Privacy Policy

MCP Index Ltd. ("we", "us", "our") operates MCP Index(the "Service") and is the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

Registered address: Add your registered company address here

Privacy contact / Data Protection queries: [email protected]

• Account data: name, email address, hashed password, or OAuth (Google) profile info if you sign in with Google.
• Listing data: information you submit about a tool, including photos and location details.
• Payment data: when you purchase a featured placement, payment card details are collected and processed directly by Stripe, Inc. (Stripe). We never see or store your full card number - we only receive transaction metadata (amount, status, subscription ID, billing country).
• Usage data: pages visited, browser type, device information, IP address, collected via strictly necessary cookies and, where you consent, analytics cookies (see our Cookie Policy).
• Communications: messages you send us via the contact form or email.

• Contract - to create your account, publish your listing, and process featured-placement subscriptions (Art. 6(1)(b) GDPR).
• Consent - for analytics/marketing cookies and marketing emails, which you can withdraw at any time (Art. 6(1)(a) GDPR).
• Legitimate interest - to keep the Service secure, prevent fraud, and improve our directory (Art. 6(1)(f) GDPR).
• Legal obligation - to keep financial/invoicing records (typically 7 years) as required by tax law (Art. 6(1)(c) GDPR).

Featured placement payments are handled entirely by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. When you subscribe, you are asked to give explicit consentto have your billing details (name, email, country, card details) shared with Stripe for the sole purpose of processing your payment, detecting fraud, and calculating applicable VAT. Stripe acts as an independent data controller for this data - see Stripe's Privacy Policy.

Where Stripe processes data outside the EEA, transfers are covered by Stripe's Standard Contractual Clauses (SCCs) as an appropriate safeguard under Art. 46 GDPR.

We use strictly necessary cookies (login sessions, security, payment) at all times, and analytics/marketing cookies only with your consent, collected via the cookie banner shown on your first visit. See our full Cookie Policy for the full list of cookies and how to change your preferences at any time.

We keep account and listing data for as long as your account is active. Payment and invoicing records are kept for 7 years to comply with tax obligations. You may request earlier deletion of your account data, subject to legal retention requirements (see "Your Rights" below).

If you are located in the EU/EEA or UK, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten"), subject to legal retention needs
• Restrict or object to certain processing
• Data portability - receive your data in a structured, machine-readable format
• Withdraw consent at any time (this does not affect processing carried out before withdrawal)
• Lodge a complaint with your local supervisory authority

To exercise any of these rights, email [email protected]. We will respond within one month as required by the GDPR.

Our primary infrastructure is located in European Union. Where we or our processors (e.g. Stripe, our hosting and email providers) transfer data outside the EEA, we rely on Standard Contractual Clauses or an equivalent adequacy mechanism.

We may update this Privacy Policy from time to time. Material changes will be notified via email or an in-app notice, and the "Last updated" date above will be revised.

Questions about this policy or your data? Email [email protected] or visit our contact page.