Privacy policy

Last updated: 10 November 2026

1. Controller

VICO Ventures UG (haftungsbeschränkt), Münchener Straße 37, 85123 Karlskron, Germany, represented by its managing director Richard Brauel. Email: richard.brauel@vico.ventures

2. Hosting

mcpheaven runs on servers of Hetzner Online GmbH in Germany. When you open the website, the server processes technically necessary data such as IP address, time and requested address to deliver the page and protect it against abuse (Art. 6(1)(f) GDPR). A data processing agreement with Hetzner is in place.

3. Anonymous API and MCP access

Bots and agents may read the public catalog without an account. To enforce the hourly limit we store a salted hash of the requesting IP address with an hourly counter and delete these entries after two days (Art. 6(1)(f) GDPR).

4. Account and console

For an account we store name, email address and a password as an argon2id hash, plus login times, API keys (hashes only), your private capabilities and the monthly number of calls. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Failed login attempts are kept for up to one day to limit attacks (Art. 6(1)(f) GDPR).

You can delete your account at any time in the console under Settings. This removes all related data unless statutory retention applies.

5. Cookies

We set exactly one cookie: the session after login. It is technically necessary and expires after 30 days or on logout. There are no analytics, advertising or third-party cookies. Fonts are served from our own origin.

6. Payments

Paid plans are processed by Stripe Payments Europe, Ltd. (Ireland). Checkout and the customer portal are served directly by Stripe; card or bank details never reach mcpheaven. We pass your name, email address and an identifier of your workspace to Stripe and receive only the state of your subscription. Legal basis: Art. 6(1)(b) GDPR. Stripe may transfer data to the USA on the basis of the EU Commission's standard contractual clauses. Stripe's privacy notice: stripe.com/privacy.

7. Retention

We keep account data as long as the account exists. Data relevant for invoicing is kept for the statutory periods under German commercial and tax law.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). Contact us at the email address above. You may also lodge a complaint with a supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA).