Skip to content

Deemwar MCP

Privacy policy

Deemwar MCP

Privacy policy

Last updated: 7 November 2026. Operated by Deemwar (deemwar.com).

Deemwar MCP turns a company's API and documentation into hosted MCP endpoints (<name>-mcp.deemwar.com), a command-line tool, a skill and a chat widget. This policy covers what passes through those services. It applies alongside the Deemwar privacy policy.

Who is who

  • Publisher: the company or person who connects their API to Deemwar MCP. They decide which operations are exposed and who may sign in.
  • End user: a person who connects an AI app (Claude, ChatGPT, Codex, Cursor and others) or the widget to a published endpoint and signs in.
  • For end-user data we act as a processor for the publisher. The publisher's own privacy policy governs the data held in their API.

What we collect

  • Account data (publishers): email address, organisation name, configuration of your project.
  • Sign-in data (end users): the user identifier, name and role returned by the publisher's login (for example the sub and name claims). We store short-lived access tokens and refresh sessions so the AI app stays signed in. Passwords entered on a sign-in page are passed to the publisher's login and are never stored.
  • Request metadata: time, endpoint, method or tool name, user identifier, role, result status and duration, used for security, rate limiting, billing and debugging.
  • Tool call contents: the arguments of a tool call and the publisher API's response pass through our servers to reach the API and the AI app. We do not store them beyond processing the request, and we do not log them.
  • Documentation: documents and URLs a publisher adds are processed into a searchable wiki and stored in our object storage.
  • Usage and billing: points used per category per day, purchases and balances.

What we do not do

  • We do not sell or rent personal data.
  • We do not use tool call contents, end-user data or publisher documents to train AI models.
  • We do not show advertising.

Service providers

CloudflareDNS, TLS and network edge for all hostnames.
HetznerServers and database in Germany.
S3-compatible object storageProcessed documentation.
OpenRouterOnly when the chat widget or document answers use our AI key: the question and the relevant context are sent to the selected model. Publishers can use their own key instead.
Razorpay (via licenseapi.deemwar.com)Payments for points. We never see card details.

Retention

  • Sign-in sessions end when they expire, when the user signs out, or when the publisher revokes them.
  • Request metadata is kept for up to 90 days.
  • Project data and documentation are kept while the project exists and deleted within 30 days of the publisher deleting it.
  • Billing records are kept as required by law.

Security

All traffic uses HTTPS. Secrets supplied by publishers (signing keys, client secrets, API keys) are encrypted at rest. Access to production systems is restricted to Deemwar staff.

Your choices and rights

  • End users can disconnect at any time from their AI app, and ask the publisher to revoke access.
  • You can ask us to access, correct or delete personal data we hold: write to [email protected]. Requests about data inside a publisher's own API go to that publisher.

Changes

We will update the date above when this policy changes, and notify publishers by email of material changes.