Effective 12 November 2026
Privacy Policy
Effective 12 November 2026. This policy describes how Cygnix Labs handles personal data for the Cygnix SEO MCP service at mcp.cygnixlabs.com.
Operator: Cygnix Labs, Block 6, Street 106, Building 152, Hawalli, Kuwait (“Cygnix”, “we”, “us”). Contact: info@cygnixlabs.com. This policy applies to mcp.cygnixlabs.com and the hosted Cygnix SEO MCP service (the “Service”).
1. What we collect
- Account data: the email address you give us when you sign up, your plan, account status, and when your account and keys were created and last used.
- API keys: stored only as one-way SHA-256 hashes, plus the first 12 characters for display. We cannot recover a lost key; you rotate or create a new one instead.
- Usage metering: the number of successful tool calls per key per month, and short-lived per-minute counters, used only for quotas, rate limits and billing.
- Client name hint: the name your AI app reports when it connects (for example
openai-mcporclaude-ai) and the name an app registers for sign-in. We keep the latest one per key or connected app so we can show messages that fit that app (for example, no prices inside ChatGPT). The browser or app user-agent is read per request and is not stored. - Tool inputs and outputs: processed in memory to produce your result and not stored. The only exception is a white-label PDF report you deliberately create on the Agency plan, which we store for 30 days so the private download link works.
- Google Search Console (optional): only if you choose to connect Google. We store an OAuth refresh token encrypted with AES-256-GCM and the granted scope (
https://www.googleapis.com/auth/webmasters.readonly). Search Console data (queries, pages, inspection results and similar) is fetched when you run a tool, used to produce that tool’s result, and not retained after the response is returned. See Google user data below. - Agency branding: if you are on the Agency plan, the agency name, logo URL, colours, website and footer text you provide for PDF reports.
- Billing: when you pay with PayPal, we keep an order record (order reference, plan, amount in USD, 30-day period, status and dates) and any payment reference you submit so we can match and activate your plan. We never see or store your PayPal password or card number. PayPal processes the payment under its own policy.
- Technical data: our hosting provider processes IP addresses and request metadata to serve and secure the Service. We use IP addresses to rate-limit sign-ups and payment-reference submissions.
- Public pages you ask us to check: tools such as on-page audits, AEO checks and Core Web Vitals fetch the public URLs you supply. Core Web Vitals may send the URL to Google’s PageSpeed Insights API. Requests identify themselves as a Cygnix SEO MCP user agent.
We do not use cookies or third-party analytics trackers on mcp.cygnixlabs.com.
2. How we use it
We use this data to provide, secure and support the Service, to enforce plan limits, to process prepaid payments and activate plans, to answer support and billing requests, to send essential service emails (for example about your account or a material policy change), and to prevent abuse. We process account data because you asked us to provide the Service (your agreement to these terms and, where applicable, our legitimate interest in operating a secure commercial service).
3. We do not sell data, serve ads, or train AI models
We do not sell personal data. We do not use personal data, tool inputs or outputs, or Google user data for advertising or profiling. We do not use your inputs, outputs, account data or Google Search Console data to train AI models — ours or anyone else’s.
4. Google user data (Limited Use)
Cygnix’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Scope. We request only the read-only Search Console scope
https://www.googleapis.com/auth/webmasters.readonly. We cannot change your sites, sitemaps or Search Console settings through this Service. - Purpose. We use Google user data solely to provide the user-facing Search Console features you call in the Service (for example listing properties, performance reports, period comparison, quick wins, cannibalization, URL inspection and sitemap status). We do not use it for any other purpose.
- Storage. The OAuth refresh token is stored encrypted with AES-256-GCM under a server-side key. Access tokens are short-lived. Search Console data itself is processed transiently to produce a tool result and is not stored, logged as content, or used to build profiles.
- Sharing. We do not transfer Google user data to others except as needed to provide those features (for example, returning a report to the AI client you connected), to comply with law, or as part of a merger or acquisition with notice, and never for advertising.
