PPrivacy MCP

Terms of service

The agreement that governs your use of the service.

Tip: use your browser's Print command and choose “Save as PDF” to download a copy.

DRAFT. This is a starting template and has not been reviewed by a lawyer. Placeholders appear in [square brackets]. Have qualified counsel review and adapt it before you publish it or rely on it.

Last updated: October 2026

These Terms of Service ("Terms") are an agreement between privacymcp.ai ("we", "us") and the company or organization you represent ("Customer", "you"). They govern your access to and use of Privacy MCP (the "Service"). By creating an account, connecting an AI assistant, or otherwise using the Service, you agree to these Terms. If you accept on behalf of an organization, you confirm you have authority to bind it.

1. The Service

Privacy MCP lets an AI assistant that you choose access your OneTrust tenant, using an API client that you create and provide. The Service relays requests and responses between your AI assistant and the OneTrust API and applies the access controls, limits and logging described in our Security Controls document.

We are an independent service. We are not affiliated with, endorsed by, or sponsored by OneTrust, Anthropic, OpenAI, Google or any other third party. Their names and marks belong to their owners and are used only to describe compatibility.

2. Accounts and organizations

  • You must provide accurate information and keep your sign-in credentials secure. You are responsible for all activity under your account and organization.
  • You must be at least 18 and able to form a binding contract.
  • Each organization can include up to 6 people (the person who set it up and up to 5 invited teammates), with up to 2 admins, unless your plan says otherwise. Pending invitations count toward these limits.
  • Each organization has one or more admins, who can manage OneTrust credentials, invite and remove members, set members' access (including read-only), and manage billing and deletion. You are responsible for who you make an admin or member and for removing people who should no longer have access.

3. Your OneTrust access and credentials

  • You must have the right to access the OneTrust tenant you connect and to use its API, under your agreement with OneTrust. You are solely responsible for complying with that agreement.
  • You grant us permission to store the credentials you provide (encrypted) and to use them only to make the requests your AI assistant initiates through the Service.
  • Whatever permissions you give the OneTrust API client define the maximum access the Service can have. We strongly recommend a dedicated, least-privilege client and, where possible, read-only mode.
  • You are responsible for the actions taken through your connection, including actions an AI assistant takes on your behalf.

4. Third-party services and AI assistants

The Service works with services we do not control, including OneTrust and the AI assistant you connect. Data you or your assistant retrieve through the Service is sent to your assistant's provider and is governed by your agreement with that provider. We are not responsible for third-party services, their availability, their outputs, or their handling of your data.

OneTrust rate limits and availability. OneTrust applies its own API rate limits and may change or interrupt its API. These can affect the speed, completeness or availability of results in your AI assistant independently of the Service. We are not responsible for delays, errors or failures caused by OneTrust or by other third parties.

5. AI outputs

AI assistants can produce incorrect, incomplete or misleading output and can take unintended actions. You are responsible for reviewing outputs and for approving any action before it changes your data. The Service does not provide legal advice, and nothing in the Service or its outputs is legal, compliance or regulatory advice. You are responsible for your own compliance decisions.

6. Free trial

A free trial includes 25 calls in total. Calls are not renewed each month. When they are used, the Service stops processing calls for that organization until you subscribe. We may modify or end the trial, and we may limit trials to prevent abuse (for example, repeated trial sign-ups).

7. Subscriptions, fees and billing

  • Paid plans are billed in advance on a recurring basis through our payment processor, Stripe. You authorize us and Stripe to charge your payment method for the plan you choose, applicable taxes, and any other amounts you agree to.
  • Subscriptions renew automatically until cancelled. You can cancel at any time from the billing portal; cancellation takes effect at the end of the current billing period unless stated otherwise.
  • Refunds: [Fees are non-refundable except where required by law / describe your refund policy].
  • If a payment fails, we may suspend or restrict the Service until payment is made. Access resumes automatically once your subscription is active again.
  • We may change prices on [30] days' notice. Changes apply from your next renewal.
  • Fees exclude taxes, which you are responsible for.

8. Acceptable use

You will not, and will not allow others to:

  1. use the Service unlawfully or to violate anyone's rights;
  2. access OneTrust data you are not authorized to access, or share credentials you do not have the right to share;
  3. attempt to breach or bypass security, isolation, limits or read-only restrictions, or probe the Service for vulnerabilities except under our vulnerability reporting process;
  4. overload or disrupt the Service, or send traffic intended to harm it;
  5. resell or provide the Service to third parties as a competing service without our written agreement;
  6. reverse engineer the Service except as the law allows; or
  7. use the Service to build a competing product.

We may suspend access that we reasonably believe violates these Terms or threatens the Service or others.

