Privacy notice

The service operator is Kiliaan Vanvoorden. Privacy enquiries can be sent to bakerstreetbandit@zohomail.eu. The operator’s postal address must still be supplied before this notice is finalized for a customer pilot.

• Your account email and authentication state.
• MCP endpoint names and URLs, encrypted bearer tokens, tool names, descriptions and schemas, snapshots, comparison results and check-run metadata.
• Golden-test prompts, expected tool choices, model settings and results. Model API keys are encrypted at rest; API access tokens are stored as hashes.
• Optional alert webhook URLs and report-share tokens, including whether a share has been revoked.

A contract check requests the MCP tool list and stores the advertised tool contract and the resulting comparison. It does not invoke the listed MCP tools. If golden tests are enabled, their prompt and tool list are sent to the model endpoint configured by the account owner; that model provider’s own terms and retention practices also apply.

The application uses Vercel for hosting and Neon for account authentication and database storage. Stripe integration exists for billing but is not represented here as active for live payments. The operator must confirm the applicable processing terms, service regions, subprocessors, transfer safeguards, and any additional providers before accepting customer data.

The application retains up to the most recent 50 snapshots and 50 golden runs per server, in addition to records needed for the approved baseline and live report shares. The operator must document infrastructure logs, backups, deletion timelines, and account deletion behavior before this notice is finalized.

For privacy requests, contact bakerstreetbandit@zohomail.eu. A verified process for access, correction, deletion, objection, portability, and complaints must be completed before publishing a final notice.