Privacy: Viridis MCP services
Applies to the hosted MCP servers at mcp.viridisconservation.com and mcp.viridis-security.com, their HTTP routes, and the seat and payment pages on those hosts. Last updated 2026-11-03. The Viridis website has its own policy.
Who we are
The hosted MCP services are operated by ViridisNorth LLC (Montana, USA). Contact: justin@viridisconservation.com.
What we collect and why
| Data | Why | Kept for |
|---|---|---|
| Tool inputs and results. What you or your agent send to a tool, and what it returns. | To run the tool. Some services keep the records you create so you can retrieve or verify them later, for example escrow records, signed receipts and reports. | Not kept by read-only and calculation tools beyond processing. Kept for record-keeping services while the record is retrievable; bounded result caches hold the newest records only. |
| Pseudonymous caller ID. A one-way hash of the connecting IP address and client user-agent string, never the raw values. | To enforce free daily limits, meter usage and prevent abuse. | Stored with usage records. |
| Daily demand counts. How many unpaid price requests each route receives, distinct callers per day as a daily-salted keyed hash, and a general client type such as script or browser. | To understand demand and set prices. These cannot be linked across days. | Daily salts are deleted after one day. Per-caller rows are deleted after 8 days. Aggregate counts are kept. |
| Payment records. For card payments: the Stripe Checkout or subscription identifiers, amount, currency and status. For x402 payments: the payer's public wallet address, transaction hash, amount and delivery status. | To deliver what was paid for, handle refunds and disputes, prevent double-spending, and keep accounting and tax records. | As long as required for accounting, tax, dispute and legal purposes. |
| Seat accounts. A hash of your account key (the key itself is shown once and not stored), your plan, Stripe customer and subscription IDs, and per-period usage. | To provide the subscription. | While the account exists, then as required for accounting. |
| Optional feedback. Whether a paid result was useful, if you send it. | To improve the services. | Kept with the related delivery record. |
| Operational logs. Server and error logs, which may include IP addresses and request metadata. | Security, debugging and reliability. | Size-limited and rotated automatically. |
Security Preflight does not store the raw manifests, source code or text you submit. Its signed receipts keep digests, findings and scanner metadata, and diagnostic messages can repeat the tool and policy names you submitted.
What we don't do
- We don't sell personal data or use it for advertising.
- We don't need an account, name or email to connect or to use the free tools.
- We don't see or store card numbers. Stripe handles card details under its privacy policy.
- No tool moves money or signs payments on its own. Every payment is started by a person or by a wallet the buyer controls.
Who we share it with
- Stripe, for card payments and subscriptions.
- The x402 facilitator and the Base blockchain, for USDC payments. Blockchain transactions are public by design.
- Our hosting provider (DigitalOcean), which runs the servers.
- Authorities, when required by law.
The AI assistant you use to call our tools, such as Claude, ChatGPT or Grok, has its own privacy policy for your conversations.
Your choices
Don't send secrets, credentials, or personal data you aren't authorized to share; the tools don't need them. To ask what we hold about you, or to request correction or deletion, email us. We may keep records we're required to keep for accounting, tax, security or legal reasons.
Changes
We'll update this page when our practices change and revise the date above.