9. Your data

  • You own your data, including your OneTrust data and the content you send through the Service. We claim no ownership of it.
  • We process your data only to provide the Service, secure it, support you, meet legal obligations, and as described in our Privacy Policy [link] and Security Controls. We do not sell your data and we do not use it to train AI models.
  • We do not store the contents of OneTrust records that pass through the Service; we keep audit metadata and usage counts as described in the Security Controls.
  • Export: organization admins can export the organization's audit log (CSV or JSON) from the dashboard at any time.
  • Deletion: you may delete your organization at any time. Deletion is immediate and permanent and removes stored credentials, access tokens, members, usage records and the audit log, and cancels the subscription. We cannot recover deleted data.
  • If you need a data processing agreement, contact hello@privacymcp.ai.

10. Security

We maintain the safeguards described in our Security Controls document. No system is perfectly secure, and we do not guarantee that the Service will be free from unauthorized access. You will promptly tell us of any suspected compromise of your account or credentials.

11. Availability and support

We aim for reliable service but do not guarantee uninterrupted or error-free operation. We may perform maintenance and may change or discontinue features. [Support is provided by email at hello@privacymcp.ai on business days / describe any service levels.]

12. Intellectual property

We and our licensors own the Service, including its software, design and documentation. We grant you a limited, non-exclusive, non-transferable, revocable right to use the Service during your subscription, for your internal business purposes, under these Terms. If you give us feedback, you grant us a free, perpetual right to use it to improve the Service.

13. Confidentiality

Each party will protect the other's non-public information that is marked or reasonably understood to be confidential, use it only for the purposes of these Terms, and disclose it only to those who need it and are bound to confidentiality, or as required by law. This does not apply to information that is public, independently developed, or lawfully received from someone else.

14. Disclaimers

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTY ABOUT THE ACCURACY OR COMPLETENESS OF AI OUTPUT OR THIRD-PARTY DATA. WE DO NOT WARRANT THAT THE SERVICE WILL MEET YOUR REQUIREMENTS OR THAT IT WILL BE UNINTERRUPTED, TIMELY, SECURE OR ERROR-FREE.

15. Limitation of liability

TO THE FULLEST EXTENT PERMITTED BY LAW: (A) NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL; AND (B) OUR TOTAL LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE WILL NOT EXCEED THE AMOUNT YOU PAID US FOR THE SERVICE IN THE [TWELVE (12)] MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM [OR $100 IF YOU HAVE NOT PAID]. THESE LIMITS APPLY TO ALL THEORIES OF LIABILITY, EXCEPT LIABILITY THAT CANNOT BE LIMITED BY LAW. [Counsel: consider carve-outs for confidentiality breach, indemnity and data-protection obligations.]

16. Indemnification

You will defend and indemnify us against third-party claims, and resulting losses and reasonable costs, arising from (a) your use of the Service in breach of these Terms, (b) your data or the credentials you provide, including a claim that you lacked the right to provide them, or (c) actions taken through your connection. [Counsel: consider whether to offer a reciprocal IP indemnity.]

17. Term and termination

These Terms last as long as you use the Service. You may stop at any time by deleting your organization. We may suspend or terminate your access for a material breach that you do not cure within [10] days of notice, immediately for conduct that threatens the Service or others, or for non-payment. We may also end the Service on [90] days' notice, with a prorated refund of any prepaid fees for the period after shutdown. On termination, your right to use the Service ends and we will delete your data as described in section 9. Sections that by their nature should survive will survive, including sections 3 (your responsibility for credentials), 9, 12 to 16 and 19.

18. Changes to these Terms

We may update these Terms. For material changes we will give notice by email or in the Service at least [30] days in advance. If you keep using the Service after the effective date, you accept the updated Terms. If you do not agree, you may cancel before then.

19. General

  • Governing law and disputes: these Terms are governed by the laws of the State of Georgia, USA, without regard to conflict-of-law rules. Disputes will be resolved in the courts of [venue], and each party consents to their jurisdiction. [Counsel: decide on arbitration, class-action waiver and jurisdiction for non-US customers.]
  • Entire agreement: these Terms (with the documents they reference) are the entire agreement on this subject and override earlier agreements.
  • Assignment: you may not assign these Terms without our consent. We may assign them in a merger or sale of the business.
  • Severability and waiver: if a provision is unenforceable, the rest remains in effect. Failing to enforce a provision is not a waiver.
  • Force majeure: neither party is liable for delays caused by events beyond its reasonable control, including outages of internet, hosting or third-party services.
  • Notices: we may send notices to the email on your account. Send notices to us at hello@privacymcp.ai.
  • Export and sanctions: you will comply with applicable export-control and sanctions laws.

20. Contact

privacymcp.ai — hello@privacymcp.ai