Privacy Policy

Last updated: 21 October 2026

MCP Support lets you ask questions about your own Google data, in a chat and with AI clients such as Claude and ChatGPT. This policy explains which data we process for that purpose, what we store and what we do not, and what your rights are. In short: we read your Google data only at the moment of your question, we do not store that data, and we cannot change anything in it.

1. Who we are

MCP Support is a service of Attributions (trading name GA4 Support).

Company: Attributions, Paul Gudde
Address: Tijmhof 36, 4907 BE Oosterhout, the Netherlands
Chamber of Commerce (KvK): 73595039
Email: support@mcp-support.nl (privacy questions can also go to p.gudde@attributions.nl)
Phone/WhatsApp: +31 6 25 11 82 13

Our role

For the data in your own sources (Google Analytics, Search Console, Google Ads and BigQuery, and if you connect them Microsoft Advertising, Bing Webmaster Tools, Matomo and Piwik PRO), you as the customer are the controller and we are the processor: we read that data only to answer your questions. We record this per customer in a data processing agreement (see chapter 11).

For the data we need to manage your account, sign-in and invoicing (chapter 3, table under “Account and usage”), Attributions itself is the controller.

2. How the service works

Signing in. You sign in with your Google account. We request only the permissions openid and email. We receive your email address and the confirmation that Google has verified that address. We get no access to the Google data in your own account.
Access to your data: connecting with your own Google account. On the Sources page you connect each source separately with the “Connect with Google” button. Google then asks only for read permission for that one source (see chapter 4). With that permission we retrieve the figures from that source for as long as you are signed in. We do not request a refresh token: access expires after an hour at most or when you sign out, and you can revoke it at any time with “Disconnect from Google”.
Access to your data: via our connection address. In addition, you or your organisation can grant read access yourselves to a service account of ours (the “connection address”), in Google Analytics, Search Console, Google Ads, BigQuery and Tag Manager, for exactly the properties, sites, accounts, datasets and containers you choose. This is needed for features that also work when you are not signed in, such as AI clients (Claude, ChatGPT). You can always withdraw those permissions yourself.
Access to your data: connecting with your Microsoft account (Microsoft Advertising and Bing Webmaster Tools). For these two sources there is no connection address. On the Sources page you choose “Connect with Microsoft” or “Connect with Bing” and sign in with your own Microsoft account (for Microsoft Advertising with two-step verification). The access token Microsoft issues is held only in a separate, encrypted cookie and is valid for an hour at most. We do not request a refresh token and you can disconnect at any time. Microsoft Advertising has no read-only permission; we perform read operations only (see chapter 4).
Access to your data: an access key for Matomo or Piwik PRO. Matomo and Piwik PRO have no sign-in with an account like Google or Microsoft; they work with an access key that you create yourself in that system. On the Sources page you paste that key (for Matomo the address of your installation, the site numbers and an auth token; for Piwik PRO the account name, the app IDs and a client ID with client secret). We first test it with a single read request and only save it if that succeeds. Unlike with Google and Microsoft, we do store this key: encrypted in Google Secret Manager, until you delete it or the agreement ends. That is needed because the figures must also work when you are not signed in, for example in AI clients. After saving, the key is never shown again; you only see when it was set and its last four characters. We ask you to create a key for a user with View access only; we refuse a Matomo key with administrator rights. We read totals only (visits, pages, referrers, goals), never data per visitor.
Read-only. We do not request write permissions and the service has no function to change, create or delete anything in your Google, Microsoft, Bing, Matomo or Piwik PRO environment.
Asking questions. If you ask something in the chat or through an AI client, we retrieve the necessary figures from Google at that moment. This can also be done with a free-form question to a source, for example a report in Google Analytics, a search in Search Console or a Google Ads query. Only within the sources connected for your environment, and with limits on size. A free-form BigQuery query is reserved for the owner of the environment.
BigQuery. Via the connection address, BigQuery queries run in our own Google Cloud project; we pass on the processing costs as agreed in your quote. If you have connected BigQuery with your own Google account, the query runs in the Google Cloud project of the connected dataset, with your permissions, and the processing costs fall under that project. In both cases maximums apply per query and per month, and we only run read operations (SELECT).

