Privacy policy

Draft dated 25 October 2026. Describes the website and hosted MCP tool marketplace published under the name Inferventis. That name is the product name only. It is not a legal entity.

1. Who we are

The service is a hosted marketplace where business customers connect AI agents to tools over the Model Context Protocol (MCP). The controller of personal data described in this notice will be the legal entity named below. That entity has not been appointed yet:

• [COMPANY LEGAL NAME]
• [REGISTERED ADDRESS]
• Privacy contact: [CONTACT EMAIL]

If a statutory representative in the EU or the UK is required, their details will be published here as [EU REPRESENTATIVE] and [UK REPRESENTATIVE]. Until those details are confirmed, use [CONTACT EMAIL].

2. Who this covers

The service is aimed at businesses, not at consumers acting in a purely personal capacity, and not at children. This notice covers people who visit the site, create a developer or customer account, list a tool, contact us, or whose personal data is included in a tool call their organisation sends through the marketplace.

3. Our role

We are the controller for account data, site analytics, support messages, and our own billing records.

When a business customer sends content through a tool call — a prompt, a file reference, or a result that contains personal data — we act as that customer’s processor for that content, and the tool developer who receives the call acts as a further processor or an independent controller depending on the tool. A data-processing addendum is available on request from [CONTACT EMAIL]. Customers must not send special-category data through the service unless that addendum is in place and the tool is suitable for it.

4. Data we collect

• Account and listing data. Name, work email, the organisation you work for, and the identity details returned by whichever sign-in option you use on the developer portal. Tool name, description, the endpoint you choose to register, and a wallet address for payouts.
• Tool-call content. The task an agent submits, the tool selected, the result returned, and technical details of the call such as time and whether it succeeded. This content can include whatever the customer’s agent sends.
• Billing. Payment references, wallet addresses, and transaction identifiers needed to charge for calls and to pay developers.
• Messages. What you send through the contact form or by email: name, email, organisation, subject, and the message.
• Technical data. IP address, browser type, and timestamps in security and operational logs.
• Analytics. If you accept the cookie banner, the site analytics provider named in that banner receives a cookie identifier and page-view data. If you decline, analytics cookies stay off.
• On your device. The developer portal stores a session token in the browser’s local storage. The operator dashboard stores a key you type, on that browser only. We do not put account secrets into the pages themselves.

5. Why we use it, and the lawful basis

• To provide the marketplace — create accounts, route tool calls, host or connect tools, and pay developers. Basis: contract (UK GDPR / EU GDPR Article 6(1)(b)).
• To take payment and keep accounting records. Basis: contract, and legal obligation for tax and accounting records (Article 6(1)(c)).
• To keep the service secure — authenticate requests, investigate abuse, and protect customers. Basis: legitimate interests (Article 6(1)(f)).
• To answer you and to tell existing business contacts about the service. You can opt out of marketing at any time. Basis: legitimate interests for B2B contact, or consent where we ask for it.
• To measure site use. Basis: consent, collected by the cookie banner (Article 6(1)(a) and, in the UK, PECR).

6. Who we share it with

We share personal data with:

• The tool developer whose tool is called, to the extent needed to perform that call.
• Hosting, email, and payment providers who process data on our instructions.
• The sign-in provider you choose on the developer portal, when you use one.
• The site analytics provider, only after you accept analytics cookies.
• Professional advisers and authorities where the law requires it.

We do not sell personal data.

7. International transfers

We aim to keep personal data in the UK and the EEA. Some providers may process it elsewhere. Where a transfer from the UK or EEA needs a safeguard, we use an approved mechanism such as the EU Standard Contractual Clauses or the UK International Data Transfer Agreement, plus a transfer assessment where one is required. The specific provider list is [SUBPROCESSOR LIST] and will be published or supplied with the data-processing addendum.

8. How long we keep it

These periods are draft figures for counsel to confirm:

• Account and listing data: for the life of the account, then 24 months, unless a dispute or a legal hold requires longer.
• Tool-call logs: 12 months, then deleted or reduced to counts that do not identify a person.
• Contact messages: 24 months.
• Billing and tax records: for the statutory accounting period that applies to [COMPANY LEGAL NAME].
• Analytics data: for the retention period configured for the analytics provider, and only if you have accepted cookies.
• Cookie preference: stored in your browser until you clear it.

9. Your rights

If UK GDPR or EU GDPR applies, you can ask us to access, correct, delete, or restrict your personal data, to object to certain processing, and to receive data you provided in a portable format. Where we rely on consent, you can withdraw it at any time. You can also complain to the UK Information Commissioner’s Office, or to your EU supervisory authority if you are in the EEA.

Send requests to [CONTACT EMAIL]. We may need to confirm you are the person the data is about, or that you act for the business customer who controls it. We respond within one month, or tell you if we need longer.

10. Security

We use access controls, encryption in transit, and separation between customer accounts. No online service is perfectly secure. Please keep API keys, session tokens, and wallet keys to yourself, and tell us at [CONTACT EMAIL] if you believe an account has been compromised.

11. Cookies

The site asks before it sets analytics cookies. Essential storage is limited to your cookie choice and, if you sign in, the developer session held in local storage. Declining the banner leaves analytics off. You can change your mind by clearing this site’s storage and reloading the page.

12. Changes

We will post updates on this page and change the date at the top. If a change materially affects a business account, we will also email the account contact.

13. Contact

[COMPANY LEGAL NAME]
[REGISTERED ADDRESS]
[CONTACT EMAIL]

The terms that govern use of the service are at /terms.