Privacy Policy: Ethora MCP Server

Dappros Ltd, trading as Ethora. Last updated 16 September 2026.

This policy covers the hosted Ethora MCP server at https://mcp.chat.ethora.com, which lets an AI assistant such as Claude, ChatGPT, Cursor or Claude Code create and manage Ethora chat applications on your behalf.

It does not cover the ethora.com website, which has its own privacy policy, and it does not cover Ethora deployments that you or your vendor run yourselves. If you connect an assistant to a self-hosted Ethora server, the operator of that server is responsible for its data handling, not us.

What connecting does

When you connect an assistant you either sign in to an existing Ethora account, create one through the connector, or supply an API key. From then on the assistant acts as you, with your permissions. It cannot see anything you could not see yourself.

What we collect

Your account. Email address, name, and a password stored only as a salted hash. If you sign in with Google, we receive the identity token and the email address in it, never your Google password.

Your connection. When your assistant registers as an OAuth client we store its name, the redirect URIs it declared, the scopes you approved, and which account approved them. Authorisation codes are stored briefly and deleted automatically ten minutes after issue. API keys are stored so they can be checked and revoked; the key value is shown once and is not retrievable afterwards.

Your session. The MCP server holds your session in memory only, for up to four hours of inactivity, and writes nothing about it to disk or to a database. Its operational log records when a session opens and closes and the IP address it came from.

What the assistant creates. Anything you ask the assistant to make is ordinary Ethora data: applications, chat rooms, messages, users you provision, AI agents and the sources you index. We hold it on the same terms as if you had created it in the web app.

Service logs. Each API call is recorded with the account and application it belongs to, the request path, the response status and timing, and the originating IP address, so that we can operate the service, investigate faults and detect abuse.

We do not use cookies, web analytics, session replay or advertising technology on this service. There is no web page to instrument.

Who else processes it

• Amazon Web Services - hosting for the service and its database, and file and document storage
• Cloudflare - network protection for our domains
• Postmark - transactional email such as address verification
• OpenAI - AI agent replies, retrieval-augmented answers and message translation

On AI processing, plainly. If you create an AI agent or use message translation on Ethora Cloud, the content involved is sent to OpenAI to generate the response. We do not have a zero-retention or no-training agreement with OpenAI, so their standard API terms apply. If that is not acceptable for your data, do not enable AI features on the hosted service. Run Ethora yourself and point it at a model you control, including a local one, so that nothing leaves your infrastructure. We would rather tell you this plainly than have you find out later.

We do not sell personal data, and we do not use your content to train our own models.

Where it is held

The hosted service runs on Amazon Web Services in the United States (region us-east-2, Ohio). If you need data to stay in the EU or UK, that is a dedicated deployment rather than this service, and we will discuss it with you before you commit. Transfers out of the UK or EEA rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses with the recipient.

How long we keep it

• OAuth authorisation codes - deleted automatically ten minutes after issue.
• API keys and refresh tokens - until they expire or you revoke them. API keys default to 90 days and may not exceed 365.
• MCP session state - held in memory for up to four hours of inactivity and never written down.
• Registered assistant connections - until you revoke them or close your account.
• Your account and the content you create - until you delete them. Deleting your account purges the account and its data.
• Service logs - 180 days, then deleted.

Your rights

You can ask us for a copy of your data, correct it, delete it, restrict or object to how it is used, or have it sent elsewhere. You can revoke a connected assistant or an API key at any time, which stops it working immediately, and you can delete your account and its data from the Ethora web app.

Two honest limits. Where you used the connector to act inside an application somebody else owns, we have to refer your request to them. And where a deployment writes to a compliance archive designed to be immutable, those records cannot be erased, because their purpose is to prove what happened.

Children

This service is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

Security

Traffic is encrypted in transit and data is encrypted at rest. Connections use OAuth 2.1 with PKCE, or a revocable API key. Access to production systems is restricted and authentication events are logged.

To be precise about one thing customers ask: by default we do not provide client-side end-to-end encryption in which we hold no key. An app owner can switch on end-to-end encrypted rooms for their app; in those rooms the message bodies and attachments are encrypted on your device and we hold no key to them, while sender, room and reply metadata still reach the server so notifications work. If you need a deployment where we cannot access any content at all, run Ethora yourself and we will talk you through it.

Changes

We will update this page when our practices change and revise the date above. For material changes affecting customers we will give notice by email before they take effect.

Contact

Questions, requests and complaints: contact@dappros.com. Dappros Ltd, trading as Ethora. You can also complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA.