Privacy Policy

Swagger to MCP Gateway is operated by RTT Intelligence (“RTT,” “we,” “us,” or “our”). For the processing described in this policy, RTT Intelligence is the data controller unless another arrangement is stated in writing.

Our address is Teknopark Istanbul – Cube Incubation, Sanayi Mah. Teknopark Bulvarı No:1/4C, Pendik, Istanbul, Türkiye. You can contact us at hello@swaggertomcp.com.

Depending on how you use the service, we may process:

• Account data, such as your name, email address, profile image, OAuth provider, and provider account identifier received from Google or GitHub.
• Authentication and security data, such as session identifiers, IP address, browser and device information, timestamps, and security events.
• Product configuration, including integration names, OpenAPI URLs, published tools, database scopes, allowed tables and columns, and related settings you submit.
• Sensitive service configuration, including API credentials and database connection strings. These values are stored server-side and encrypted at rest and are not returned after they are saved.
• Usage and audit information, including tool-call status, latency, quota consumption, and redacted request or response logs. You should not submit secrets or unnecessary personal data in tool arguments.
• Billing and subscription information supplied by Lemon Squeezy, such as plan, subscription status, renewal dates, transaction references, and customer identifiers. We do not store complete payment card details.
• Analytics information, such as pages viewed, approximate location, browser, device, and session statistics, only when you consent to analytics cookies.
• Communications you send to us, including support, sales, security, and data-rights requests.

We process personal data to:

• Create and authenticate accounts and maintain sessions.
• Provide, secure, support, and improve the service.
• Publish and operate the MCP surfaces you configure.
• Apply ownership, entitlement, quota, validation, and audit controls.
• Process subscriptions and communicate billing status.
• Detect abuse, investigate incidents, and protect users and infrastructure.
• Respond to support requests and meet legal obligations.
• Measure website use when you have granted analytics consent.

Our legal bases may include performing a contract with you, taking steps at your request before a contract, complying with legal obligations, protecting our legitimate interests in operating and securing the service, and your consent where required.

We use service providers where needed to operate the service. These may include Google and GitHub for OAuth sign-in, Lemon Squeezy for checkout and subscription administration, Google Analytics when you consent, and hosting, infrastructure, email, monitoring, and security providers.

We may also disclose information when required by law, to protect rights and safety, during a corporate transaction, or at your direction. We do not sell personal data.

Some providers may process information outside your country. Where required, we use an applicable legal transfer mechanism and appropriate safeguards. The protections available to you may vary depending on your location and the provider involved.

We retain personal data only for as long as needed for the purposes described in this policy, including providing the service, resolving disputes, maintaining security records, and meeting accounting, tax, and other legal requirements.

You can request account or personal-data deletion by emailing hello@swaggertomcp.com. We may verify your identity before acting. Some billing, fraud, security, backup, and legal records may be retained where required or permitted by law. Backup copies are removed through normal backup rotation.

Subject to applicable law, you may have rights to learn whether we process your data, receive information about processing and recipients, access or obtain a copy, correct inaccurate data, request deletion or restriction, object to certain processing, withdraw consent, request portability, and complain to a competent data protection authority.

Send requests to hello@swaggertomcp.com. Withdrawing consent does not affect processing that occurred before the withdrawal.

We use technical and organizational safeguards designed to protect personal data, including access controls, encrypted transport, server-side credential storage, encryption at rest for saved credentials and connection strings, validation boundaries, and redaction. No system can guarantee absolute security.

The service is intended for business and professional users aged 18 or older. We do not knowingly collect personal data from children. Contact us if you believe a child has provided personal data.

We may update this policy to reflect product, provider, or legal changes. We will publish the revised policy with a new effective date and provide additional notice when required.

Questions and requests can be sent to hello@swaggertomcp.com.