Privacy Policy
Privacy Policy
Instinct MCP — Privacy Policy
Effective date: September 15, 2026 · Last updated: September 15, 2026
1. Who we are
Instinct MCP is operated by Fox & Crow Inc. ("Fox & Crow", "we", "us"), the data controller for the personal information described here.
- Legal entity: Fox & Crow Inc.
- Postal address: 302 Center Street, Mason, MI 48854, USA
- Phone: 1-888-712-1220
- Privacy contact: support@foxcrowgroup.com
This policy applies to the Instinct MCP service and its websites: mcp.mspmcp.com (the account, connection, and billing portal and the Model Context Protocol endpoint) and mspmcp.com (the public marketing site). It sits alongside the group privacy policy at facinstinct.com/privacy; where the two differ for the Instinct MCP service, this policy governs.
2. What Instinct MCP is (so the data picture is clear)
Instinct MCP is a paid service that lets a signed-in customer's AI assistant (e.g. Claude, ChatGPT, Gemini, Grok) query Fox & Crow's business-intelligence database about companies in the managed-services market. Two different kinds of data are involved, and we treat them differently:
- Your account data — personal information about you, the customer who
signs up and pays. This policy's rights and controls apply to it.
- The business-intelligence data the service returns — firmographic and
operational information about companies (industry, size, technology, operating-maturity scores, reputation, and similar company-level signals). This is business information about organizations, not personal information about individuals, and the service does not return personal contact details (see Section 8).
3. Information we collect
We collect only the following, and only for the purposes in Section 4:
| Category | Examples | Source |
|---|---|---|
| Identity & account | Name, email address, organization/company name | You, via sign-up / SSO |
| Authentication | Login session tokens and identifiers | Our identity provider (Stytch) when you sign in |
| Billing | Plan, credit balance, transaction history, invoices. We do not store full card numbers — card data is handled by our payment processor (Stripe). | You + Stripe |
| Service usage / metering | Which tools your account called and the credits debited, timestamps, and coarse technical logs needed for security and to run the service | Automatically, as you use the service |
| Support | Messages you send us and our replies | You |
What we do NOT collect or use: we do not run web analytics, advertising or marketing trackers, third-party tracking cookies, cross-site tracking, fingerprinting, or behavioral profiling. We do not build advertising profiles and we do not track you across other websites.
Cookies — strictly necessary only. The only cookies/local storage we use are those our authentication provider Stytch sets to keep you signed in on the account portal (e.g. stytch_session and stytch_session_jwt — a session token and session JWT), and equivalent browser storage. These are first-party, strictly-necessary cookies with no analytics or advertising purpose; without them you could not stay logged in. The public marketing site (mspmcp.com) sets no cookies at all. Payment is completed on our processor's hosted checkout (Stripe), so we set no payment cookies on our own pages. You can block cookies in your browser, but the signed-in portal will not function without the session cookie.
4. How we use information
We use the information above to:
- 1. Create and administer your account and authenticate you (SSO/login);
- 2. Provide the service — run the MCP tools you call and return results;
- 3. Meter usage and take payment (credit balances, invoices, receipts);
- 4. Provide customer support and service communications;
- 5. Keep the service secure, prevent abuse and fraud, and enforce our terms;
- 6. Comply with legal, tax, and accounting obligations.
We do not sell your personal information, and we do not use it for targeted advertising.
5. Legal bases (UK/EU GDPR)
Where the UK GDPR or EU GDPR applies, we rely on: performance of a contract (providing the service you signed up for), legitimate interests (securing the service, preventing abuse, running our business — balanced against your rights), legal obligation (tax/accounting/records), and consent where specifically requested (e.g. optional communications, which you can withdraw at any time).
6. How we share information (service providers / subprocessors)
We share personal information only with vetted providers that process it on our behalf under contract, and only as needed to run the service:
| Provider | Purpose | Data |
|---|---|---|
| Stytch | Authentication / identity (sign-in, sessions) | Identity & authentication data |
| Stripe | Payment processing, checkout | Billing data (card data handled by Stripe, not us) |
| Amazon Web Services (AWS) | Cloud hosting / infrastructure | All service data, encrypted in transit and at rest |
| Intuit QuickBooks | Invoicing / accounting | Billing records needed to issue receipts/invoices |
| Cloudflare | DNS and CDN for the marketing site | Standard request metadata for mspmcp.com |
This subprocessor list is current as of the effective date. We may also disclose information where required by law, to protect our rights or users' safety, or in connection with a corporate transaction (with notice where required). We do not sell personal information or share it for cross-context behavioral advertising.
7. International data transfers
Fox & Crow Inc. is based in the United States and processes the limited account, authentication, and billing information in this policy in the US and with US service providers (Stytch, Stripe, AWS, Intuit QuickBooks). If you access the service from the UK, the EEA, Switzerland, Canada, Australia, or elsewhere outside the US, your information will be transferred to and processed in the US, which may have data-protection laws that differ from your country's.
Where we receive personal data subject to UK or EU data-protection law, we rely on appropriate safeguards. On request we make available the European Commission's Standard Contractual Clauses and, for UK data, the ICO's International Data Transfer Addendum (IDTA), and we will enter into a Data Processing Addendum (DPA) incorporating them. For customers in Canada and Australia, we remain accountable for the personal information we handle and use contractual and organizational measures intended to provide a comparable level of protection while it is processed in the US. Contact us to request our data-processing terms or transfer safeguards.
8. The company information in our database
The information Instinct MCP returns is business information about companies — such as firmographics, technology and vendor detection, operating-maturity scores, reputation, and other company-level signals — compiled from publicly accessible and third-party sources. It describes organizations, not individuals: the service does not provide personal contact information (individuals' names, personal email addresses, or phone numbers). Because this database is company/business data rather than personal information, the individual-privacy rights in this policy apply to your own account information (Sections 3–4 and 11), not to the company database.
9. Data retention
We keep personal information only as long as needed for the purposes above:
- Account & identity: while your account is active and for 90 days after
closure, then deleted or anonymized.
- Billing & tax records: retained for 7 years to meet tax and accounting
obligations.
- Usage/security logs: retained for 12 months, then deleted or aggregated.
10. Security
We use industry-standard measures including TLS in transit, encryption at rest, OAuth 2.1 authentication, least-privilege database roles, and access controls. No method is perfectly secure, but we work to protect your information and to notify you and regulators of incidents where required by law.
11. Your rights
Subject to your location and applicable law, you may have the right to access, correct, delete, port, object to, or restrict processing of your personal information, and to withdraw consent. We do not sell your personal information or use it for targeted advertising, so there is nothing to opt out of there. We will not discriminate against you for exercising any of these rights.
- United States (California CCPA/CPRA and similar state laws): rights to
know, access, delete, and correct your personal information. We do not sell or share personal information, so there is no sale/share to opt out of. You may use an authorized agent and may appeal a decision. Response timelines follow the applicable law (generally ~45 days for CCPA, extendable).
- Canada (PIPEDA): access and correction rights; our email program complies
with CASL (consent + unsubscribe on any commercial email).
- UK / EU (GDPR): the rights in this section, plus the right to complain to
your supervisory authority (e.g. the UK ICO).
- Australia (Privacy Act / APPs): access and correction rights and the right
to complain to the OAIC.
To exercise any right, contact us (Section 12). We will verify your request and respond within the timeframe required by the applicable law.
12. How to contact us / make a request
- Email: support@foxcrowgroup.com
- Mail: Fox & Crow Inc., 302 Center Street, Mason, MI 48854, USA
- Phone: 1-888-712-1220
13. Children
Instinct MCP is a business service not directed to children. We do not knowingly collect personal information from anyone under 18, and if we learn that a user is under 18 we will remove them and delete their information. If you believe a minor has provided us information, contact us and we will delete it.
14. Changes to this policy
We may update this policy. We will post the new version here with a revised "Last updated" date and, for material changes, provide additional notice where required.