Deliverect MCP Connector Privacy Policy
Last updated: October 26, 2026 - Version 1.0
1. Scope
This policy explains how Deliverect NV ("Deliverect", "we"), a company incorporated under the laws of Belgium, with company number 0692.623.253, with registered office at Foreestelaan 82, 9000 Ghent, Belgium, handles Customer Data and Deliverect Data when you use the Deliverect MCP Connector (the "Connector"). The Connector lets an AI tool you choose ("AI Tool(s)"), such as Claude, read information from a Deliverect account you have access to.
This policy covers the Connector only. Your use of the Deliverect platform is covered by our main Privacy Notice and by your organisation's agreement with Deliverect. As regards to Customer Data, if this policy and that agreement conflict, the agreement prevails.
Deliverect Data (as defined below) and Customer Data (as defined below) are processed in connection with the Connector. The terms “Controller”, “Processor”, and “Personal Data”, have the meanings given in the EU General Data Protection Regulation (GDPR) and the UK GDPR.
This policy does not govern your AI Tool’s processing of Customer Data you make available through the Connector. Such processing is subject to your agreement with the relevant AI Tool and their privacy notice, and Deliverect is not responsible for it; we encourage you to review those documents before enabling the Connector.
2. Who is responsible for your data
Your organisation controls its account data. The restaurant, retail or other business that holds the Deliverect account (the "Customer") decides whether the Connector is enabled, which of its users may use it and which AI Tools receive its data. For account data (orders, menus, stores, sales and similar business data) (collectively "Customer Data"), the Customer is the Controller and Deliverect acts as its Processor.
Deliverect controls the data needed to run the Connector. Deliverect is the Controller of the signed-in user's login details and of the records we keep to operate, secure and audit the Connector, as listed in section 3 (collectively "Deliverect Data").
3. What the Connector receives and stores
The Connector processes only the data below.
| Category | What it contains | Why |
|---|---|---|
| AI Tool requests | What the AI Tool asks for: which account, store, order or date range to look up | To answer the request |
| Sign-in tokens | Access and refresh tokens issued when you sign in, linked to your Deliverect user | To confirm who you are and what you may access |
| Consent record | That you accepted the Connector terms, which version and when | To show that the terms were accepted |
| Technical logs | Time, the type of request and whether it succeeded, together with technical identifiers such as the Deliverect account or user ID. | To run, secure and troubleshoot the Connector |
Technical logs are designed not to record IP addresses, the content of tool requests or Customer Data. Exceptionally, where needed to investigate a specific technical issue, limited request content (such as an order note) may be logged for a limited period. Any Personal Data this captures is incidental, is not used for any other purposes, is accessible only to authorized personnel and is deleted in line with section 5.
What the Connector does not receive. It does not receive your conversation with the AI Tool, files you share with it, or data from other tools you connect to it.
What the Connector does not return. It does not return Personal Data of the Customer's end customers or couriers available in your Deliverect account, including data from Deliverect Dispatch (except for any Personal Data that an end customer chooses to include in the free-text order note).
4. How we use it
We use the Deliverect Data in section 3 only to sign you in, answer the requests your AI Tool sends, keep the Connector secure and keep a record of consent.
| Purpose | Legal basis |
|---|---|
| Signing you in and answering requests | Legitimate interest in providing the Connector that the Customer has enabled for its users (Art. 6(1)(f) GDPR) |
| Security, troubleshooting and abuse prevention | Legitimate interest in keeping the Deliverect platform and the Connector secure (Art. 6(1)(f) GDPR) |
| Keeping the consent record | Legitimate interest in being able to show the terms were accepted, and to establish, exercise, or defend a claim (Art. 6(1)(f) GDPR). |
We do not use Deliverect Data shared through the Connector to train AI models. We do not sell it or use it for advertising. We process Customer Data only on the Customer’s documented instructions. We do not use the Connector to make decisions about you based solely on automated processing that produce legal or similar effects.
5. How long we keep it
| Category | Retention |
|---|---|
| Tool requests | Not stored beyond answering the request (save for the limited logging described in section 3). |
| Sign-in tokens | Up to 30 days, or until you sign out or the Customer revokes access |
| Consent record | For the term of the Customer’s agreement with Deliverect and five (5) years after it ends, to cover applicable limitation periods |
| Technical logs | Up to 12 months. Logs are searchable for around 14 days, then kept in restricted archive storage until they are automatically deleted. |
When a retention period ends, we delete the data or make it anonymous.
6. AI Tools and other third parties
AI Tools are chosen by the Customer. An AI Tool connected to the Connector is an MCP Recipient under the Customer's responsibility, as set out in the Connector terms.
Disconnecting stops new access only. Removing the Connector stops further data from reaching the AI Tool. It does not delete data already shared with the AI Tool; to delete the data, use the AI Tool’s settings or contact its provider directly.
Service providers. We use service providers to run the Connector, including Auth0 (Okta) for sign-in, and Google for hosting. They act on our instructions under data processing terms. Please review our privacy notice for further information about our subprocessors.
International transfers. To the extent that Customer Data (containing Personal Data), is transferred outside the European Economic Area, such transfer shall be subject to an appropriate data transfer mechanism, including, where required, the applicable European Commission’s Standard Contractual Clauses or any other legally recognized transfer mechanism.
7. Security
All traffic to the Connector is encrypted in transit. The Connector only gives access to Customer Data the signed-in user can already see in the Deliverect account, and tokens are scoped to that user.
8. Your rights
You can request Deliverect to grant you access, correct or delete Deliverect Data, or to restrict or object to the processing of Deliverect Data, or to receive a copy of your Deliverect Data in our possession. Please submit a request by emailing security@deliverect.com.
If your request is related to Customer Data, we will pass it to the Customer, or you can contact them directly. You may also file a complaint, either related to Deliverect Data or Customer Data, with your local data protection authority.
9. Changes to this policy
We will update this policy when the Connector changes how it handles data. If a change affects the Connector terms, you will be asked to accept them again before you continue.
10. Contact
Privacy questions and requests: security@deliverect.com
Help with the Connector: integrations-support@deliverect.com