Privacy policy
This policy explains how Invokely handles personal data when you visit invokely.ai, create an account, call the API or the MCP server, or pay for a plan.
Invokely needs little personal data to work. We keep an email address to sign you in, a few records to meter usage and bill you, and short-lived logs to keep the service secure. We do not sell personal data and we do not use it for advertising.
Who is responsible for your data
The controller of your personal data is [Legal entity name], tax ID [Tax ID (NIF or CIF)], with its registered address at [Registered address].
For any privacy question or request, write to privacy@invokely.ai. For other legal matters, write to legal@invokely.ai.
What we collect
We collect only what we need to run the service:
- Account data: your email address. If you sign in with Google, also your name and your Google account identifier.
- Sign-in records: session records and single-use sign-in links. We store a hash of each session and link token, not the token itself.
- API keys: a SHA-256 hash of each key, its name, a short prefix so you can recognize it, and when it was created, last used or revoked. We never store the full key after showing it to you once.
- Connected clients: when an MCP client such as Claude, ChatGPT or Cursor connects through OAuth 2.1, we store the client's registration (name and redirect addresses) and hashes of the access and refresh tokens issued to it.
- Usage counts: the number of calls per account, day, channel (API or MCP) and operation, plus monthly totals and credit use.
- Billing data: your Stripe customer and subscription identifiers, your plan, billing period, and prepaid credit balance and movements.
- Workspace content: the charts, tables and datasets you save (titles, settings, and the rows of datasets you upload or send through an agent). Only you can read them. Do not upload personal data about other people.
- Technical data: IP address, requested path, user agent and time of each request, kept in our reverse proxy logs. The IP address is also used for rate limits and for the anonymous MCP trial.
- Messages you send us, for example support or privacy requests.
What we do not keep about your queries
We do not keep a full log of your API or MCP requests tied to your account. We store counts per day and operation for metering. The content of a query (for example, which indicator or place you asked about) is not stored against your account.
The reverse proxy logs described above contain the requested path, which can include search terms. These logs are deleted after 14 days. Do not put personal data in queries.
Where the data comes from
Most data comes from you directly, when you sign up, create keys, connect clients or contact us.
Some data comes from third parties:
- Google, if you choose Google sign-in: your email address, name and Google account identifier.
- Stripe, when you pay: your customer and subscription identifiers and the status of your subscription and payments. We do not receive your card number.
- Cloudflare Turnstile, on sign-in forms: a pass or fail result for the security check.
Why we use it and on what legal basis
Under the General Data Protection Regulation (GDPR), each use needs a legal basis:
- To create and run your account, sign you in, issue API keys, connect MCP clients, meter usage and provide paid plans and credits. Basis: performance of the contract with you (Article 6(1)(b) GDPR).
- To send transactional email, such as sign-in links and messages about your account or billing. Basis: performance of the contract.
- To issue invoices and keep accounting and tax records. Basis: legal obligation (Article 6(1)(c) GDPR), under Spanish commercial and tax law.
- To protect the service from abuse, enforce rate limits, run the anonymous MCP trial, check sign-in forms with Turnstile, investigate incidents, and keep backups. Basis: our legitimate interest in keeping the service secure and available (Article 6(1)(f) GDPR).
- To answer your messages and handle legal claims. Basis: our legitimate interest, or the contract when the message is about your account.
Where we rely on legitimate interest, we have weighed it against your rights. You can object at any time (see "Your rights").
Who receives your data
We share personal data only with service providers that need it for their role. They process it under data processing agreements and our instructions, except where noted:
- Hetzner Online GmbH: hosting of the application and database (Helsinki, Finland).
- Cloudflare, Inc.: DNS, the Turnstile security check, delivery of sign-in links and other transactional email, and storage of encrypted backups.
- Stripe: payment processing. Stripe also acts as an independent controller for some data, for example to meet financial regulation and prevent fraud.
- Google: sign-in, only if you choose it. Google acts as an independent controller of your Google account.
The subprocessors page lists each provider with its legal entity, location and transfer safeguards.