3. Which data we process

Google data from your environment

Figures and rows from the connected sources (for example visitors, conversions, costs, search queries, tag configuration). As a rule this data contains no names or email addresses, but an export in BigQuery may contain personal data. That is why only the owner may run free-form BigQuery queries, the number of rows is limited, and we ask the AI model for summarised figures. We do not store this data (see chapter 5). The same applies to the figures from Microsoft Advertising (cost, clicks, impressions and conversions per campaign; no search terms and no data per visitor) and from Bing Webmaster Tools (clicks, impressions, search queries, pages and crawl data of your site). We do not store those either. The same applies to Matomo and Piwik PRO: totals over visits, sessions, pages, referrers and conversions, never data per visitor, and not stored. Page titles, addresses and campaign names in those totals can still contain personal data (for example an email address in a URL); check that in your own measurement setup.

Account and usage

Data	Purpose
Configuration of your environment	The connections (which properties, sites, accounts, datasets and containers), the chosen branding (name, logo, colour) and the language. Needed to make the environment work.
User list	Email address and role (owner or viewer) of everyone you give access. With every request we check against it whether someone may view along.
Source status	Per connected source, whether the connection works, so that we can report a broken connection.
Access key for Matomo and Piwik PRO	Only if you set up that source yourself. The key is stored encrypted in Google Secret Manager (see chapter 5); our database holds only the address or account name and the site or app numbers.
Monthly counters	Per environment the number of questions, the number of tokens used, the number of BigQuery bytes processed and the estimated costs. For the quota and for invoicing.
Business Context	The description of your company, goals and definitions that you fill in yourself, so that answers fit your situation. Do not put personal data of third parties in it.
Files you upload yourself	Tables (CSV or TSV) that the owner of an environment uploads, such as a budget, a schedule or an export, so that the assistant can answer questions about them. Columns that we recognise as personal data (by name and content: email address, phone number, address or postcode, IBAN, IP address; date of birth by column name only) we leave out and do not store. This recognition is automatic and not watertight: do not upload files containing personal data, they do not belong there.
Contact and invoicing details	Name, email address, phone number and company details for the quote, agreement and invoicing. With Business: company name, address, VAT number (if you provide it) and email address for the invoice. We do not see or store your bank account number; you give that to Mollie.
Signing up for the free Trial	The company name, your confirmation that you use MCP Support for business, and the version of the terms you agreed to. To give one free Trial per Google account we keep a code derived from your email address (a salted hash), not the address itself. For the daily limits on new sign-ups we use a code of your email domain and of your IP address in the same way.
Technical logs	See chapter 6.

4. Google permissions and the Google API Services User Data Policy

When signing in

When you sign in, Google asks you only for the following two permissions.

Permission	Why	What we do with it, and what we do not
`openid`	To recognise your Google account.	Only to establish who you are.
`email`	To check whether your email address is on the user list of an environment.	We receive your email address and the confirmation that it has been verified. We do not read Google Analytics, Ads, Gmail, Drive or other data from your own account.

When connecting a source

If you connect a source with your own Google account, Google asks for one read permission per source. We never ask for more than the source needs, and only at the moment you connect that source.