- Human access. We do not allow humans to read Google user data unless you ask us to for support, it is necessary for security or to investigate abuse, or we are required to by law. In ordinary operation, no person at Cygnix reads your Search Console data.
- Revoke and disconnect. You can disconnect at any time with the
gsc_disconnecttool, the Disconnect button on your account page, or by removing Cygnix’s access at myaccount.google.com/permissions. Disconnecting deletes the stored Google token from our systems. - Deletion on request. Email info@cygnixlabs.com from your account email and we will delete your Google token and other personal data as described in section 9. You can also revoke keys yourself on the account page.
5. Subprocessors
We share data only with processors that help us run the Service:
| Recipient | Why | What |
|---|---|---|
| host.pk | Hosting the application and database | Service data needed to operate the hosted MCP (accounts, hashed keys, usage counters, encrypted Google tokens, order records) |
| Only if you connect Search Console, and when a tool calls PageSpeed Insights | OAuth token exchange and the Search Console API calls you request; the public URL you ask us to measure for Core Web Vitals | |
| PayPal | Prepaid plan payments | What you provide to PayPal at checkout; we receive confirmation, amounts and references needed to activate your plan |
Each of those parties handles data under its own terms and privacy policy. We disclose data when the law requires it. If we later enable another payment method, we will name it here and at checkout before you pay.
6. AI apps you connect
When you use the Service through Claude, ChatGPT, Cursor, VS Code or another client, that provider’s privacy policy covers what you send to it. Tool results we return are visible to that app. Connecting an app uses our own OAuth bridge: we issue tokens bound to your Cygnix API key; we do not receive your Claude or ChatGPT password.
7. Retention
| Data | Kept for |
|---|---|
| Account and prepaid order / billing records | While your account is active, then as long as needed for legal, tax and accounting obligations |
| Usage counters | Up to 24 months |
| Rate-limit windows | About 1 day |
| Our OAuth codes, access tokens and refresh tokens (Cygnix connector sign-in) | 10 minutes / 24 hours / 90 days, or until revoked |
| Google refresh token | Until you disconnect, the token is revoked, or your account is deleted |
| Google Search Console tool results | Not retained (transient processing only) |
| Agency PDF reports | 30 days |
| Client name hint | Until replaced by a later connection, or account deletion |
| Revoked API-key hashes | Kept so a revoked key cannot be reused |
8. Security
We use TLS for traffic, one-way hashes for API keys, AES-256-GCM for Google refresh tokens, unguessable order and report links, and the least Google scope we need (read-only). No system is perfectly secure. Report a security issue to info@cygnixlabs.com.
9. Your choices and rights
You can access, correct, export or delete your data, or object to processing, by emailing info@cygnixlabs.com from your account email. We will complete a deletion request without undue delay, except for records we must keep for law (for example prepaid billing records) and hashed revoked keys kept only to prevent reuse. You can revoke keys and disconnect Google yourself on your account page.
Depending on where you live, you may have further rights under applicable law (for example the EU/UK GDPR or California CCPA/CPRA). You may also have the right to complain to a competent data-protection authority.
10. International transfers
The Service is hosted by host.pk. Google and PayPal may process data in the United States and other countries. That means your data may be processed outside your country of residence. Where a transfer requires a safeguard (for example Standard Contractual Clauses), we rely on the mechanisms those providers offer and on our agreement with you to provide the Service.
11. Children
The Service is for businesses and professionals. It is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, email info@cygnixlabs.com and we will delete it.
12. Changes
We will post updates to this page and change the effective date. If a change is material, we will also email the address on the account. Continued use after the effective date of an update means you accept the revised policy, except where the law requires us to ask for consent.
13. Contact
Cygnix Labs, Block 6, Street 106, Building 152, Hawalli, Kuwait.
Privacy and data requests: info@cygnixlabs.com.