How DataTether handles personal information.

Who We Are and How to Contact Us

The DataTether platform is operated by DataTether Inc. ("DataTether," "we," "our," or "us"). DataTether is the entity responsible for the personal information described in this policy where we act as a controller, and the entity that processes personal information on behalf of customer organizations where we act as a processor.

For any privacy or data-protection question — including access, correction, deletion, export, or objection requests, questions about this policy, requests for a data processing addendum, or requests for the current subprocessor list — contact us at [email protected] with "Privacy request" in the subject line.

We aim to acknowledge privacy requests within five business days and to respond substantively within 30 days, or within the shorter period required by applicable law. Where a request is complex, we may extend that period as permitted by law and will tell you if we do.

Security vulnerabilities should be reported through the security contact channel rather than this address so they can be triaged more quickly.

Scope of This Policy

DataTether is a governed enterprise integration and orchestration platform. It connects customer-authorized enterprise systems — such as ERP, CRM, OData, and other business services — to AI systems, MCP-compatible clients, users, and applications through generated tools, resources, dashboards, workflows, and controlled automation.

This policy covers the DataTether public website, the authenticated console, the MCP and API surfaces, and the supporting infrastructure. It applies to personal information we handle as a controller and describes, for transparency, how we handle customer data as a processor.

It does not cover the connected enterprise systems you authorize, the MCP clients or AI applications you approve, or any third-party website we link to. Those are governed by their own policies. Cookie and browser-storage detail is set out in the Cookie Policy at /cookie-policy, which forms part of this notice.

What We Do Not Collect

Some categories of processing are worth stating in the negative, because they are commonly assumed:

• We do not use your enterprise data, prompts, tool definitions, workflow configurations, or MCP request content to train, fine-tune, or improve AI or machine-learning models — ours or anyone else's.
• We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under California law.
• We do not store your payment card number, CVC, or full bank details. Card data is entered directly into our payment provider's hosted checkout and never reaches DataTether servers.
• We do not run advertising, remarketing, or retargeting pixels on the public site, and no advertising tags are configured in the application code.
• We do not collect precise geolocation, contact lists, address books, or device sensor data.
• We do not disclose your stored upstream-system credentials to MCP clients through the ordinary OAuth approval flow.
• We do not require consumer profiles, and the Platform is not directed to children.

Controller and Processor Roles

For enterprise data processed on behalf of customers, DataTether generally acts as a processor or service provider.

For account management, security, analytics, operational monitoring, and business administration data, DataTether may act as a controller.

Organizations using the Platform remain responsible for ensuring they have appropriate rights and lawful bases for the enterprise data they connect or process through the Platform.

Information We Collect

We may collect:

• Account Information: name, email address, organization membership, authentication identifiers, and profile information.
• Supabase Authentication Data: Supabase user identifiers, provider identifiers, session metadata, access tokens, refresh tokens, OAuth authorization details, scopes, redirect URLs, authorization codes, sign-in events, and related security metadata.
• Authentication and Security Data: OAuth identity data, login events, IP addresses, browser/device metadata, session identifiers, authentication provider metadata, API tokens, static MCP tokens, and MCP OAuth tokens.
• Operational Data: workflow execution data, MCP requests, tool usage, dashboard interactions, confirmation events, audit logs, resource access activity, configuration metadata, client metadata, errors, performance signals, and session or replay identifiers.
• Platform Configuration Data: organizations, instances, service URLs, OData metadata, generated tools, prompts, resources, dashboards, workflows, field mappings, access rules, confirmation rules, and selected display settings.
• Integration Credentials and Secrets: usernames, passwords, OAuth client IDs, OAuth client secrets, token endpoint details, OAuth access or refresh tokens, API keys, service-account credentials, and other secrets supplied to connect authorized systems.
• Connected Enterprise Data: the Platform may process enterprise records exposed through connected systems, including ERP, CRM, OData, workflow, operational, or business-system data. We process such data only on behalf of authorized users and organizations.
• Billing and Subscription Data: for paid plans, the billing contact name and email address submitted at checkout, the plan purchased, subscription status, renewal and cancellation dates, and a record of each payment event including payment and subscription identifiers, amount, currency, status, refunds, and disputes.
• Support and Correspondence Data: the content of messages you send us through the guided access form, privacy or legal requests, and support correspondence, together with the contact details you include.