Permission	Purpose	What we do with it, and what we do not
`https://www.googleapis.com/auth/analytics.readonly`	Google Analytics	The key figures on the overview (visitors, sessions, conversions, best channel) and answers to your questions, via the Google Analytics Data API. Read-only, only for the property that is set in your environment.
`https://www.googleapis.com/auth/webmasters.readonly`	Search Console	Search queries, clicks and impressions. Read-only.
`https://www.googleapis.com/auth/adwords`	Google Ads	The costs and the cost per conversion on the overview and answers to your Ads questions. Google Ads has no separate read permission; we run read operations only (`googleAds:search`) and do not change, create or delete anything in your Ads account.
`https://www.googleapis.com/auth/bigquery.readonly`	BigQuery	Questions about your own GA4 export in BigQuery, for example what share of your measurements arrives without consent. Read operations only (`SELECT`), with a maximum on bytes processed.

The access token that Google provides for this is held only in your encrypted session cookie, is valid for an hour at most and is not stored in our database. We do not request a refresh token, so without your active session we cannot reach your data with your account. With “Disconnect from Google” we revoke the permission at Google immediately.

If you use the connection address instead, we read with our service account on the basis of the read permissions that you or your organisation have granted to it yourselves. That falls outside Google’s consent screen, but is just as important to you; that is why this policy describes it in full.

Limited Use. The use and transfer of information that MCP Support receives through Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we use that data only to provide the features described in this policy and that you see in MCP Support. We do not sell it and do not use it for advertising. We do not use it to train AI models. People at our company do not read that data, except with your consent for specific data, for security purposes (for example investigating abuse), to comply with the law, or as aggregated and anonymised figures for internal use. Transfer to third parties happens only to provide the feature: Google Cloud (hosting) and Anthropic for answering your question (see chapter 7).

When connecting with Microsoft

For Microsoft Advertising and Bing Webmaster Tools you sign in with your own Microsoft account; that is a different identity from your Google sign-in and does not need the same email address. Microsoft asks for the following permission per source. We ask only at the moment you connect the source.

Permission	Purpose	What we do with it, and what we do not
`openid`, `email`	Microsoft Advertising	To show which Microsoft account you connected with (we show only a masked address, for example p***@example.com). The address is not logged and not used to recognise you.
`https://ads.microsoft.com/msads.manage`	Microsoft Advertising	The cost and the cost per conversion on the overview and answers to your questions about campaigns (cost, clicks, impressions, conversions). Microsoft Advertising has no separate read permission, which is why the consent screen says “manage”. We perform read operations only (listing accounts and requesting reports) and do not change, create or delete anything in your account. Whether anything can be read or written depends on your role in Microsoft Advertising; preferably use an account with the Viewer role.
`webmaster.read`	Bing Webmaster Tools	Clicks, impressions, search queries and crawl data of the sites in your environment. Read-only: this is a genuine read-only permission.

The access token Microsoft issues is held only in a separate encrypted cookie (__Host-mcp_mtok for Microsoft, __Host-mcp_btok for Bing), is valid for an hour at most and is not stored in our database or logs. We do not request a refresh token (no offline_access): without your active session we cannot reach your data with your account. Microsoft and Bing have no simple revoke call that lets us withdraw the permission on your behalf. With “Disconnect from Microsoft” (or Bing) we erase our access token; if you also want to withdraw the permission itself, do so in your Microsoft account (account.live.com/consent/Manage, or for a work or school account myapps.microsoft.com).

Our commitment for Microsoft and Bing data. The Google Limited Use requirements apply to Google data only. For data we read through Microsoft Advertising and Bing Webmaster Tools we give the same commitment: we use it only to provide the features described in this policy, do not sell it, do not use it for advertising and do not use it to train AI models. People at our company do not read it, except with your consent, for security, to comply with the law, or as aggregated and anonymised figures. Transfers happen only to provide the feature: Google Cloud (hosting) and Anthropic to answer your question (see chapter 7).

When setting up Matomo or Piwik PRO

There is no Google or Microsoft consent screen here, because these are other systems. You paste an access key yourself; this is what we do with it.

