Privacy Policy

MCP Hub is a self-hosted tool that connects accounts you already own — Gmail inboxes and a Pipedrive workspace — to an AI assistant (Claude) over the Model Context Protocol. This page describes exactly what it does with data.

What it accesses

Only accounts you explicitly connect, and only with the permissions you tick at the moment you connect them:

• Gmail — search and read messages; send messages and create drafts; change labels (archive, mark as read, move to trash); permanently delete. Each of these is a separate permission and is refused unless granted.
• Pipedrive — read deals, leads, persons, organizations and notes; create and update leads, persons, organizations and notes. Read and write are separate permissions.

What it stores

• The email address you sign in with, which identifies you as the owner of the accounts you connect.
• For each connected account: the alias you chose, the account's address or identity, the permissions granted, and the credential itself — a Google refresh token or a Pipedrive API token — encrypted at rest.
• API tokens you create for MCP clients, stored only as a SHA-256 hash.
• Creation and last-used timestamps.

What it does not store

Message bodies, subjects, attachments, contacts and CRM records are never written to this server's database. They are fetched from Google or Pipedrive at the moment a request is made, returned to the client that asked, and not retained afterwards.

Where the data goes

Data fetched from your accounts is returned only to the MCP client you authenticated — your own Claude session — and only in response to your own requests. Nothing is sold, shared with third parties, used for advertising, or used to train any model.

Google user data

This application's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Gmail data is used solely to provide the features you invoke, is not transferred to anyone except as needed to provide those features, is not used for advertising, and is not read by humans except as you direct.

Retention and deletion

• Remove a connected account from the dashboard and its stored credential is deleted immediately.
• Revoke an API token from the dashboard to cut off a client at once.
• You can independently revoke this app's access to your Google account at myaccount.google.com/permissions, or delete its API token in Pipedrive.

Security

Stored credentials are encrypted with Fernet (AES-128-CBC with HMAC) using a key held only in the server's environment and never in the database. The MCP endpoint requires a bearer token on every request. Each signed-in user can see and use only their own connected accounts.

Contact

Access to this deployment is by invitation. For any question about your data, or to have it removed, contact the operator through the same channel by which you were given access.