Payment card numbers, CVC codes, and bank account details are entered directly into the hosted checkout operated by our payment provider and are never transmitted to or stored on DataTether systems. We receive only the transaction outcome and the identifiers needed to attribute a subscription to your organization.

How We Use Information

We use information to:

• provide and operate the Platform
• authenticate and authorize users
• execute workflows and MCP requests
• maintain security
• monitor reliability and performance
• detect abuse or unauthorized access
• improve Platform functionality
• support audit and compliance needs
• respond to support requests
• operate Supabase-backed account, database, and OAuth authorization flows
• issue, validate, refresh, revoke, or expire access tokens and sessions
• store and resolve integration credentials server-side for authorized requests
• process subscriptions, payments, renewals, refunds, and billing records
• send service, security, billing, and policy notices

We do not sell personal information, and we do not use personal information for automated decisions that produce legal or similarly significant effects about an individual.

Legal Bases for Processing

Where the GDPR or UK GDPR applies, we rely on the following legal bases. Where we act as a processor for a customer organization, that organization is responsible for establishing the legal basis for the enterprise data it connects.

• Performance of a contract: creating and administering accounts and organizations, authenticating users, operating the Platform and its integrations, executing workflows and MCP requests, and providing support.
• Legitimate interests: securing the Platform and preventing abuse, monitoring reliability and performance, debugging, product analytics and improvement, and administering our business relationship with customers. We balance these against your interests and rights before relying on them.
• Legal obligation: retaining billing, tax, and accounting records, responding to lawful requests, and meeting security-incident notification duties.
• Consent: optional analytics cookies on public marketing pages, marketing communications where required, and any processing you separately opt into. You may withdraw consent at any time without affecting prior processing.

AI Processing and Model Training

The Platform may process information through:

• AI systems and model providers
• workflow engines
• MCP-compatible clients
• generated tools
• dashboards
• application resources
• transformations and enrichments

DataTether does not use your enterprise data, prompts, tool definitions, workflow configurations, or MCP request content to train, fine-tune, or improve AI or machine-learning models, and does not sell or license that content to third parties for their own purposes. This applies to both the data you configure in the Platform and the enterprise records retrieved through connected systems.

Where a request is fulfilled using a third-party AI provider, the content of that request is transmitted to that provider and handled under that provider's terms. Depending on the model you or your organization select, those providers may include Anthropic (anthropic.com/legal/privacy), OpenAI (openai.com/policies/privacy-policy), and Google (policies.google.com/privacy). We use these services through their API or enterprise offerings, under which the provider does not train its models on the content submitted. You are responsible for confirming that the provider selected is appropriate for the sensitivity of the data involved.

MCP clients and AI applications you authorize — such as Claude, ChatGPT, or Copilot — receive data under their own privacy policies once you approve them, and their handling of that data is outside our control.

Some processing involves automated decision support or AI-generated outputs. These are the product of probabilistic systems and may be inaccurate, incomplete, unsafe, or unintended. Interfaces that surface AI-generated content are intended to identify it as AI-generated, and users remain responsible for validating operational decisions and reviewing sensitive actions before approval.

If you deploy the Platform in a context governed by AI-specific regulation, including the EU AI Act, you remain responsible for determining your role under that regulation and for any disclosure, human-oversight, or record-keeping obligations that apply to your deployment.

Integration Credentials and Secrets

The Platform may store authentication credentials and integration secrets required to connect authorized enterprise systems and external services.