What you enter	For	What we do with it, and what we do not
Matomo: address of your installation, site numbers and an auth token	Matomo	Totals over visits, actions, pages, referrers, goals and countries for the sites you enter, through the Matomo Reporting API. Read-only. The address must be a public https address; we refuse addresses that point to internal networks. We refuse a token with administrator or superuser rights.
Piwik PRO: account name, app IDs, client ID and client secret	Piwik PRO	Sessions, visitors, conversions and revenue as totals for the apps you enter, through the Piwik PRO Analytics API. Read-only. We ask for a key from a separate user with View access only; whether Piwik PRO technically limits a View key to reading entirely is up to Piwik PRO.

Our commitment for Matomo and Piwik PRO data. The Google Limited Use requirements apply to Google data only. For data we read from Matomo or Piwik PRO with your key we give the same commitment as for Microsoft and Bing: we use it only to provide the features described in this policy, do not sell it, do not use it for advertising and not to train AI models. People at our company do not read it, except with your consent, for security, to comply with the law, or as aggregated and anonymised figures. We use the key only to retrieve that data. Transfers happen only to provide the feature: Google Cloud (hosting and the key vault) and Anthropic for answering your question (see chapter 7).

5. What we store, and what we do not

Data	Where and for how long
Google data from your sources	Not stored. Retrieved at the moment of your question.
Google access token (when connecting with your own account)	Only in your encrypted session cookie, an hour at most. Not in our database, not in logs. No refresh token. Gone on sign-out, on expiry or after “Disconnect from Google”.
Microsoft and Bing data from your sources	Not stored. Retrieved at the moment of your question. A report built by Microsoft Advertising stays in the server’s memory for at most 30 minutes (per environment, user, account and period), so a repeated question does not wait again; the id of a report still running for at most 15 minutes.
Microsoft and Bing access token (when connecting with your own account)	Only in a separate encrypted cookie, an hour at most and never longer than your session. Not in our database, not in logs. No refresh token. Gone on sign-out, on expiry or after “Disconnect from Microsoft (or Bing)”. We keep only a masked label of your Microsoft account (p***@domain) in that same cookie, for the status line.
Matomo and Piwik PRO data from your sources	Not stored. Retrieved at the moment of your question or to fill the cards on your overview. The cards stay in the server’s memory for 30 minutes at most.
Access key for Matomo or Piwik PRO	Stored, encrypted in Google Secret Manager (EU), until you delete it or the agreement ends. Only our service can read it; it is not in our database, not in logs and never comes back into the page. “Replace key” creates a new version and destroys the old one; “Delete key” destroys all versions. When you cancel, we remove the key (see chapter 9). An access token that Piwik PRO issues stays in the server’s memory for 30 minutes at most.
Scorecards (key figures at the top)	A maximum of 30 minutes in the server’s memory, so that not every page view burdens Google again. In your browser they are held in `sessionStorage` and disappear when you close the tab.
Chat history	Only in your own browser (`localStorage`). We erase it on sign-out. We have no copy.
Configuration, user list, source status, Business Context	In our database (Google Cloud Firestore, region europe-west4), for as long as the agreement runs. After that, see chapter 9.
Files you upload	In our database (Google Cloud Firestore, region europe-west4, in the EU), until the owner deletes the file or the environment is terminated; on termination we delete them together with the environment (see chapter 9). Only the assistant of your environment uses them, to answer your questions, in a temporary, isolated database per question. The rows or figures that come from a file in the process are sent to Anthropic as part of the answer (see chapter 7), just like data from Google. Only the owner uploads; viewers can use a file only if the owner enables that per file (off by default). We do not use files to train AI models.
Monthly counters	In the same database, for as long as the agreement runs.
Technical logs	Google Cloud Logging, with Google’s default retention period (30 days).
Session	A cookie of 8 hours, see below.
Invoices and accounts	7 years (statutory tax retention obligation).
Code of your Google account (Trial)	For as long as we offer a free Trial, also after your environment has been deleted: this way nobody can start a Trial again and again with the same account. It is not a readable address.
Codes for the daily sign-up limits	3 days.

