Privacy Policy

Who we are

Finbolt is run by Finbolt, which is responsible for your personal information under this policy. Contact: support@finboltmcp.com.

What we collect

• Account: your email address and the date you signed up. If an AI agent signs up for you, it sends us your email address and we treat you as the account holder.
• API keys: a one-way hash of each key and its first few characters. We can't recover a full key after it's shown to you.
• Usage: how many requests each key makes per day and when it was last used, to enforce plan limits.
• Billing: if you upgrade, your Stripe customer and subscription IDs and subscription status. Card details go straight to Stripe; we never see or store them.
• Sign-in sessions: one-time sign-in links (valid for 15 minutes) and a session token when you sign in to the dashboard. Sessions last up to 30 days, and your browser keeps the token in local storage until you sign out.
• Requests: the tool calls you make (for example a ticker symbol) are processed to answer you and are not stored with your account. Your IP address is held briefly in memory to rate-limit signups. Our hosting providers keep standard server logs, which can include IP addresses, request times and errors.
• Website analytics: the website uses Vercel Web Analytics to count page views. It sets no cookies. For each page view it records the page address, the referring site, approximate location (country, region and city), browser, operating system and device type. Visitors are counted using a hash of the request that is discarded after 24 hours, and the results are used only in aggregate. IP addresses are not stored. The API and MCP server don't use analytics.

The website doesn't use cookies for tracking, or any advertising trackers. The only analytics are the cookieless page counts described above.

Why we use it

• to run your account, authenticate requests and enforce plan limits (needed to provide the Service you signed up for);
• to bill you for paid plans and keep tax records (contract and legal obligation);
• to send sign-in links and important service or billing emails (contract);
• to keep the Service secure, prevent abuse and fix problems (our legitimate interest in running a safe service);
• to understand which pages of the website are used, from aggregate page counts (our legitimate interest in improving the site).

We don't sell your personal information, share it for cross-context behavioral advertising, or use it for advertising. We don't send marketing emails unless you opt in.

Who processes it

• Supabase: database for accounts, key hashes and usage.
• Stripe: payments and subscriptions. Stripe also handles payment data under its own privacy policy.
• Resend: sign-in and account emails.
• Vercel: hosting for the website, and its page analytics.
• Render: hosting for the API and MCP server, including server logs.
• Market data providers: receive the query parameters needed to answer a tool call (such as a symbol), not your identity.

These providers may process data in the United States and other countries. Where the law requires it, transfers rely on safeguards such as the European Commission's standard contractual clauses. We may also disclose information if the law requires it, or to a buyer if the Service is sold, under this policy.

How long we keep it

We keep account and usage data while your account is open. Sign-in sessions expire and server logs are kept for a limited period by our hosting provider. Billing records are kept as long as tax and accounting law requires. When you ask us to delete your account, we delete your email, keys and usage records within 30 days, apart from records we must keep by law.

Security

Traffic is encrypted in transit, API keys are stored only as hashes, and access to our systems is limited. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

Your choices

You can ask for a copy of your data, a correction, or deletion of your account by emailing support@finboltmcp.com from the address on the account. We reply within 30 days. Depending on where you live, you may have further rights under laws such as the GDPR, UK GDPR or CCPA, including the right to object to processing based on legitimate interests. We won't treat you differently for using them. You can also complain to your local data protection authority.

Children

The Service is for adults. We don't knowingly collect data from anyone under 18; if you think we have, email us and we'll delete it.

Changes

We'll update the date at the top when this policy changes, and email account holders about material changes.