Depending on configuration, this may include:

• usernames and passwords
• OAuth access or refresh tokens
• API keys
• client credentials
• session cookies
• service-account credentials

Customers remain responsible for:

• supplying authorized credentials
• rotating credentials where appropriate
• revoking compromised credentials
• limiting excessive permissions

Credentials are stored using restricted-access, encrypted secret-management mechanisms and are used solely to authenticate authorized requests to connected systems.

DataTether personnel do not routinely access plaintext credentials. Access is restricted to authorized personnel and occurs only where operationally required for support, recovery, compliance, or security purposes.

When username and password authentication is selected for a connected system, those credentials may be stored so DataTether can authenticate permitted requests. When OAuth is selected, OAuth client configuration, tokens, scopes, redirect metadata, and token endpoint details may be stored and refreshed where supported.

Stored upstream credentials are resolved server-side for permitted operations and are not intended to be disclosed to MCP clients through the ordinary OAuth approval flow.

OAuth and Third-Party Clients

When you authorize third-party applications through OAuth:

• those applications may access approved scopes and capabilities
• those applications may receive access tokens or authorization codes that allow access under your signed-in identity until they expire or are revoked
• those applications operate under their own privacy and security practices
• DataTether is not responsible for third-party behavior after authorization is granted

You should review third-party application policies before authorizing access.

You may deny an OAuth request without granting access. Authorized clients may be revoked through account or workspace settings where available, by an administrator, or through support if self-service revocation is not available.

Cookies, Analytics, and Session Replay

A full inventory of cookies and browser storage, including names, durations, and consent categories, is published in the Cookie Policy at /cookie-policy. In summary, the Platform uses cookies, local storage, and similar technologies for:

• authentication
• session management
• security
• preference storage
• analytics
• operational monitoring
• product improvement

On public marketing pages, optional analytics tools — PostHog, Google Analytics, and Google Tag Manager where configured — load only after you accept analytics cookies. If you reject optional analytics, public pages remain fully usable and only the consent preference is stored. You can change or withdraw that choice at any time from the Cookie Policy page or by clearing the consent cookie in your browser.

No advertising, remarketing, retargeting, or conversion tags are configured in the application code, and the public site does not perform cross-site tracking. If advertising tags are introduced to the tag-manager container in future, this policy and the Cookie Policy will be updated before they are enabled.

Inside the authenticated console, DataTether uses PostHog product analytics, autocapture, heatmaps, surveys, exception capture, and session replay to understand product usage, diagnose issues, improve reliability, analyze feature adoption, and support security or operational review. This processing is based on our legitimate interest in operating and improving the Platform. Login, signup, and OAuth consent routes are excluded from PostHog capture.

Session replay reconstructs what was displayed in the console during a session. Because the console renders data retrieved from your connected systems, a replay may include enterprise data that was on screen at the time. Replay is limited to the authenticated console, is not enabled on public marketing pages, and is subject to the retention period described in Retention and Deletion. Organizations with a requirement to disable session replay for their workspace can request it through the privacy contact.

Analytics data may include page visits, interaction events, browser and device information, session activity, approximate geographic region derived from IP address, feature usage metrics, error data, and replay or heatmap data where enabled. We configure capture to avoid collecting credentials and secrets, and sensitive values should not be intentionally entered into fields that are not required for the operation being performed.

The Platform does not currently respond to browser Do Not Track signals, because no consistent standard for them exists. Where the Global Privacy Control (GPC) signal is legally recognized for a visitor, we treat it as a valid opt-out of optional analytics for that browser.

Service Providers and Subprocessors

We use third-party providers to operate the Platform. Each processes information on our behalf under a written agreement that limits use to our instructions and imposes confidentiality and security obligations. The providers currently in use are:

• Supabase — authentication, OAuth authorization, database, and backend services; stores account, session, token, configuration, and application data (supabase.com/privacy).
• PostHog — product analytics, autocapture, heatmaps, surveys, exception capture, and session replay for the public site and authenticated console (posthog.com/privacy).
• Google (Google Analytics and Google Tag Manager) — public marketing-site analytics, loaded only after analytics consent (policies.google.com/privacy).
• Dodo Payments — merchant of record for paid plans; operates the hosted checkout and customer portal and processes payment card and billing information directly (dodopayments.com/privacy-policy).
• AI and model providers — Anthropic, OpenAI, and Google, where those models are used or selected for AI-assisted processing, as described in AI Processing and Model Training.
• Cloud hosting and infrastructure providers — compute, container hosting, networking, content delivery, and backup storage for the Platform.