Session and cookies

After you sign in we set one necessary cookie: __Host-mcp_sess (connecting Microsoft or Bing adds one cookie per provider, see below). It is encrypted, sent only over a secure connection, not readable by scripts on the page and valid for 8 hours. If you connect a source with your own Google account, Google’s access token is held in it, encrypted and valid for an hour at most. We do not request or store a refresh token, so with your account we cannot reach Google data when you are not signed in yourself. If you connect Microsoft Advertising or Bing Webmaster Tools we set one extra necessary cookie per provider holding the access token: __Host-mcp_mtok (Microsoft) and __Host-mcp_btok (Bing), with the same properties, valid for an hour at most and never longer than your session. We do not request or store a refresh token for those either. In your environment we set no advertising or tracking cookies.

On this website (mcp-support.nl, not your environment) we use a cookie banner. Only if you give consent there do we measure visits with Google Analytics and advertising results with Google Ads. Those measurements run through our own server at sst.mcp-support.nl. If you do not give consent, we do not set these cookies. You can change your choice via the cookie settings.

The request form on this website and the sign-up form of the free Trial (login.mcp-support.nl/aanmelden) are protected by Cloudflare Turnstile, a check on whether a human is filling it in. For that, Cloudflare processes technical data from your browser and your IP address; Turnstile sets no advertising or tracking cookies. In addition, Cloudflare, as the administrator of our network, may keep visitor statistics for this website (Cloudflare Web Analytics). This happens without cookies and without following you across websites: it concerns the page visited, the referring page, the browser type and load times.

If you use MCP Support through an AI client such as Claude or ChatGPT, that client receives an access token from us that is valid for 8 hours, without a refresh token. So you reconnect the client every working day.

6. Logs

For security, troubleshooting and the monthly counters, we record per request: a hashed user code (with salt, so it cannot be traced back to your email address), which tool was used, which source, the outcome, the duration and the number of bytes and rows. We do not log the content of questions or answers, nor email addresses, nor tokens.

7. Who we share data with

We do not sell data. We work with these parties, who process data exclusively for this service:

Party	Purpose	Location
Google Cloud	Hosting of the service and storage in the database (Cloud Run, Firestore)	EU: the service runs in europe-west1 (Belgium), the database is in europe-west4 (the Netherlands)
Anthropic	The AI model (Claude) that answers your question	United States
Cloudflare	DNS and proxy at the edge of the network, bot protection on the request form and the sign-up form (Turnstile), visitor statistics without cookies (Web Analytics)	Worldwide network
Mollie	The payment for Business and the monthly charge. Mollie receives your company name and email address from us; you give your payment details to Mollie yourself, and Mollie is responsible for them.	The Netherlands (EU)
Rompslomp	Our bookkeeping: the Business invoice with your company name, address, VAT number and email address.	The Netherlands (EU)

Anthropic and your questions

If you ask a question in the chat, we send the messages from the conversation, supplemented with the data that we retrieve from Google, Microsoft Advertising, Bing Webmaster Tools, Matomo or Piwik PRO for the answer or from a file that the owner uploaded (the result of the tool), to Anthropic. Anthropic processes that data solely to answer your question and does not use data received through the API to train its models. Because what goes to the model depends on what you ask, we recommend not requesting personal data that you do not need.

Transfers outside the European Union

Anthropic is established in the United States. For the transfer of data to Anthropic, the standard contractual clauses of the European Commission apply, which provide appropriate safeguards for the protection of your data. Google Cloud and Cloudflare process data on the basis of the same safeguards when data leaves the EU. You can request a copy of the relevant safeguards from us via the contact details at the bottom of this page.

If you use MCP Support through your own AI client (Claude, ChatGPT or another), your questions and the retrieved data go to the provider of that client. The terms and privacy policy of that provider apply to this; we have no influence over that.

Legal obligation

Only if the law requires it, for example in the case of a court order, do we hand over data to a government authority.

