Privacy Policy

Last updated: August 2026

This English version is a convenience translation. The German-language version is the legally binding version; in case of any discrepancy, the German version prevails.

Controller

Responsible for data processing within the meaning of the GDPR:

Aron-Frederic Seiffert und Markus Ehret GbR
(Trading as: Logistry GbR)
Veitstraße 44 A
13507 Berlin, Germany
Email: privacy@specmcp.com

General Information

We process personal data exclusively in accordance with applicable law (GDPR). This privacy policy explains what data we process, for what purpose, and what rights you have.

Purposes and Legal Bases

We process data to provide our SaaS service. Purposes of processing:

  • Operating the application
  • Account management
  • Authentication
  • Executing user requests
  • Payment processing
  • Technical security

Legal bases: Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR.

Services Used

Hosting: Fly.io
Fly.io, Inc., 2261 Market Street #4990, San Francisco, CA 94114, USA. Server location: EU (Amsterdam). Purpose: hosting and delivery of the application. Data processed: IP address, browser data, operating system, timestamps, pages accessed. Legal basis: Art. 6(1)(f) GDPR. Third-country transfer: USA, standard contractual clauses. Privacy Policy

Database: Neon
Neon Inc. (a Databricks company), 160 Spear Street, Suite 1300, San Francisco, CA 94105, USA. Server location: EU (Frankfurt). Purpose: storage of account and application data. Data processed: email address, account data, usage data, technical metadata. Legal basis: Art. 6(1)(b) GDPR. Third-country transfer: USA, EU-US Data Privacy Framework and standard contractual clauses. Privacy Policy

Authentication: Better Auth (internal)
Purpose: login and access control. Data processed: login credentials, session tokens, security data. Legal basis: Art. 6(1)(b) GDPR.

Email delivery: Resend Inc.
2261 Market Street #5039, San Francisco, CA 94114, USA. Purpose: sending transactional emails. Data processed: email address, technical metadata, email content. Legal basis: Art. 6(1)(b) GDPR. Third-country transfer: USA, standard contractual clauses. Privacy Policy

Payment processing: Stripe Inc.
510 Townsend Street, San Francisco, CA 94103, USA. Purpose: processing payments and managing subscriptions. Data processed: payment data, billing address, email address, technical metadata. Legal basis: Art. 6(1)(b) GDPR. Third-country transfer: USA, standard contractual clauses. Privacy Policy

GitHub integration
When a customer installs the SpecMCP GitHub App, we process pull-request and repository data for the repositories the customer selects, to produce advisory regulatory-impact checks and comments on pull requests. Data processed: pull-request diffs, titles and descriptions, repository file contents read during the analysis, and repository and pull-request identifiers. We store an audit record of each analysis (repository and pull-request identifiers, commit references, the certification scope used, the outcome, and a content hash); we do not retain the analyzed source code or diffs beyond the transient processing needed to produce the result. Legal basis: Art. 6(1)(b) GDPR.

Automated analysis: OpenAI
OpenAI, L.L.C., San Francisco, CA, USA (EEA contracting entity: OpenAI Ireland Ltd, Dublin, Ireland). Purpose: analyzing pull requests for regulatory and certification impact via large language models and text embeddings, only where the customer installs the GitHub App. Data processed: redacted pull-request content and repository files read during analysis. Obvious secrets are removed before transmission. Legal basis: Art. 6(1)(b) GDPR. Third-country transfer: USA, EU-US Data Privacy Framework and standard contractual clauses. OpenAI does not use API data to train its models. Privacy Policy

Web analytics: Matomo (self-hosted) We operate Matomo on a Virtual Private Server managed by us and provided by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. We do not use Matomo Cloud and do not disclose analytics data to Matomo or other third parties. We use the data to measure use of our website and improve its content and functionality. The data includes pages and referrers visited, timestamps, technical browser and device information, a truncated IP address, and interaction events such as link and CTA clicks. Matomo is configured without analytics cookies, User IDs, or cross-site tracking. Processing takes place only with consent for web analytics under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn at any time with effect for the future through the cookie settings. Raw data is automatically deleted according to the deletion period configured in Matomo; aggregated statistics are retained only as long as needed for analysis. netcup Privacy Policy

Cookies

Only technically necessary cookies are used. Purposes:

  • Session management
  • Login state
  • Language preferences
  • UI state

Legal bases: Section 25(2) TDDDG, Art. 6(1)(f) GDPR. Web analytics takes place only with the consent described above.

Server Log Files

Log files are automatically recorded when the website is accessed. Data processed: IP address, browser, operating system, date and time, referrer. Purpose: security and error analysis. Legal basis: Art. 6(1)(f) GDPR.

Retention Period

Personal data is stored only for as long as necessary for the respective purpose or as required by legal retention obligations.

Your Rights

You have the right to:

  • Access
  • Rectification
  • Erasure
  • Restriction of processing
  • Data portability
  • Objection

Right to lodge a complaint with a supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit — www.datenschutz-berlin.de

← Back to homepage