MCP clients and AI applications that you authorize through OAuth are not our subprocessors. They act independently under their own terms once you approve them.

A current, named subprocessor list — including hosting regions — and a data processing addendum are available on request at [email protected]. Customer organizations with an executed DPA receive advance notice of new subprocessors as provided in that agreement.

Data Sharing

We may share information:

• with the infrastructure, analytics, payment, and AI service providers listed in Service Providers and Subprocessors
• with connected enterprise systems, at your direction and within the permissions you configure
• with identity providers used to authenticate you
• with authorized administrators of your organization, who can see workspace configuration, audit activity, and membership
• with third-party MCP clients and AI applications that you authorize through OAuth
• where legally required, including in response to a valid legal process
• during security investigations and to prevent fraud or abuse
• to enforce our Terms
• with an acquirer or successor in connection with a merger, acquisition, financing, or sale of assets, subject to this policy continuing to apply

We do not sell personal information, do not share it for cross-context behavioural advertising, and do not disclose it for advertising resale purposes.

Where we receive a government or law-enforcement request for customer data, we will, unless legally prohibited, notify the affected customer organization before disclosing anything, and we will object to requests that are overbroad or legally defective.

International Processing and Transfers

Information may be processed in multiple jurisdictions depending on infrastructure regions, hosting providers, subprocessors, AI providers, and the connected services you configure. Hosting regions for your workspace are documented in the subprocessor list available on request.

Where personal information is transferred out of the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards under Chapter V of the GDPR, principally:

• the European Commission Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies
• adequacy decisions, where the receiving country or framework benefits from one
• supplementary technical and organizational measures, including encryption in transit and at rest and access controls, assessed against the destination

A copy of the transfer mechanism relied on for a particular subprocessor, and the associated transfer impact assessment where one exists, is available on request through the privacy contact.

Data may also transit through other regions as an ordinary consequence of internet routing and content delivery.

Security Measures

We implement reasonable safeguards including:

• encryption of data in transit using TLS, and encryption at rest for stored data and backups
• encrypted, restricted-access secret management for integration credentials and tokens
• access controls, role-based authorization, and authorization enforcement at the workspace and organization level
• token-based authentication with expiry, refresh, and revocation
• audit logging of authentication, MCP requests, tool usage, and confirmation actions
• confirmation systems requiring explicit approval for sensitive write actions
• least-privilege internal access, granted only where operationally required

Users remain responsible for:

• protecting credentials
• configuring permissions appropriately
• reviewing integrations and workflows
• monitoring connected-system access

However, no system is completely secure, and no transmission over the internet can be guaranteed secure.

Data Breach Notification

We maintain procedures to detect, investigate, and respond to security incidents affecting personal information.

If a personal data breach occurs, we will notify the affected customer organization without undue delay after becoming aware of it, and in any event within the timeframe required by applicable law or by an executed data processing addendum. Where we act as a controller and the breach is likely to result in a risk to individuals' rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will notify affected individuals directly where the law requires it.

Notifications will describe the nature of the incident, the categories of data involved, the likely consequences, the measures taken or proposed, and a contact point for further information, to the extent known at the time.

Retention and Deletion

We retain information for operational purposes, security monitoring, audit requirements, legal compliance, and reliability and debugging. Retention is set per category rather than by a single blanket period. Where a period below is stated as a default, it reflects current configuration and may be shortened or extended for a specific organization by workspace configuration, organization policy, or written agreement.