We may also disclose data to public authorities or courts when the law requires it.
Transfers outside the European Economic Area
Our application and database run in the European Union. Some providers are based in the United States or may access data from there: Cloudflare, Stripe and Google.
These transfers rely on the EU-U.S. Data Privacy Framework, under the European Commission's adequacy decision of 10 July 2023, for providers certified under it. Where a transfer is not covered by that framework, it relies on the Standard Contractual Clauses approved by the European Commission. Each provider's safeguard is listed on the subprocessors page. You can ask us for a copy of the relevant safeguards at privacy@invokely.ai.
How long we keep it
- Account data, API key records, connected client records and usage counts: while your account is open. When you close your account, we delete them within 30 days.
- Workspace content: until you delete it, or within 30 days after you close your account.
- Sessions: until they expire, at most 30 days after sign-in, or when you sign out.
- Sign-in links: valid for 15 minutes; the record is deleted within a day after it expires.
- OAuth codes and tokens: deleted after they expire or shortly after.
- Billing records and invoices: 6 years after the end of the financial year they relate to, as required by Article 30 of the Spanish Commercial Code. Tax authorities may require them for that period.
- Reverse proxy logs: 14 days.
- Rate limit and anonymous trial counters: deleted automatically within 48 hours.
- Backups: encrypted database backups are kept for up to 5 weeks, then overwritten. Data deleted from the live database disappears from backups within that time.
- Messages to support: up to 2 years after the conversation ends, unless they are needed for a legal claim.
We may keep data longer if we need it to establish, exercise or defend a legal claim, and only for that purpose.
Your rights
You have the right to:
- access the personal data we hold about you and get a copy;
- correct data that is inaccurate;
- have your data erased;
- restrict processing in some cases;
- receive data you gave us in a machine-readable format and have it sent to another provider (portability);
- object to processing based on our legitimate interest.
To use these rights, write to privacy@invokely.ai from the email address on your account. If we cannot confirm that the request comes from you, we may ask for more information. We answer within one month. In complex cases this can be extended by two more months, and we will tell you if it is.
Exercising your rights is free. We may refuse or charge a reasonable fee only for requests that are clearly unfounded or excessive, as the GDPR allows.
Complaints
If you think we have not handled your data correctly, please write to us first at privacy@invokely.ai.
You also have the right to lodge a complaint with a data protection supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You can also complain to the authority in the EU country where you live or work.
What happens if you do not give us data
An email address is required to create an account. Without it we cannot sign you in or contact you about your account. Billing data is required for paid plans and credits.
You can try the MCP server without an account, within the anonymous trial limit of 25 calls a day per IP address. In that case we process only the IP address and the technical data described above.
Automated decisions
We do not make decisions based solely on automated processing that produce legal effects for you or affect you in a similarly significant way, as described in Article 22 GDPR. We do not build profiles of users.
Rate limits, quotas and the Turnstile check run automatically. They can block a request for a short time. If you think one has blocked you by mistake, write to legal@invokely.ai.
Security
We protect personal data with technical and organizational measures suited to the risk. For example, connections use HTTPS, API keys and tokens are stored only as hashes, backups are encrypted before they leave our server, and access to production systems is limited.
If a personal data breach is likely to put your rights at risk, we will notify the AEPD and, where the law requires it, tell you.
Data protection officer
We have not appointed a data protection officer. The GDPR (Article 37) and the Spanish data protection law (Article 34 of Organic Law 3/2018) require one only for public bodies, for organizations whose core activities involve large-scale regular monitoring of people or large-scale processing of special categories of data, and for certain listed sectors. Invokely does none of these. Privacy questions go to privacy@invokely.ai.
Children
Invokely is a service for developers and businesses. Accounts are for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has created an account, write to privacy@invokely.ai and we will delete it.
Changes to this policy
We will update this policy when our processing changes, for example when we add a provider. The date at the top shows the latest version. If a change affects how we use your data in a significant way, we will email account holders before it takes effect.