Last updated: April 2, 2026
FloMCP ("we", "us", "our") operates the FloMCP.com website and MCP server generation service. We are the data controller responsible for the personal data you provide to us.
Contact: privacy@flomcp.com
We do not collect payment card details directly. If and when paid plans are processed by a payment provider, that provider handles all card data under their own PCI-DSS compliant environment and privacy policy.
If you are located in the EEA, UK, or another jurisdiction with similar data protection laws, we process your personal data on the following legal bases:
We do not use your data for advertising, sell it to third parties, or use it for any purpose unrelated to providing the Service.
Your data is stored in Supabase (PostgreSQL) hosted on AWS infrastructure. We apply industry-standard encryption at rest and in transit (TLS 1.2+).
| Data type | Retention |
|---|---|
| Account data | Until account deletion + 30 days |
| Generated servers | Until you delete them or your account |
| Security / request logs | 90 days, then purged |
| Support messages | 3 years from last interaction |
| Anonymised analytics | Indefinitely (no personal data) |
We do not sell your personal data. We share the minimum necessary data with the following processors, each bound by data processing agreements:
We may disclose personal data if required by law, court order, or to protect the rights and safety of FloMCP, our users, or the public.
FloMCP is operated from India and uses infrastructure based in the United States (Supabase on AWS). If you are located in the EEA or UK, your personal data is transferred to countries that may not have equivalent data protection laws.
We rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum as the appropriate safeguard for these transfers where applicable. You may request a copy of the relevant safeguards by contacting us at privacy@flomcp.com.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us at privacy@flomcp.com. We will respond within 30 days (or as required by applicable law). We may ask you to verify your identity before processing your request.
We use a single session cookie for authentication (set by Supabase Auth). This cookie is strictly necessary for the Service to function and cannot be opted out of while using your account.
We do not use tracking cookies, advertising cookies, or third-party cookies. Vercel Analytics uses no cookies.
FloMCP is not directed at children. You must be at least 16 years old (or the applicable age of digital consent in your country) to create an account. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@flomcp.com and we will delete it promptly.
We implement industry-standard technical and organisational measures to protect your personal data, including TLS encryption in transit, encryption at rest, access controls, and regular security reviews. However, no internet transmission is completely secure and we cannot guarantee absolute security.
If you discover a security vulnerability, please disclose it responsibly to security@flomcp.com.
We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top and notify registered users by email at least 14 days before changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
For any privacy questions, data subject requests, or complaints:
If you are dissatisfied with our response, you may escalate to your national data protection authority.
Also see our Terms of Service, Acceptable Use Policy, and Refund Policy.