From af084133faa1f2be684f60439470d4ea955000af Mon Sep 17 00:00:00 2001 From: Garfield Date: Fri, 12 Jun 2026 12:12:46 -0400 Subject: [PATCH] legal: update privacy policy and terms for v1 consumer launch --- product/site/privacy.html | 142 +++++++++++++++++++++++--------------- product/site/terms.html | 20 +++--- 2 files changed, 94 insertions(+), 68 deletions(-) diff --git a/product/site/privacy.html b/product/site/privacy.html index 9656c98..23aa31d 100644 --- a/product/site/privacy.html +++ b/product/site/privacy.html @@ -6,7 +6,7 @@ Privacy Policy — SquareMCP @@ -28,94 +28,127 @@
Legal

Privacy Policy

-

Last updated May 5, 2026

+

Last updated June 12, 2026

Scope

- This Privacy Policy describes how SquareMCP collects, uses, and protects information - when you visit squaremcp.com, contact us, or participate in a SquareMCP pilot or - managed deployment. + This Privacy Policy describes how SquareMCP (operated by HERONS LLC) collects, uses, and + protects information when you use squaremcp.com, app.squaremcp.com, or the SquareMCP MCP + server at hermes.squaremcp.com. This includes when you connect SquareMCP to Claude, + ChatGPT, or other AI systems.

Information we collect

-

We may collect:

+

We collect:

    -
  • contact details such as your name, work email, company, and role
    • -
  • pilot intake details such as your use case, target systems, and security requirements
    • -
  • service and operational data needed to provision, secure, and support a deployment
    • -
  • communications you send to us by email or through the pilot intake form
    • +
  • Account information — your email address and password when you create a SquareMCP account at app.squaremcp.com.
    • +
  • Connected platform credentials — API keys, OAuth access tokens, app passwords, and account identifiers for platforms you choose to connect (Obsidian, email accounts, Facebook Pages, Instagram Business accounts, and others). These are stored encrypted and used only to execute the actions you request.
    • +
  • Request logs — records of tool calls made through SquareMCP, including which platform was called, timestamp, and outcome. We do not log the full content of emails, notes, or social media posts.
    • +
  • Communications — emails or messages you send to info@squaremcp.com or through the site contact form.
+
+

How AI systems interact with your data

+

+ SquareMCP acts as a bridge between AI systems (such as Claude by Anthropic and ChatGPT by + OpenAI) and your connected accounts. When you authorize SquareMCP from within an AI assistant: +

+
    +
  • The AI system sends requests to SquareMCP describing what action to perform (e.g., "search notes for topic X", "post to Facebook page").
    • +
  • SquareMCP uses your stored credentials to carry out the action on your behalf.
    • +
  • Results are returned to the AI system so it can respond to you.
    • +
+

+ SquareMCP does not train AI models on your data. SquareMCP does not share your connected + platform content or credentials with AI providers — the AI system sends instructions to + SquareMCP; SquareMCP sends results back to the AI system. What the AI provider does with + those results is governed by that provider's own privacy policy (Anthropic's for Claude; + OpenAI's for ChatGPT). +

+
+ +
+

Connected platforms and what we access

+

When you connect a platform, SquareMCP accesses only what is needed to perform the actions you request:

+
    +
  • Obsidian vault — note content, titles, and paths in your vault. SquareMCP can read, write, search, and append notes. Your vault is accessed via an API key you generate in your Obsidian configuration.
    • +
  • Email (Gmail, Yahoo, IMAP/SMTP) — inbox messages, message content, and the ability to send email from your configured accounts. SquareMCP connects via IMAP for reading and SMTP for sending using credentials you provide. We do not store email content beyond what is needed to respond to your current request.
    • +
  • Facebook Pages — your Facebook Business Page info, existing posts, and the ability to publish new posts and photos on your behalf. Access uses a Page access token you authorize via the Facebook Developer Console.
    • +
  • Instagram Business — your Instagram Business account profile, media, and the ability to publish photos and reels. Access is linked to your Facebook Page authorization.
    • +
  • Other platforms — LinkedIn, Twitter/X, TikTok, WhatsApp, Telegram, Discord, and Slack integrations follow the same principle: SquareMCP uses only the credentials and permissions you explicitly provide and performs only the actions you request.
    • +
+

+ You can disconnect any platform at any time from app.squaremcp.com. Disconnecting removes + stored credentials for that platform. +

+
+

How we use information

We use information to:

