Trendalyse privacy notice

Website accounts

When you register, we store your email, a salted password hash, account creation time, encrypted SerpApi key if connected, session-token hashes, and daily AI usage. Your SerpApi key is used for your research requests and is never displayed back after saving. Sessions use an HttpOnly cookie and expire after seven days. Account details and encrypted credentials persist until removed by the operator; contact us to request account deletion. Disconnecting SerpApi removes the stored key. There is no email verification or password-reset delivery yet.

Public MCP service

MCP does not require an account and cannot read website accounts. It uses operator credentials, not customers' saved keys. We process the search terms, chosen region, and research results needed to answer a tool request. Do not submit personal, confidential, or sensitive information.

To enforce public limits, we store daily counts and a keyed hash derived from the caller IP and the UTC day, not the raw IP in the usage table. Usage rows older than seven days are removed when a later public research reservation runs. Hosting and networking providers may process connection metadata, including IP addresses, under their own policies.

Public MCP job results and their random capability IDs are held in server memory for up to one hour and are lost on restart. Anyone possessing a job ID can retrieve that result until it expires. Jobs can continue after the calling assistant disconnects; their deadline is 330 seconds or midnight UTC, whichever comes first.

Third parties and processing

SerpApi receives search terms and region settings to fetch Google Trends and Google search evidence. DeepSeek receives search evidence and prompts to generate ideas. Cloudflare provides the HTTPS tunnel and may process network metadata. Your assistant provider also processes your conversations and tool results under its own terms. We do not send your Trendalyse password to these providers.

Provider retention and training practices are governed by their respective policies, not by this notice. See SerpApi privacy, DeepSeek, and Cloudflare privacy. We do not promise zero retention or make a training opt-out claim.

Operational records and choices

The application logs service failures for diagnosis; provider errors can include query or response excerpts. Container logs are size-rotated rather than retained for a guaranteed number of days. Account AI usage older than 30 days is pruned during later AI usage updates. No advertising tracker is added by MCP. You can stop using the public tools, disconnect a connector in your assistant, remove a saved SerpApi key, or contact us about access, correction, and deletion.

This notice describes the current implementation and may change with the service. Updated notices will be published here.