← Home

Privacy

Effective 19 October 2026. Operator: Sun Business Group. Product: WebMCP Eval at www.webmcp-eval.com and https://mcp.webmcp-eval.com/mcp.

This page is the privacy policy for directory and connector review. Terms govern payment and acceptable use.

What we collect

• Wallet. Prepaid balance, last successful debit or reload time, Stripe checkout and payment identifiers needed to fulfill or refund a pack. Keys look like usr_live_. OAuth access tokens map to that wallet. The balance tool returns only your remaining credits, dollar balance and expiry. Outside ChatGPT it also shows the last four characters of your access key so you can quote them to support. It never returns your email, account ID or full key. We do not store card numbers.
• An evaluation request. The HTTPS URL you submit to evaluate_webmcp, plus the page content fetched so we can describe WebMCP surfaces and recommend tools. Evaluations where the page doesn't load or the analysis can't run are not billed (see Terms).
• Your email address (paid packs). When you buy a pack, Stripe, our payment processor, gives us the email address you entered at checkout, and we store it with your wallet. We use it only to run your account: to send or replace your key (for example, a one-time-view link after a key is rotated; the key itself is never put in the email), to send usage and account notices (credits remaining, credits expiring 12 months after purchase, or a pack that hasn't been used yet), to handle billing and support, and occasionally to ask for product feedback. We don't send marketing or sales solicitations to this address, we don't use it for advertising, and we don't sell or rent it. We share it only with the providers that help us run WebMCP Eval: Stripe (payments), Resend (email delivery, from clients.fxops.ai), and our hosting providers, or where the law requires. Our legal bases are performing our contract with you (key delivery, account and expiry notices, billing) and our legitimate interest in supporting your use of the product (feedback and reminders about unused credits). You can opt out of reminders and feedback emails at any time using the link in those emails or by writing to jwilliams@sunbusinessgroup.com; essential account and security notices will still be sent.
• Connector session. Host name of the client that completed OAuth (Claude, ChatGPT, Grok, Cursor, or another MCP host) so the consent page can name that host.
• Free-pass abuse check. When you claim a free evaluation, we store a hash of your IP address for up to 30 days, one pass per network in that window. We do not store the raw IP. The hash is salted with a secret kept outside the ledger (a Fly secret), so a ledger backup alone is not enough to recover addresses. Deleted after 30 days or when unused free-pass wallets are purged.

What we do not keep

We do not keep a first-party history of the URLs you evaluate, page titles, page sketches, or intent labels. The evaluation JSON in your agent chat is your copy. The default ledger is wallet-only.

If a result is too large for your chat, we hold the remaining parts in server memory so your agent can fetch them with the same wallet. A part stays readable for up to 15 minutes after the evaluation. It is not deleted on the first fetch, but older results may be removed sooner when the server is busy. Only the wallet that ran the evaluation can fetch it. At most 20 results are held for each wallet, and at most 200 results are held on the server. These parts are never written to disk or logs, and nothing about your wallet is included.

An audit log of evaluated URLs is not on by default. If a buyer later needs one for their own client billing, that will be an explicit opt-in setting.

We do not run first-party analytics, advertising pixels, or session replay on this site.

How an evaluation is processed

To complete evaluate_webmcp we send the submitted URL and fetched page material to these subprocessors:

• Firecrawl (Firecrawl, Inc.) — scrape / sketch when the page must be read as a document. We send the URL and public HTML, not your wallet key, chat, or card.
• OpenAI — US-hosted inference used to classify the page and draft recommended tools. We do not train foundation models on your evaluations. We send page text needed for the eval, not your wallet key, chat, or card.
• Our browser worker (when used) — inspect in-page WebMCP tools on infrastructure we operate. It does not execute those tools.

Payment is processed by Stripe. Checkout cookies on Stripe’s pages are Stripe’s.

Checkout labels: when you start a checkout, we record how it began (the website button, an AI agent's checkout tool, or an in-app reload), whether the request came from a browser or an automated client, and the name of the referring website (for example x.com). For checkout labels we do not store your IP address, full browser details, or page URLs with the label. Separately, when someone claims a free evaluation, we store a hash of their IP address for up to 30 days so the same network cannot claim more than one free pass in that window. We do not store the raw IP. The hash is salted with a secret kept outside the ledger (a Fly secret), so a ledger backup alone is not enough to recover addresses. Hashes older than 30 days are deleted. Free-pass wallets carry no email unless you later pay (Stripe) or we issue a one-time pass link after you email jwilliams@sunbusinessgroup.com. Unused free-pass wallets with no evaluation and no payment are deleted after 30 days. Repeated checkout attempts from the same network are briefly rate-limited using a temporary in-memory counter that isn't saved.

We use infrastructure hosts to run the MCP and this site. They see connection metadata the way any HTTPS host does. We do not sell personal data.

Retention

• Wallet and Stripe fulfillment records: while the wallet exists and as long as we must keep them for tax, dispute, or abuse review.
• Page content used during an evaluation: processed to produce the result, then discarded from our first-party store. Subprocessors keep their own logs under their policies for a short operational window.
• OAuth tokens: until you disconnect the host or we revoke abuse.
• Email on your wallet: kept while your wallet has unexpired credits, and for 90 days after your last credits are used up or expire, so we can answer support or key requests. Then we delete it from the wallet. Payment records, including the email on your Stripe receipt, are kept by Stripe and in our accounting records only as long as tax, dispute, or legal rules require.
• Free-pass abuse check: a hash of the IP address, kept for up to 30 days, then deleted. We do not store the raw IP. The hash is salted with a secret kept outside the ledger (a Fly secret), so a ledger backup alone is not enough to recover addresses. Unused free-pass wallets with no evaluation and no payment are deleted after 30 days. Free-pass wallets carry no email unless you later pay (Stripe) or we issue a one-time pass link after you email jwilliams@sunbusinessgroup.com.

What this product does not do

• It does not execute tools registered on the page you evaluate.
• It does not ask for passwords, cookies, or private URLs. Do not put secrets in the evaluated URL.
• Connect, tools/list, and get_credits are not billed. A billed evaluate_webmcp debits $2 from the prepaid wallet; an unbilled result returns the $2 to the wallet. Reload checkout is a separate Stripe payment you approve in a browser.

Your requests

Email jwilliams@sunbusinessgroup.com from the address you used at checkout, or include the last four characters of your access key. Never send the full key. We can confirm balance and last debit or reload. We cannot replay URL history we do not store.