Privacy policy SPEKTRUM MCP

1. What data we collect

The SPEKTRUM MCP is a server based on the Model Context Protocol that you connect to an AI assistant such as Claude, ChatGPT or Microsoft 365 Copilot. For this we process:

• Account data: Name of the organisation and of the persons with their own login (up to five per office), email address, password (hash only), booked plan and services, quota, term, time and version of your consent to the terms of use. On request, a key for interessenabwaegung.ch. For the full subscription, the Stripe customer and subscription identifiers.
• Assistant sign-in: The connection uses OAuth 2.0. We store the client identifier registered by the assistant (name, redirect address) and the access and refresh tokens.
• Call log: For each tool call: time, account, service, tool name, response time, error status and identifier of the assistant used. If a call fails we store the error message; it may contain parts of the input, such as an address or a parcel identifier (EGRID). In authority mode (on request) no error text is stored.
• Not stored: The inputs to the tools, the results and the content of your conversation with the assistant. The tools answer each request afresh and build no usage profiles.
• Generated files: Tools that deliver files (GIS export, building zone report, 3D model, reserve evaluation) place them under a random link. The files are deleted after seven days at the latest.
• Feedback: If you report an error through the tool rueckmeldung_geben, we store the tool name, the reported input, the description of the problem, the correct information and source, your account and the time.
• Server logs: The web server logs IP address, time and requested path. These logs serve troubleshooting and abuse prevention and are overwritten automatically.
• Forms and emails: Anyone requesting trial access or student access, or taking out a subscription, provides name, organisation and email address. We then send access credentials, confirmations and account notices by email.

2. What we use the data for

• Operating the access: Sign-in, checking entitlement and plan, assigning the tools per service.
• Quota and billing: Counting calls per office and month, monthly limit, invoicing through Stripe.
• Security and troubleshooting: Detecting overload and abuse, tracing failed calls, blocking accounts in case of violations.
• Improving the tools: Anonymised usage statistics (which tools how often, which error types) and handling of your feedback.
• Account information: Emails with access credentials, about changes to the terms of use, the expiry of a trial or a cancellation. No advertising without your consent.

We do not use your data to train AI models and create no profiles of persons or parcels.

3. Who receives the data

We share data only as far as needed to run the service and never sell it. Recipients are:

• Hetzner Online GmbH, Falkenstein (Germany): Hosting of the gateway and the services. Encrypted backups are kept for 30 daily states.
• Stripe Payments Europe Ltd., Dublin: Processing of the full subscription. Payment data are held by Stripe only; we receive email address, customer number and subscription status. Stripe's privacy policy applies.
• Brevo (Sendinblue SAS, Paris): Sending of account emails. Name, email address and the message content are transmitted.
• Official geoservices and court databases: The tools query services of the Confederation (swisstopo, geo.admin.ch, PLR cadastre, Federal Statistical Office, Fedlex) and of the cantons, as well as court databases (e.g. entscheidsuche.ch). Only the information needed for the query is sent there, such as coordinates, an address or a search term.
• interessenabwaegung.ch (own service of SPEKTRUM Partner GmbH): The tools for the weighing of interests and EIA screening create cases and uploaded documents in your account at interessenabwaegung.ch. That service's privacy policy applies.
• Your AI provider: What you write or upload in the chat and what the tools answer is processed by your AI provider (e.g. Anthropic, OpenAI, Microsoft) under its terms. The SPEKTRUM MCP receives only the individual tool calls.
• Anthropic (connector directory): For inclusion in the Claude connector directory, Anthropic reviews the server with a test account we provide. No customer data are shared for this.

Public authorities can request an authority mode (log without error text, tools that forward to interessenabwaegung.ch disabled) and receive a data processing agreement on request.

4. How long we keep the data

• Account data: For the duration of the access. After expiry, cancellation or deletion of the account we delete them within twelve months, earlier on request.
• Call log: Month by month for billing. After the contract ends we delete the log entries together with the account within twelve months; on request we delete them immediately.
• Tokens: Access tokens expire automatically after a short time, refresh tokens after 30 days; when an account is blocked all tokens are revoked.
• Generated files: Seven days, then automatic deletion.
• Feedback: Until the report is resolved, at most twelve months.
• Backups: 30 daily states, encrypted; older states are removed automatically.

5. Your rights and contact

You may at any time request information about the data stored about you, its rectification, portability or deletion, and withdraw a consent you have given. Persons in the EU additionally have the rights under Art. 15 to 21 GDPR. Complaints can be lodged with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Contact: SPEKTRUM Partner GmbH, Josefstrasse 182, 8005 Zurich, Switzerland, andreas.rupf@spekt.ch (privacy SPEKTRUM MCP) or info@spekt.ch. We usually reply within ten working days.

6. Security

All connections are encrypted with TLS. Passwords are stored as hashes only, the services are reachable from outside only through the gateway, backups are encrypted. Only the operator has access to the data.

7. Changes

We update this policy when the service changes. The current version is at lab.spekt.ch/en/mcp/datenschutz; the terms of use at spekt.ch/agb-mcp, the general privacy policy of SPEKTRUM Partner GmbH at spekt.ch/impressum.