    -
  • review and respond to pilot requests
    • -
  • configure and operate SquareMCP deployments
    • -
  • authenticate access, troubleshoot issues, and maintain security controls
    • -
  • communicate about pilots, support, billing, and service changes
    • +
  • authenticate your account and authorize AI system access via OAuth
    • +
  • execute platform actions you request through connected AI assistants
    • +
  • maintain request logs for debugging, security, and operational purposes
    • +
  • communicate about your account, service changes, and support
-
-

Customer data and connected systems

-

- SquareMCP is designed to act as a managed MCP gateway for internal tools. Depending on - the deployment, customer data may remain in a customer-controlled environment or may be - processed in SquareMCP-managed infrastructure as part of the service. The exact data - path depends on the deployment architecture and connector configuration. -

-

- Pilot and production customers are responsible for evaluating which systems they choose - to connect and which tool permissions they enable for their users and agents. -

-
- -
-

Authentication credentials and tokens

-

- SquareMCP may process API keys, OAuth credentials, session metadata, audit records, and - related access-control data needed to operate the service. We use these credentials only - to authenticate approved integrations and support the configured deployment. -

-
-

Sharing

- We do not sell personal information. We may share information with infrastructure, - hosting, email, or support providers only to the extent reasonably necessary to run the - service, support customers, comply with law, or protect SquareMCP and its users. + We do not sell personal information. We do not share your connected platform content + or credentials with third parties except as required to operate the service (e.g., using + a cloud hosting provider). We may disclose information if required by law or to protect + the security of the service and its users.

-

Retention

+

OAuth and third-party authorization

- We retain information for as long as reasonably necessary to evaluate pilots, deliver - services, maintain records, and meet legal, operational, or security obligations. + SquareMCP uses OAuth 2.0 to authorize AI systems (Claude, ChatGPT) to access your + SquareMCP account. When you complete an OAuth flow from an AI assistant, you are granting + that AI system permission to call SquareMCP tools on your behalf. You can revoke this + access at any time by disconnecting the AI system from app.squaremcp.com. +

+

+ SquareMCP does not have access to your Anthropic or OpenAI account credentials. +

+
+ +
+

Data retention

+

+ Account data and connected platform credentials are retained as long as your account is + active. Request logs are retained for up to 90 days for operational and security purposes. + You may request deletion of your account and associated data at any time by emailing + info@squaremcp.com.

Security

- We use reasonable administrative, technical, and operational measures to protect - information. No system can guarantee absolute security, and you should not submit - information through the service unless you are comfortable with that risk profile. + Connected platform credentials are stored encrypted. We use HTTPS for all communications. + Webhook endpoints use HMAC signature validation. OAuth tokens are stored server-side and + not exposed to the browser. No system can guarantee absolute security.

-

Your choices

-

- You may contact us to request access, correction, or deletion of personal information we - hold about you, subject to legal and operational limits. -

+

Your rights and choices

+

You can:

+
    +
  • disconnect any connected platform at any time from app.squaremcp.com
    • +
  • revoke AI system OAuth access from app.squaremcp.com
    • +
  • request deletion of your account and data by emailing info@squaremcp.com
    • +
  • request a copy of data we hold about you
    • +
@@ -123,13 +156,10 @@

Questions about this Privacy Policy can be sent to info@squaremcp.com. +
+ HERONS LLC, 10704 NW 51 St, Coral Springs, FL 33076.

- -
- This page is a general website and pilot-stage privacy policy. It should be reviewed and - adapted if SquareMCP moves into broader commercial availability or regulated deployments. -
diff --git a/product/site/terms.html b/product/site/terms.html index 6ddfcd7..15bed1f 100644 --- a/product/site/terms.html +++ b/product/site/terms.html @@ -28,22 +28,23 @@
Legal

Terms of Service

-

Last updated May 5, 2026

+

Last updated June 12, 2026

Agreement

These Terms of Service govern your access to and use of SquareMCP, including the - squaremcp.com website, pilot engagements, managed deployments, and related support. - By using SquareMCP, you agree to these Terms. + squaremcp.com and app.squaremcp.com websites, the SquareMCP MCP server, and related + support. By using SquareMCP, you agree to these Terms.

Service description

- SquareMCP provides managed MCP infrastructure and related services for connecting AI - agents to customer-approved internal tools, systems, and data sources. + SquareMCP provides an MCP server and related services that connect AI assistants + (such as Claude and ChatGPT) to your personal and business accounts, including email, + social media platforms, and productivity tools like Obsidian.

@@ -60,8 +61,7 @@

Customer responsibilities

You are responsible for: