Privacy Policy

1. Overview

advMCP.ai is a public explorer for SEC Form ADV data. No login, account, or API key is required to browse the site or use the MCP service. The only authenticated surface is a private operator dashboard used by us to monitor service usage. This policy explains what information we collect, why we collect it, and how long we keep it.

2. Information we collect

• Public SEC data: All adviser data shown on the site comes from the SEC Investment Adviser Public Disclosure (IAPD) compilation feed. This is public information.
• Theme preference: We store your light/dark mode preference in your browser's localStorage so the site loads in your chosen theme on future visits.
• IP addresses for rate limiting: When you call the MCP service, your IP address (as reported by our network provider) is stored as the key of a rate-limit counter row. That row is retained for up to about a day after its counting window closes, and is then deleted.
• MCP usage log: For each MCP handshake or tool call we record a pseudonymous caller hash, the calling client's reported name and version (for example "Claude" or "ChatGPT"), the JSON-RPC method, the tool name, a status, a duration in milliseconds, and a timestamp. The caller hash is a salted SHA-256 digest; raw IP addresses are never written to the usage log table.
• Server logs: Our hosting infrastructure receives standard HTTP request data, including IP address, in order to serve the site.

3. How we use information

We use the data above to keep the site running, protect it from abuse, understand aggregate usage, and improve the service. We do not sell personal information, and we do not use it for advertising.

4. Sharing

We do not share personal information with third parties. Aggregated, non-identifiable usage statistics may be reviewed by our hosting and infrastructure providers as part of normal operations.

5. Cookies and localStorage

The site uses localStorage only for theme preference. We do not use tracking cookies or advertising cookies. The one exception is a session cookie set when an operator signs in to the private admin dashboard; it exists solely to keep that operator signed in and is not used for tracking or advertising.

6. Data retention

Rate-limit counter rows are discarded roughly a day after their counting window closes. MCP usage log entries are deleted after 180 days. SEC adviser data is retained as long as the public feed remains useful to the service.

7. Changes

We may update this Privacy Policy from time to time. The effective date at the top of the page will reflect the latest version.