• Trial workspace data — deleted after the 15-day free trial ends where it is not converted to a paid plan. This covers connection configurations, stored integration credentials and tokens, generated tools, dashboards, and workflow definitions, as described in the Terms of Use.
• Account and organization data — retained while the account or organization remains active, then deleted from active systems within 30 days of closure, subject to the exceptions below.
• Integration credentials and OAuth tokens — retained while the related connection remains configured, and deleted when they are rotated, revoked, deleted, expired, or the workspace is deleted.
• Authentication sessions and refresh tokens — retained according to the configured Supabase Auth session lifetime, and invalidated on sign-out or revocation.
• Server access and application logs — 30 days, for security, debugging, and abuse prevention.
• Audit logs, MCP request metadata, confirmation records, and security events — 12 months by default, because they support investigation, compliance, abuse prevention, and operational integrity.
• PostHog product analytics events, heatmaps, surveys, and exception telemetry — 12 months by default, per the configured PostHog project settings.
• PostHog session replay recordings — 30 days by default.
• Google Analytics data on public marketing pages — 14 months, the configured GA4 retention period.
• Billing, payment, invoice, and tax records — retained for the period required by applicable tax and accounting law, generally seven years from the end of the relevant financial year.
• Support and privacy-request correspondence — 24 months from resolution, so we can demonstrate how a request was handled.

Deletion is not instantaneous. Data is removed from active systems within the periods above and may persist in encrypted backups for up to a further 35 days before those backups expire on their ordinary cycle. During that window the data is not accessible for ordinary operational use.

A limited set of records is retained beyond these periods where necessary to comply with a legal obligation, establish or defend legal claims, prevent fraud or abuse, or meet audit and security requirements. These records do not include stored integration credentials, which are deleted with the workspace.

Because trial data is deleted, the Platform should not be relied on as a system of record. Your connected enterprise systems remain the source of truth for your business data.

Your Privacy Rights

Depending on where you live and the applicable law, you may have rights to:

• access the personal information we hold about you and obtain a copy
• correct information that is inaccurate or incomplete
• request deletion of your information
• restrict how we process your information
• object to processing based on our legitimate interests, including direct marketing
• receive your information in a portable, machine-readable format, or have it transmitted to another provider where technically feasible
• withdraw consent at any time, without affecting processing carried out before withdrawal
• not be discriminated against for exercising a privacy right

Some requests may be limited or refused where they conflict with:

• a customer organization's instructions, where we act as processor rather than controller
• audit, security, or abuse-prevention requirements
• a legal or regulatory retention obligation
• the rights and freedoms of other individuals

To exercise any of these rights, email [email protected] with "Privacy request" in the subject line, describing the right you wish to exercise. We will acknowledge within five business days and respond within 30 days, or within the shorter period required by applicable law.

We may need to verify your identity before acting on a request. Verification is normally satisfied by responding from the email address associated with your account; we will not collect additional identity documents unless the sensitivity of the request requires it. Exercising a right is free of charge unless a request is manifestly unfounded or excessive, in which case we will tell you before proceeding.

An authorized agent may submit a request on your behalf where the law permits, provided they supply written proof of authorization and we can verify your identity directly.

If you are an employee or user of a customer organization and we process your information as a processor on that organization's behalf, please direct your request to that organization. Where you contact us instead, we will refer the request to them and assist them in responding.

EEA and UK Supplement

This section applies if you are in the European Economic Area, the United Kingdom, or Switzerland, and supplements the rest of this policy.

DataTether Inc. is the controller for the processing described in Controller and Processor Roles where we act as a controller. The legal bases we rely on are set out in Legal Bases for Processing, and international transfers are addressed in International Processing and Transfers.

Your rights under Articles 15 to 22 of the GDPR are described in Your Privacy Rights, and can be exercised through the contact details in this policy. Where you object to processing based on legitimate interests, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise, or defend legal claims.

We do not carry out solely automated decision-making that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22.

