MCP Connector Privacy Policy

1. Introduction and Scope

Orbitax LLC (“Orbitax,” “We,” or “Us”) provides a Model Context Protocol (“MCP”) connector (the “Connector”) that allows the MCP client of Orbitax approved AI Hosts (that from time to time may include, for example, Claude, ChatGPT, Cursor, and Microsoft Copilot), acting on the Orbitax subscriber’s (“Customer”) instruction to call from Orbitax’s MCP Server a defined set of Orbitax tools provisioned by us and return results to your AI conversation.

This policy describes how Orbitax collects, uses, stores, shares, and retains information when you use the Connector. The Connector is an interface to your existing Orbitax International Tax Platform (“ITP”) account, not a new data store. Enabling the Connector does not change Orbitax’s role as a Processor of Customer Content under your ITP subscription agreement. Orbitax is a Controller as to the authentication and operational data generated by the Connector, as described in Section 3. Orbitax’s role as a Controller arises only from your use of the Connector and does not extend to the Orbitax Services generally. “Controller” and “Processor” have the meanings given in the EU General Data Protection Regulation and the UK GDPR.

Orbitax’s general Privacy Policy (orbitax.com/privacy-policy) applies to our website, to information we otherwise receive, and to the Orbitax products and services that reference it, including the Connector. This MCP Connector Privacy Policy supplements our general Privacy Policy and where the two policies address the same subject, this policy controls for Connector activity.

This policy does not govern your AI Host’s, handling of your conversation. Data returned by the Connector into an AI conversation through the MCP client is subject to the AI Host’s privacy policy and your agreement with it — for example, where the AI Host is Claude, Anthropic’s Privacy Policy (anthropic.com/privacy). We encourage you to review those terms.

2. Our Role: Controller and Processor

Orbitax handles two distinct categories of information through the Connector: Customer Content, for which we act as a Processor, and Account and Operational Data, for which we act as a Controller.

Customer Content — Orbitax as a Processor. Customer Content is the electronic data and information submitted to the Orbitax Services by or on behalf of the Customer, together with any data, reports, analyses, compilations or summaries derived from it or generated by the Customer’s use of the Orbitax Services. Orbitax processes Customer Content only on the Customer’s documented instruction under the applicable subscription agreement. The Customer retains all right, title and interest in its Customer Content at all times. If you are an individual user accessing the Connector under your employer’s Orbitax subscription, your employer is the Controller of that data, and your employer’s privacy policy governs how it handles that data.

Account and Operational Data — Orbitax as a Controller. Account and Operational Data includes authentication identifiers, user profile fields, and Connector operational logs, described in Section 3.

3. Information the Connector Collects

3.1 What the Connector receives from your MCP client

When you invoke an Orbitax tool, the Connector receives only the parameters required to execute that specific tool call — for example, an entity identifier, a jurisdiction code, a fiscal period, or a calculation reference.

The Connector does not receive, request, store, or log:

• your conversation history or prior messages;
• prompts, system instructions, or model outputs, other than the tool parameters described above;
• files you have uploaded to your MCP client;
• your MCP client’s memory, saved context, or conversation summaries; or
• data from other connectors, tools, or integrations enabled in your client.

We collect only what is necessary for the requested function, consistent with the minimum-necessary requirements of the MCP client directories in which the Connector is listed, including, for example, Anthropic’s Software Directory Policy. We do not collect conversation data for logging, analytics, quality assurance, or any other purpose.

3.2 Authentication data

The Connector authenticates using OAuth 2.0. We store the access and refresh tokens issued for your session, together with the granted scopes, the associated Orbitax user identifier, and issuance and expiry timestamps. Tokens are stored encrypted. We do not receive or store your Orbitax password through the Connector, and we do not receive credentials for any third-party system.

3.3 Operational logs

We generate service-level and application-level logs of Connector activity for security monitoring, troubleshooting, and abuse prevention. These records contain: timestamp; authenticated user identifier; tool name invoked; request outcome or error code; source IP address; and response latency.

Consistent with our platform-wide logging standard, no Customer Content is written to these logs. Tool parameters are not logged in full; only the tool name and outcome are recorded.

Operational logs are held in the same region as the Customer Content to which they relate.

3.4 What we do not collect

The Connector does not use cookies, web beacons, device fingerprinting, or advertising identifiers. It does not perform behavioral tracking. It does not serve advertisements, sponsored content, or paid placements.

4. How We Use Information

We currently use the information described above only to:

1. Authenticate you and authorize access to your Orbitax entitlements;
2. Execute the tool calls you request and return results to your MCP client;
3. Maintain the security, availability, and integrity of the Connector and the ITP;
4. Detect, investigate, and prevent fraud, abuse, and violations of our terms;
5. Diagnose faults and provide technical support you request;
6. Comply with legal, regulatory, and audit obligations.

We do not use Customer Content, tool parameters, or Connector logs to train, fine-tune, or evaluate any artificial intelligence or machine learning model, whether our own or a third party’s. We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising.

5. Storage and Security

5.1 Where data is stored — regional data residency

Customer Content processed through the Connector is stored in the cloud region associated with the Orbitax account under which the Connector is authorized. The storage region is set when the account is provisioned and reflects the Customer’s elected data residency. Customer Content does not leave its assigned region in the ordinary course of processing, and it is not replicated to another region for backup, disaster recovery, or analytics purposes.

