Legal
This policy explains data handling for the hosted MCP Beast console and gateway, self-hosted deployments, and the Mac app and its optional services.
Effective date: October 27, 2026
The hosted MCP Beast console and gateway are operated by Inspired by Frustration. For hosted-service privacy questions or deletion requests, contact [email protected]. The Mac app has separate operator and contact details below.
The hosted service processes account and organization data such as email addresses, profile information, organization membership, roles, and access settings. We also process contact information you provide when you email us or request a demo.
We store connection configuration and tool metadata needed to route and govern access, including server names and endpoints, connection settings, tool names, descriptions and schemas, and permission settings.
Hosted MCP Beast stores upstream OAuth client details and credentials, including API keys and access and refresh tokens. Secret credential values are encrypted server-side in a credential vault, scoped to the organization and, where applicable, the user. The hosted service uses these credentials to authenticate authorized upstream calls and refresh access when the provider permits it.
The hosted gateway processes tool inputs and results to route requests, apply access and approval policies, and return responses to your client. Connected MCP servers and upstream providers receive the data and authentication information needed for the calls you authorize. Third-party services handle that data under their own policies and terms. Your chosen AI clients may also process the inputs and results under their own policies.
Hosting, database, storage, security, and communications providers process information needed to operate the website and hosted service. Website and service requests can include IP addresses, user agents, requested URLs, timestamps, and security events. Cloud-run connections also process configuration and credentials in the hosted runtime used for that connection.
We store operational and audit records to operate the service, enforce access controls, investigate errors and security events, and support usage reviews. These records can include account and organization identifiers, connection and tool identifiers, request metadata, timestamps, outcomes, usage measurements, and error information. Records may also include tool arguments and request and response content. Some logging paths apply redaction and size limits, but these controls do not guarantee that all sensitive content is removed.
Retention varies by the type of data and the operational, security, and legal needs it serves. Deleting a connection, revoking an upstream OAuth grant, deleting an account, and making a deletion request are different actions. Revoking a grant does not by itself delete connection configuration, operational records, or backups, or erase data already processed by an upstream provider. Disconnecting a service does not guarantee immediate deletion of every related record or backup.
For a hosted-service access, correction, or deletion request, contact [email protected]. We can explain the data associated with your account and connection and any retention that applies. Upstream providers handle their own deletion requests.
In a self-hosted deployment, gateway credentials and configuration are stored in your own environment. The customer operating that environment controls its access and retention settings. Self-hosting does not make calls to selected external services local; those services still process the data sent to them. Any hosted MCP Beast features you separately use remain subject to the hosted-service disclosures above.
The Mac app is provided by SwiftLee B.V., A. Commandeurlaan 30, 1715AG, Spanbroek, The Netherlands. Mac-app privacy questions can be sent to [email protected].
The Mac app stores local connection settings, tool metadata, and gateway preferences on your Mac. Credentials managed locally by the Mac app are intended to be stored in macOS Keychain. This local storage description does not apply to credentials configured in the hosted console or gateway. Local app data remains on your device unless you remove it, reset the app, or delete related Keychain items.
The local gateway handles local MCP requests on your device. Optional LAN access lets devices with the gateway bearer token send requests. If you enable Remote Access, the relay processes MCP requests and responses, relay identifiers, bearer tokens, connection status, and operational metadata needed to provide and secure that service.
The Mac app may use RevenueCat and Apple services for subscriptions, purchases, restores, and entitlements. These providers process purchase identifiers, subscription status, and related transaction information under their own policies.
Access controls and encrypted credential storage help protect hosted connections, but no system is perfectly secure. Protect your accounts, devices, credentials, and configured MCP servers. Depending on where you live, you may have rights to access, correct, delete, or object to processing of personal data. Contact the relevant operator above to make a privacy request.
We may update this policy as MCP Beast evolves. Changes will be reflected by updating the effective date and, where appropriate, providing additional notice.