ACI Connector Privacy Notice

Who operates the connector

Aethon Digital FZCO, a company incorporated in Dubai Multi Commodities Centre, operates the ACI connector at https://mcp.aethoncredit.com/mcp.

What we receive

When your MCP client calls an ACI tool, ACI receives:

• the parameters your client sends with the call;
• authentication information for calls that require sign-in;
• connection metadata, which may include IP addresses.

Tool inputs may contain personal or confidential information. Submit only the information needed for the analysis you request.

Why we use it

To authenticate and authorise access, provide the requested analytics, operate and protect the connector (including rate limiting), and keep the limited audit records described below. ACI does not use connector data for advertising or profiling.

What we keep, and for how long

• resolve_exposures audit receipts. Each resolve_exposures call creates a receipt recording the hour, position and outcome counts, provider and snapshot IDs, module, role and matched identifier type. The receipt contains no caller identity and no identifier values. Receipts are kept for 24 months and then deleted.
• Runtime logs. Our host, Vercel, keeps runtime logs, which may include IP addresses, for one day. ACI has no log export configured. This one-day period applies to those runtime logs only.
• Rate-limit records. Short-lived counters keyed to your sign-in identifier or API key identifier, kept for about two hours after your last request.
• Authentication tokens. ACI does not store access tokens. ACI stores a record of each refresh token it issues, so that each can be used only once and can be revoked: an identifier of the token (not the token itself), your account identifier, the client identifier, and when the token was issued, used, revoked and expires. Refresh tokens expire 30 days after issue, and each record is deleted within a day after its token expires.
• Other account, authentication and security records are described in the platform Privacy Policy.

These records are not described as anonymous: omitting direct identifiers does not by itself make a record anonymous.

Who else processes it

• Anthropic and other AI clients. When you use the connector through Claude, your requests pass from Claude to ACI, and the tool results return to Claude for use in your conversation. Anthropic processes those exchanges under the terms and privacy settings of your Claude account. Other MCP clients may involve their own service providers.
• ACI's service providers for the connector: Vercel (hosting and runtime logs), Supabase (database and authentication) and Upstash (rate limiting). Depending on the service and infrastructure, processing may take place outside the UAE. You can ask us for details of the applicable arrangements using the contact below.

Professional use must also meet the Approved Internal AI requirements of your agreement. A provider's training exclusion does not mean the provider performs no processing or keeps no data.

Lawful basis and your rights

ACI processes personal data where it is needed to provide a service, or take contractual steps you request; to meet specific legal obligations; or to establish or defend legal rights where the applicable statutory conditions are met. Where no applicable exception permits processing without consent, ACI obtains your informed consent first.

You can withdraw consent by disconnecting the connector and contacting us. Withdrawal does not affect earlier lawful processing or records kept on another lawful basis. To ask about processing or transfers, or to request correction or deletion, contact alexkouam@aethoncredit.com.