← Home

Privacy

Effective 25 September 2026. Operator: Sun Business Group. Product: WebMCP Eval at www.webmcp-eval.com and https://mcp.webmcp-eval.com/mcp.

This page is the privacy policy for directory and connector review. Terms govern payment and acceptable use.

What we collect

• Wallet. Prepaid balance, last successful debit or reload time, Stripe checkout and payment identifiers needed to fulfill or refund a pack. Keys look like usr_live_. OAuth access tokens map to that wallet. We do not store card numbers.
• An evaluation request. The HTTPS URL you submit to evaluate_webmcp, plus the page content fetched so we can describe WebMCP surfaces and recommend tools. Failed fetches are not billed as full evaluations.
• Your email address (paid packs). When you buy a pack, Stripe, our payment processor, gives us the email address you entered at checkout, and we store it with your wallet. We use it only to run your account: to send or replace your key (for example, a one-time-view link after a key is rotated; the key itself is never put in the email), to send usage and account notices (credits remaining, credits expiring 12 months after purchase, or a pack that hasn't been used yet), to handle billing and support, and occasionally to ask for product feedback. We don't send marketing or sales solicitations to this address, we don't use it for advertising, and we don't sell or rent it. We share it only with the providers that help us run WebMCP Eval: Stripe (payments), Resend (email delivery, from clients.fxops.ai), and our hosting providers, or where the law requires. Our legal bases are performing our contract with you (key delivery, account and expiry notices, billing) and our legitimate interest in supporting your use of the product (feedback and reminders about unused credits). You can opt out of reminders and feedback emails at any time using the link in those emails or by writing to [email protected]; essential account and security notices will still be sent.
• Connector session. Host name of the client that completed OAuth (Claude, ChatGPT, Grok, Cursor, or another MCP host) so the consent page can name that host.

What we do not keep

We do not keep a first-party history of the URLs you evaluate, page titles, page sketches, or intent labels. The evaluation JSON in your agent chat is your copy. The default ledger is wallet-only.

An audit log of evaluated URLs is not on by default. If a buyer later needs one for their own client billing, that will be an explicit opt-in setting.

We do not run first-party analytics, advertising pixels, or session replay on this site.

How an evaluation is processed

To complete evaluate_webmcp we send the submitted URL and fetched page material to these subprocessors:

• Firecrawl (Firecrawl, Inc.) — scrape / sketch when the page must be read as a document. We send the URL and public HTML, not your wallet key, chat, or card.
• OpenAI — US-hosted inference used to classify the page and draft recommended tools. We do not train foundation models on your evaluations. We send page text needed for the eval, not your wallet key, chat, or card.
• Our browser worker (when used) — inspect in-page WebMCP tools on infrastructure we operate. It does not execute those tools.

Payment is processed by Stripe. Checkout cookies on Stripe’s pages are Stripe’s.

Checkout labels: when you start a checkout, we record how it began (the website button, an AI agent's checkout tool, or an in-app reload), whether the request came from a browser or an automated client, and the name of the referring website (for example x.com). We don't store your IP address, full browser details or page URLs with it. Repeated checkout attempts from the same network are briefly rate-limited using a temporary in-memory counter that isn't saved.

We use infrastructure hosts to run the MCP and this site. They see connection metadata the way any HTTPS host does. We do not sell personal data.

Retention

• Wallet and Stripe fulfillment records: while the wallet exists and as long as we must keep them for tax, dispute, or abuse review.
• Page content used during an evaluation: processed to produce the result, then discarded from our first-party store. Subprocessors keep their own logs under their policies for a short operational window.
• OAuth tokens: until you disconnect the host or we revoke abuse.
• Email on your wallet: kept while your wallet has unexpired credits, and for 90 days after your last credits are used up or expire, so we can answer support or key requests. Then we delete it from the wallet. Payment records, including the email on your Stripe receipt, are kept by Stripe and in our accounting records only as long as tax, dispute, or legal rules require.

What this product does not do

• It does not execute tools registered on the page you evaluate.
• It does not ask for passwords, cookies, or private URLs. Do not put secrets in the evaluated URL.
• Connect, tools/list, and get_credits are not billed. A successful evaluate_webmcp debits $2 from the prepaid wallet. Reload checkout is a separate Stripe payment you approve in a browser.

Your requests

Email [email protected] to close a wallet, rotate a key, or ask what we hold for an account_id from get_credits. We can confirm balance and last debit or reload. We cannot replay URL history we do not store.