How DataTetherz handles personal information.

Controller and Processor Roles

For enterprise data processed on behalf of customers, DataTetherz generally acts as a processor or service provider.

For account management, security, analytics, operational monitoring, and business administration data, DataTetherz may act as a controller.

Organizations using the Platform remain responsible for ensuring they have appropriate rights and lawful bases for the enterprise data they connect or process through the Platform.

Information We Collect

We may collect:

• Account Information: name, email address, organization membership, authentication identifiers, and profile information.
• Supabase Authentication Data: Supabase user identifiers, provider identifiers, session metadata, access tokens, refresh tokens, OAuth authorization details, scopes, redirect URLs, authorization codes, sign-in events, and related security metadata.
• Authentication and Security Data: OAuth identity data, login events, IP addresses, browser/device metadata, session identifiers, authentication provider metadata, API tokens, static MCP tokens, and MCP OAuth tokens.
• Operational Data: workflow execution data, MCP requests, tool usage, dashboard interactions, confirmation events, audit logs, resource access activity, configuration metadata, client metadata, errors, performance signals, and session or replay identifiers.
• Platform Configuration Data: organizations, instances, service URLs, OData metadata, generated tools, prompts, resources, dashboards, workflows, field mappings, access rules, confirmation rules, and selected display settings.
• Integration Credentials and Secrets: usernames, passwords, OAuth client IDs, OAuth client secrets, token endpoint details, OAuth access or refresh tokens, API keys, service-account credentials, and other secrets supplied to connect authorized systems.
• Connected Enterprise Data: the Platform may process enterprise records exposed through connected systems, including ERP, CRM, OData, workflow, operational, or business-system data. We process such data only on behalf of authorized users and organizations.

How We Use Information

We use information to:

• provide and operate the Platform
• authenticate and authorize users
• execute workflows and MCP requests
• maintain security
• monitor reliability and performance
• detect abuse or unauthorized access
• improve Platform functionality
• support audit and compliance needs
• respond to support requests
• operate Supabase-backed account, database, and OAuth authorization flows
• issue, validate, refresh, revoke, or expire access tokens and sessions
• store and resolve integration credentials server-side for authorized requests

We do not sell personal information.

Legal Bases for Processing

Depending on applicable law and the nature of the processing, we may process information based on:

• performance of a contract
• legitimate business interests
• legal obligations
• user or customer consent
• security and fraud-prevention needs

AI and Workflow Processing

The Platform may process information through:

• AI systems
• workflow engines
• MCP-compatible clients
• generated tools
• dashboards
• application resources
• transformations and enrichments

Some processing may involve automated decision support or AI-generated outputs.

AI systems may produce inaccurate, incomplete, unsafe, or unintended outputs.

Users remain responsible for validating operational decisions and reviewing sensitive actions before approval.

Integration Credentials and Secrets

The Platform may store authentication credentials and integration secrets required to connect authorized enterprise systems and external services.

Depending on configuration, this may include:

• usernames and passwords
• OAuth access or refresh tokens
• API keys
• client credentials
• session cookies
• service-account credentials

Customers remain responsible for:

• supplying authorized credentials
• rotating credentials where appropriate
• revoking compromised credentials
• limiting excessive permissions

Credentials are intended to be stored using restricted-access and encrypted secret-management mechanisms and are used solely to authenticate authorized requests to connected systems.

DataTetherz personnel are not intended to routinely access plaintext credentials except where operationally required for support, recovery, compliance, or security purposes.

When username and password authentication is selected for a connected system, those credentials may be stored so DataTetherz can authenticate permitted requests. When OAuth is selected, OAuth client configuration, tokens, scopes, redirect metadata, and token endpoint details may be stored and refreshed where supported.

Stored upstream credentials are resolved server-side for permitted operations and are not intended to be disclosed to MCP clients through the ordinary OAuth approval flow.

OAuth and Third-Party Clients

When you authorize third-party applications through OAuth:

• those applications may access approved scopes and capabilities
• those applications may receive access tokens or authorization codes that allow access under your signed-in identity until they expire or are revoked
• those applications operate under their own privacy and security practices
• DataTetherz is not responsible for third-party behavior after authorization is granted

You should review third-party application policies before authorizing access.