8. Why we are allowed to do this (legal bases)

Performance of the agreement (art. 6(1)(b) GDPR): to provide the service, manage the user list, invoice and give support.
Legal obligation (art. 6(1)(c) GDPR): statutory tax retention obligation.
Legitimate interest (art. 6(1)(f) GDPR): security, logging and abuse prevention.

For the Google data in your environment we process on your instructions; you determine the legal basis for that as the controller.

9. Cancellation and deletion

Trial. A free Trial that you do not convert to Business is deleted 90 days after your last question (or after signing up, if you never asked a question). The code of your Google account stays (see chapter 5).
Business paused. If Business stays paused for 30 days because a payment does not go through, the agreement ends; after that the period below applies.
Cancelling. If you cancel the service, we delete your customer environment, the user list, the files you have uploaded and the stored access keys for Matomo and Piwik PRO no later than 30 days after the end of the agreement. We keep invoices for 7 years, because the law requires it.
Disconnecting from your own Google account. With “Disconnect from Google” on the Sources page we revoke the permission at Google immediately and erase the access token from your session. You can also do it yourself via myaccount.google.com/connections. After that we read nothing with your account.
Disconnecting from your Microsoft account (Microsoft Advertising and Bing Webmaster Tools). With “Disconnect from Microsoft” (or Bing) on the Sources page we erase the access token from your browser. Microsoft has no simple revoke for us; you withdraw the permission itself via account.live.com/consent/Manage (or myapps.microsoft.com for a work or school account). After that we read nothing with your account.
Deleting the access key for Matomo or Piwik PRO. With “Delete key” on the Sources page we destroy the stored key immediately, and the source disappears from your environment. Also revoke the key at Matomo or Piwik PRO if you no longer use it; only you and your administrator can do that. If you cancel the service, we destroy the key ourselves.
Withdrawing the permissions of the connection address. The read permissions you gave to our service account are withdrawn by you yourself, in Google Analytics, Search Console, Google Ads, BigQuery and Tag Manager. We cannot do that for you and we remain without any management rights in your environment. Without those permissions we can no longer read data via the connection address.
Withdrawing sign-in. You can withdraw the sign-in permission at any time via myaccount.google.com/permissions.
Google data. Because we do not store it, there is nothing of it to delete on our side.
Uploaded files. The owner can delete a file themselves in the environment at any time; it is then gone from our side.
Customer containers. We never delete anything in your own Google environment, not even after cancellation.

10. Your rights

Under the GDPR you have the right of access (art. 15), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), data portability (art. 20) and objection (art. 21). If you have given consent, you can withdraw it.

Send your request to support@mcp-support.nl. We respond within 30 days. To prevent abuse, we sometimes ask you first to confirm that the request comes from you.

If your organisation is the customer and your request concerns data in the environment, we will usually refer you to your employer or client, because as the controller it is in charge of that data. We help that party to handle it.

Do you disagree with how we handle your data? Then you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We would like to hear from you first, so that we can resolve it.

11. Data processing agreement

For every customer we conclude a data processing agreement, with an annex listing the connected sources and the sub-processors from chapter 7. The template is online and we sign it together with the quote. Questions? Email support@mcp-support.nl.

12. Security

We take appropriate technical and organisational measures. Each customer environment is separate from other environments, and with every request we check against the current user list whether someone has access. Traffic runs over encrypted connections, keys and passwords are kept in a managed vault and not in code, and the service can only read. No service on the internet is one hundred percent secure; if you notice anything unusual, please report it to us immediately.

13. Changes

We update this policy if the service or the permissions change, or if the law requires it. The date at the top shows when that last happened. For significant changes we inform our customers by email.

14. Contact

Questions about this policy or about your data:

Email: support@mcp-support.nl
Phone/WhatsApp: +31 6 25 11 82 13
Post: Attributions, Tijmhof 36, 4907 BE Oosterhout, the Netherlands