Where we are required to designate a data protection officer or a representative in the EEA or United Kingdom under Article 27 of the GDPR, the current details are available on request at [email protected].

You have the right to lodge a complaint with a supervisory authority in the EU or EEA member state of your habitual residence, place of work, or the place of the alleged infringement, with the UK Information Commissioner's Office if you are in the United Kingdom, or with the Federal Data Protection and Information Commissioner if you are in Switzerland. We would appreciate the chance to address your concern first.

Where DataTether processes personal data as a processor on behalf of a customer organization, a data processing addendum incorporating the Standard Contractual Clauses is available on request.

California Supplement

This section applies to California residents and supplements the rest of this policy, as required by the California Consumer Privacy Act as amended by the CPRA.

In the preceding 12 months we have collected the following categories of personal information, in each case from you, your organization, your device and browser, or our service providers, for the business purposes described in How We Use Information, and disclosed them for those business purposes to the categories of recipient listed in Data Sharing:

• Identifiers — name, email address, account and organization identifiers, authentication identifiers, IP address, and device or session identifiers.
• Customer records — billing contact details and subscription information associated with a paid plan.
• Commercial information — plans purchased, subscription status, and payment, refund, and dispute records.
• Internet or network activity — page and feature usage, interaction events, MCP and API request metadata, error data, heatmaps, and session replay within the authenticated console.
• Geolocation data — approximate region derived from IP address. We do not collect precise geolocation.
• Professional or employment-related information — your role and organization membership.
• Inferences — limited product-usage inferences used to improve the Platform. We do not build consumer profiles or infer sensitive characteristics.
• Sensitive personal information — account credentials and integration secrets are collected solely to authenticate you and to operate the connections you configure. We do not use or disclose sensitive personal information for purposes beyond those permitted under CCPA section 1798.121, so no right to limit applies.

We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not have actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

California residents have the right to know what personal information we collect, use, disclose, and retain; to request deletion; to request correction; to opt out of sale or sharing; to limit the use of sensitive personal information; and not to receive discriminatory treatment for exercising these rights. Because we do not sell or share personal information, no "Do Not Sell or Share My Personal Information" mechanism is required, and we honour the Global Privacy Control signal where it applies.

To exercise a right, email [email protected] with "California privacy request" in the subject line. We will verify your request as described in Your Privacy Rights and respond within 45 days, extending by a further 45 days where reasonably necessary and telling you if we do. An authorized agent may submit a request with written permission and verification of your identity.

Retention periods for each category are set out in Retention and Deletion. Where DataTether acts as a service provider to a customer organization under the CCPA, we process personal information only to perform the services under our written agreement and are prohibited from retaining, using, or disclosing it for any other purpose.

Children

The Platform is intended for business and enterprise use and is not directed to children. We do not knowingly collect personal information from children under 13, or under 16 where the EEA or UK GDPR applies.

Consistent with the Terms of Use, you must be at least 16 years old to use the Platform, or at least 18 where that is required to form a binding contract in your jurisdiction.

If you believe a child has provided personal information to us, contact [email protected] and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Platform, our providers, or legal requirements. Updated versions become effective when published, and the "Last updated" date at the top of this page is revised.

Where a change materially affects how we handle personal information — for example a new category of processing, a new subprocessor category, or a change to retention — we will provide reasonable advance notice by email to account or organization administrators, by in-product notice, or both, before the change takes effect. Where the change requires your consent, we will obtain it.

We encourage you to review this policy periodically. Previous versions are available on request.

Contact

For privacy or data-protection inquiries — including access, correction, deletion, export, or objection requests, requests for a data processing addendum, and requests for the current subprocessor list — contact DataTether Inc. at [email protected] with "Privacy request" in the subject line.

You may also use the guided access form and include "Privacy request" in your note so the request can be routed appropriately, though email is the faster route for rights requests.

We aim to acknowledge privacy inquiries within five business days and to respond substantively within 30 days. Security vulnerabilities should be reported through the security contact channel so they can be triaged more quickly.