You may deny an OAuth request without granting access. Authorized clients may be revoked through account or workspace settings where available, by an administrator, or through support if self-service revocation is not available.

Cookies and Analytics

The Platform may use cookies, local storage, and similar technologies for:

• authentication
• session management
• security
• preference storage
• analytics
• operational monitoring
• product improvement

On public marketing pages, optional analytics tools such as PostHog, Google Analytics, or Google Tag Manager start only after you accept analytics cookies. If you reject optional analytics, public pages remain usable and only the consent preference is stored.

Inside the authenticated console, DataTetherz may use PostHog product analytics, autocapture, heatmaps, surveys, exception capture, and session replay to understand product usage, diagnose issues, improve reliability, analyze feature adoption, and support security or operational review. Login and OAuth consent routes are excluded from PostHog capture in the current implementation.

Analytics data may include page visits, interaction events, browser/device information, session activity, approximate geographic region, feature usage metrics, error data, and replay or heatmap data where enabled. Sensitive fields should not be intentionally submitted into analytics, and we configure capture to avoid collecting secrets where feasible.

You can control certain cookie behaviors through your browser settings or applicable consent controls where available.

Service Providers and Subprocessors

We may use third-party providers to support operation of the Platform, including providers related to:

• cloud hosting
• authentication
• analytics
• infrastructure
• monitoring
• AI services
• database management
• communications
• security services

These providers may process information on our behalf subject to contractual or operational safeguards.

Current infrastructure and product providers may include Supabase for authentication, OAuth, database, and backend services; PostHog for product analytics, product telemetry, and related product-improvement workflows; and Google Analytics or Google Tag Manager for public-site analytics when configured.

Data Sharing

We may share information:

• with infrastructure and service providers
• with connected enterprise systems
• with identity providers
• with authorized organization administrators
• where legally required
• during security investigations
• to enforce our Terms

We do not share personal information for advertising resale purposes.

International Processing and Transfers

Information may be processed in multiple jurisdictions depending on infrastructure regions, hosting providers, subprocessors, AI providers, and connected services.

By using the Platform, you acknowledge that information may be transferred and processed outside your local jurisdiction.

Security Measures

We implement reasonable safeguards including:

• access controls
• authorization enforcement
• credential isolation
• audit logging
• token-based authentication
• confirmation systems for sensitive actions

Users remain responsible for:

• protecting credentials
• configuring permissions appropriately
• reviewing integrations and workflows
• monitoring connected-system access

However, no system is completely secure.

Retention

We retain information for:

• operational purposes
• security monitoring
• audit requirements
• legal compliance
• reliability and debugging

Retention periods may vary based on:

• workspace configuration
• organization policy
• operational requirements
• legal obligations

Account and Supabase Auth session data may be retained while an account or organization remains active and for a reasonable period afterward for security, audit, legal, or backup purposes.

Integration credentials and OAuth tokens are retained while the related connection remains configured or until they are rotated, revoked, deleted, expired, or no longer needed.

Audit logs, MCP request metadata, confirmation records, and security events may be retained longer than ordinary product analytics because they support investigation, compliance, abuse prevention, and operational integrity.

PostHog analytics events, heatmap data, survey responses, exception telemetry, and session replay data are retained according to the configured PostHog project settings and applicable legal or operational requirements.

Your Rights

Depending on applicable law, you may have rights to:

• access information
• correct information
• request deletion
• restrict processing
• object to certain processing
• request export of information

Some requests may be limited by:

• enterprise obligations
• audit requirements
• legal obligations
• security requirements

To exercise applicable privacy rights, contact DataTetherz through the privacy contact listed on this page once published.

Children

The Platform is intended for business and enterprise use and is not directed toward children.

Changes to This Policy

We may update this Privacy Policy from time to time.

Updated versions become effective when published.

Contact

For privacy or data-protection inquiries, use the guided access form and include "Privacy request" in your note so the request can be routed appropriately.