Legal
Clinamen Privacy Policy
Draft. Not yet reviewed by a lawyer. Highlighted fields are filled in before launch; until then this page is a preview of the terms, not the agreement.
Last updated: {{EFFECTIVE_DATE}}
{{COMPANY}} ("we", "us") runs https://clinamen.dev, the Clinamen registry, downloads and the hosted MCP server. This policy says what personal data we collect, why, how long we keep it, who else handles it, and your rights. We collect as little as we can to sell and run the product.
What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Name and email address | Our payment provider ({{PAYMENT_PROVIDER}}) sends them to us when you buy | To identify your licence, send receipts-related and licence emails, and answer support |
| Order details (product, plan, seats, order and subscription status, country) | Payment provider | To know what you bought and what your key unlocks |
| Licence key activations (key, the instance name you or your tool give each activation, activation time) | You, when you activate a key | To enforce seat limits and let you see and free your seats |
| MCP request counts (per key, per day: number of requests, which tools were called, errors) | Our MCP server | To enforce usage limits, show your usage dashboard and keep the service healthy |
| Technical logs (IP address, user agent, timestamps, request path) | Our servers and host | Security, abuse prevention and debugging |
| Support messages | You, by email | To help you |
| Website analytics | Plausible Analytics | Aggregate page views and referrers |
Analytics without cookies. We use Plausible, which does not use cookies, does not track you across sites and does not store personal data. It counts visits using a daily-rotating, anonymised hash. That is why we have no cookie banner. The site sets no tracking cookies; a login session cookie is set only if you sign in to the dashboard.
What we do not collect
- Card or bank details. The payment provider handles payment; we never see your full card number.
- The contents of your codebase. Our MCP server receives the queries and snippets your agent sends it (for example a search term or a snippet for
check_laws) and answers them; we do not keep the snippet contents beyond the request, except in short-lived error logs. - Advertising identifiers, cross-site tracking, or data bought from brokers.
We do not use your data to train AI models.
How long we keep it
| Data | Kept for |
|---|---|
| Name, email, order details | As long as your licence is active, then {{ORDER_RETENTION}} (tax and accounting law) |
| Licence activations | Until you deactivate them or your licence ends, then 12 months |
| MCP request counts | 13 months, then aggregated with no key attached |
| Technical logs | {{LOG_RETENTION}} (target 30 days) |
| Support email | 2 years after the conversation ends |
Who processes it for us
| Processor | What they do | Data they handle |
|---|---|---|
| {{PAYMENT_PROVIDER}} | Checkout, payments, tax, invoices, licence keys (merchant of record) | Name, email, billing address, payment details, order |
| {{HOST_PROVIDER}} (website, registry Worker, MCP server, key cache) | Hosting | Technical logs, licence and usage records |
| Plausible Analytics | Cookieless site analytics | No personal data |
| {{EMAIL_PROVIDER}} | Support and transactional email | Name, email, messages |
| {{ERROR_MONITORING}} | Error monitoring for the registry and MCP server | Technical logs (scrubbed of keys) |
As merchant of record, the payment provider is also an independent controller of the payment data it collects; its own privacy policy applies to that. Some processors are in the United States. Where the law requires, transfers rely on standard contractual clauses or an equivalent safeguard.
We do not sell your data
We do not sell or rent personal data, and we do not "share" it for cross-context behavioural advertising as the California Consumer Privacy Act uses that term.
Your rights
Wherever you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy,
- correct it,
- delete it (we will keep only what tax law makes us keep),
- stop processing it for a purpose you object to,
- send it to you in a portable format.
If you are in the EU, UK or EEA (GDPR) our legal bases are: performing our contract with you (licence, keys, MCP service), legal obligation (tax records), and legitimate interests (security, abuse prevention, aggregate analytics). You can complain to your local data protection authority.
If you are in California (CCPA/CPRA) you have the rights to know, delete, correct and opt out of sale or sharing (we do neither), and we will not treat you differently for using them.
To use any of these rights, email {{PRIVACY_EMAIL}} (or [email protected]). We answer within 30 days and may need to confirm you own the email address on the licence.
Security
Licence keys are stored hashed where we can, traffic is encrypted (HTTPS), and access to our systems is limited to the people running the product. If a breach affects your data we will tell you as the law requires.
Children
The Service is for developers and businesses, not for children under 16. We do not knowingly collect their data.
Changes
We will post changes here with a new date, and email customers about material changes.
Contact
{{COMPANY}} · {{COMPANY_ADDRESS}} · {{PRIVACY_EMAIL}}
Signature licence Core licence Licence FAQ Terms of service Refund policy