Privacy Policy / Data Policy

1. Who we are

Service: Akashic / Akashic MCP — a hosted contextual database and MCP memory service for individuals and teams (memories, project rules, skills, documents, todos, and related tools).

Controller (account and service operations data): the operators of Akashic as presented on akashic-mcp.com (contact channels below). Formal registered entity name, postal address, and Data Protection Officer designation are pending counsel confirmation and will be updated when finalized.

Processor / service provider (Customer Content): for memories, documents, and other content you or your agents store through the Service (“Customer Content”), you (or your organization) typically determine the purposes and means of that content. Akashic processes Customer Content to provide, secure, and operate the Service under your instructions as expressed through the product (API, MCP tools, and admin UI).

2. Data we process

2.1 Account and authentication

• Identifiers such as email address, display name, and account identifiers.
• Authentication credentials or tokens (passwords hashed where applicable; OAuth tokens/session cookies for sign-in flows including Google OAuth where enabled).
• Security and session metadata needed to keep you signed in and detect abuse.

2.2 Customer Content

• Memory content and metadata you store via MCP or the admin interface (including project associations, tags, event types, and relationship graphs).
• Uploaded files and document metadata linked to memories.
• Project, sharing, and preference settings you configure.

Optional at-rest encryption of memory content may be available. When encryption is enabled, content is protected with per-user encryption material managed by the Service; disabling encryption (where the product allows it) is at your risk and may increase exposure if systems are compromised.

2.3 Usage, diagnostics, and support

• Technical logs (requests, errors, approximate timing, IP address, user agent) for security, reliability, and debugging.
• Application error monitoring via Sentry when configured in the deployment environment.
• Privacy or support requests you submit (for example through the authenticated privacy-request channel in the admin interface).

2.4 Cookies and similar technologies

Marketing and docs surfaces may use cookies classified as necessary, analytics, and marketing. On surfaces where the cookie consent mechanism (CMP) is installed (marketing pages, documentation, and the admin application), Google Analytics and/or Microsoft Clarity load only when analytics consent is granted (see the Cookie Policy). Necessary cookies include consent-preference storage and essential session/theme functions. Admin shares the same consent storage key and categories as marketing.

3. Purposes and legal bases (GDPR-informed framing)

Where the EU/UK GDPR or similar laws apply, we rely on the following bases as appropriate:

• Contract / steps prior to contract: creating and operating your account; providing MCP/API access; storing and retrieving Customer Content you request.
• Legitimate interests: securing the Service, preventing fraud/abuse, understanding aggregated product reliability, improving features in a privacy-respecting way, and defending legal claims — balanced against your rights.
• Consent: non-essential cookies/analytics/marketing technologies; optional communications where consent is required. You may withdraw consent without affecting prior lawful processing.
• Legal obligation: responding to lawful requests and retaining records where required.

4. Sharing and subprocessors (high level)

We do not sell personal information for monetary consideration. We share data with:

• Infrastructure and hosting providers that run compute, storage, networking, and related cloud or on-prem systems for the Service.
• Authentication providers when you choose OAuth/social sign-in (for example Google).
• Analytics providers (Google Analytics; Microsoft Clarity) when consent allows.
• Error monitoring (Sentry) when enabled.
• Professional advisors or authorities when required by law or to protect rights and safety.

Exact subprocessor identities, locations, and contractual terms are maintained operationally and should be confirmed in a Data Processing Addendum (DPA) for enterprise use. This draft does not invent a sealed subprocessor list.

5. International transfers

The Service may process and store data in jurisdictions other than your own, depending on where infrastructure is deployed (including Kubernetes/Docker-hosted environments operated for Akashic). Transfer safeguards (such as standard contractual clauses or other lawful mechanisms) will be documented with counsel for applicable regions. By using the Service you acknowledge that processing may occur internationally subject to those safeguards when required.

6. Retention

• Account data: retained while the account remains active and for a reasonable period afterward for security, dispute resolution, and legal compliance.
• Customer Content: retained until you delete it, until account closure processing completes, or as otherwise required for security/legal holds. Project backup export/restore features (where available) may create portable copies under your control.
• Logs and diagnostics: retained for operationally necessary periods (typically short-to-medium term) unless needed longer for investigations.
• Backups: infrastructure backups may persist for a limited window after deletion until rotated.

7. Security

We apply technical and organizational measures consistent with a production service (authentication gates, transport security, rate limiting, input validation, optional memory encryption, and operational hardening). No method of transmission or storage is completely secure; we do not warrant absolute security. You are responsible for protecting credentials, MCP tokens, and the sensitivity of Customer Content you choose to store.

8. Your rights

8.1 EEA / UK (and similar)

Subject to applicable law, you may have rights to access, rectification, erasure, restriction, objection, and data portability, and the right to lodge a complaint with a supervisory authority. Authenticated users may submit privacy requests through the admin Contact / privacy-request flow (request types include access, correction, deletion, complaint, and other). We may need to verify identity before acting.

8.2 California / CCPA-style notice

If you are a California resident, we describe categories of personal information collected (identifiers, internet/commercial activity related to Service use, and Customer Content you provide), purposes (Service provision, security, analytics with consent), and that we do not sell personal information for money. You may request to know, delete, or correct certain information, and to opt out of “sale”/“sharing” for cross-context behavioral advertising where those concepts apply to our optional marketing cookies. Use the privacy request channels below. We will not discriminate for exercising privacy rights.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided data, contact us so we can delete it. Educational use by minors should occur only under responsible adult supervision and applicable law.

10. Customer Content responsibility

You and your agents (including LLM clients using MCP) decide what is stored. Do not store unlawful content or data you are not entitled to process. Akashic is not responsible for the accuracy, legality, or fitness of Customer Content, nor for decisions made by third-party AI tools that consume that content.

11. Changes

We may update this Policy. Material changes will be indicated by updating the effective date and, where appropriate, additional notice through the Service. Continued use after the effective date constitutes acceptance of the updated Policy together with the Terms.

12. Contact

• Admin Contact dialog (authenticated privacy requests): /admin
• Community / support: Discord
• Related: Terms of Use · Cookie Policy · Documentation copy