Regions currently available:

Customers can confirm the region assigned to their account at any time by contacting orbitax-mcp@orbitax.com. Where we add, change, or retire a region in a way that would affect a Customer’s assigned storage location, we will provide advance notice in accordance with the applicable subscription agreement, and will not migrate Customer Content between regions without the Customer’s instruction.

Customer Content is not stored on Orbitax corporate networks or employee endpoints.

5.2 Encryption

• At rest: AES-256-GCM.
• In transit: HTTPS with TLS 1.2 or higher. Key exchange uses ECDHE; certificates use RSA 2048-bit keys; SHA-256 is used for hashing.
• Key management: encryption keys are managed in AWS KMS, Azure Key Vault, and Google Cloud KMS, according to the provider serving the Customer’s assigned region. Keys are rotated on a 90-day cycle, privileged key access is restricted to a minimum of two administrators, and all key operations are logged and reviewed quarterly.

5.3 Access controls and tenant separation

Access to systems processing Customer Content is governed by role-based access control and the principle of least privilege, with multi-factor authentication required and just-in-time elevation for privileged operations. Access rights are reviewed on a recurring basis and signed off by our Operations and Information Security leads.

The ITP is a multi-tenant environment. Customer Content is logically segregated and cannot be accessed by other tenants; segregation is enforced through unique tenant and session identifiers.

Customer Content is never used in development, test, or other non-production environments.

5.4 Assurance

Orbitax maintains SOC 1 and SOC 2 examinations, performed annually by an independent third party; reports are available to customers under NDA. Our control environment is mapped to NIST 800-53 (Rev 5). We conduct annual third-party penetration testing and quarterly internal vulnerability scanning, and we maintain a documented patch management program with severity-based remediation timelines.

6. Data Retention and Deletion

On expiration or termination, Orbitax will provide written confirmation that Customer Content has been purged. Before expiration or termination, Customers may export their data at any time using the platform’s export templates.

7. Third Parties and Sub-processors

We share information only as described below. We do not sell personal information.

7.1 Infrastructure sub-processors

Customer Content is processed only by sub-processor facilities located within that Customer’s assigned region, as described in Section 5.1. The regions listed above are the full set in which each sub-processor operates on our behalf; no individual Customer’s data is present in all of them.

Each sub-processor is subject to our third-party risk management program, including contractual security and confidentiality obligations, execution of NDAs, and annual review of their SOC reports as part of our own SOC audit.

Orbitax personnel administering the platform are located in the United States, Bangladesh, and India, and may access Customer Content across regions where necessary to operate, support, and secure the service. Such access is governed by the controls described in Section 5.3, and by the transfer mechanisms described in Section 8.

7.2 Your MCP client

When you invoke a tool, results are returned to the MCP client you have connected from an AI Host — for example, Anthropic’s Claude. This transfer occurs at your direction. Once returned, that data is handled under the terms and privacy policy of that MCP client provider, not this one.

7.3 Other disclosures

We may disclose information where required by law, valid legal process, or governmental request; to establish or defend legal claims; or to protect the rights, safety, and property of Orbitax, our customers, or the public. In a merger, acquisition, or asset sale, information may transfer to the successor entity, subject to this policy.

We do not otherwise disclose Customer Content to third parties.

8. International Transfers

Customer Content is stored in the region assigned to the Customer’s account, as set out in Section 5.1. Selecting a European Union, United Kingdom, or Middle East region means that Customer Content is stored and processed in that region rather than in the United States.

A transfer may nonetheless occur where Orbitax LLC, as a United States entity, or its personnel located outside the storage region, access Customer Content in order to operate, support, or secure the service. Where personal data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred outside that jurisdiction on this basis, or on any other basis, Orbitax relies on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss adaptations where applicable.

These transfers are supported by supplementary technical and organizational measures, including the encryption, key management, and access controls described in Section 5, and by transfer impact assessments carried out for destinations without an adequacy decision. Customers may request execution of the Standard Contractual Clauses as part of their subscription agreement by contacting privacy@orbitax.com.

9. Your Rights and Controls

9.1 Disconnecting the Connector

You may revoke the Connector’s access at any time from your MCP client’s connector settings, or from your Orbitax account. On revocation, the associated OAuth tokens are invalidated and deleted, and the Connector can no longer access your Orbitax data. Revocation does not delete data already stored in your Orbitax account, and it does not remove content already returned into a conversation in your MCP client — that content is managed through your MCP Client.

9.2 Privacy rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or obtain a portable copy of your personal information; to object to or restrict processing; to withdraw consent; and to be free from discrimination for exercising these rights. Residents of California and other US states with comprehensive privacy laws have rights including access, deletion, correction, portability, and opt-out of sale or sharing — Orbitax does not sell or share personal information as those terms are defined.

Submit a request by emailing privacy@orbitax.com. We will verify your identity before acting and respond within the period required by applicable law.

If you access Orbitax under an employer’s subscription, direct requests concerning Customer Content to your employer; we will assist them as processor.

10. Incidents

Orbitax maintains a documented incident response plan, tested at least annually, with tabletop exercises conducted on a recurring basis. In the event of a security incident materially affecting Customer data, we will notify the affected Customer without undue delay and no later than 72 hours after we become aware of, or have reason to believe there has been, such an incident, keep them informed of response actions and investigative outcomes, and provide relevant security logs to support forensic investigation.

11. Children

The Connector is a business tax product and is not directed to, or intended for use by, individuals under 18. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be posted at this URL with a revised effective date, and where required by law or by our agreements, communicated directly to Customers. Continued use of the Connector after an update constitutes acceptance.

13. Contact