Where data is processed outside your country (e.g. by a hosting or content delivery provider), we rely on appropriate safeguards as required by applicable law.
10. Changes
We may update this policy; material changes will be reflected by updating the "Last updated" date above.
11. Contact
For any privacy question or request: [email protected]