Privacy Policy

Last updated: 2 August 2026

1. Introduction

Gatana (“Service”), operated by Accendo Consulting GmbH (“Company”, “we”, “us”, or “our”), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service.

Where we process personal data on behalf of a customer organization, we act as a processor under our Data Processing Agreement. This Privacy Policy covers the personal information for which we act as controller — principally account administration, billing, website analytics, and security logging.

2. Who We Are


Controller	Accendo Consulting GmbH
Registered address	Gatana c/o Accendo Consulting GmbH, Werdstrasse 122, 8003 Zürich, Switzerland
Company registration	CHE-487.652.075
Privacy contact	[email protected]
Security and incident reports	[email protected]

We have not appointed a Data Protection Officer. We are not required to do so, as we do not carry out large-scale monitoring of individuals or process special categories of data as a core activity.

We are established in Switzerland and process personal data under the Swiss Federal Act on Data Protection (FADP). Where we offer the Service to individuals in the European Economic Area or the United Kingdom, the EU GDPR and UK GDPR also apply.

3. Information We Collect

3.1 Information You Provide

We collect information you provide directly to us, including:

Account information (name, email address, organization details)
Contact information for customer support
MCP server configurations and metadata
Communications with our support team

3.2 Information We Collect Automatically

When you use our Service, we automatically collect:

Usage data (features used, time spent, actions taken)
Device information (IP address, browser type, operating system)
Log data (access times, pages viewed, errors encountered)
Performance and diagnostic data

3.3 Information from Third Parties

We may receive information about you from:

Authentication providers, if you use federated sign-in
Stripe, our payment processor
Google, through the analytics described in Section 5

4. How We Use Your Information and Our Legal Basis

Purpose	Legal basis
Provide, maintain and operate the Service	Performance of a contract (GDPR Art. 6(1)(b))
Process payments and issue invoices	Performance of a contract, and legal obligation for accounting records (Art. 6(1)(b) and (c))
Send technical notices, updates and support messages	Performance of a contract (Art. 6(1)(b))
Respond to your questions and support requests	Performance of a contract (Art. 6(1)(b))
Monitor usage and improve the Service	Our legitimate interest in understanding how the Service is used (Art. 6(1)(f))
Website analytics (see Section 5)	Our legitimate interest in measuring website traffic (Art. 6(1)(f))
Detect and prevent fraud, abuse and security incidents	Our legitimate interest in keeping the Service secure (Art. 6(1)(f))
Comply with legal and regulatory obligations	Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interests, you have the right to object — see Section 10.

5. Analytics and Cookies

5.1 What runs on this website

This website loads Google Tag Manager, which may in turn load Google Analytics and similar Google services. It loads when a page loads. Google receives your IP address, browser and device information, and the pages you view, and may set cookies in your browser.

We also store a single preference in your browser’s local storage (gatana-nerd-mode) to remember a display setting you have chosen. It contains no personal information and is not shared with anyone.

We do not currently present a cookie consent banner, and analytics load without asking you first. We rely on our legitimate interest in measuring website traffic as our legal basis. You should be aware that EU and UK rules on cookies generally require prior consent for analytics of this kind, and that we do not currently offer that choice.

You can block or delete these cookies through your browser settings, or by using a browser extension or ad blocker that blocks Google Tag Manager. Doing so does not affect your ability to use the Service.

If you would prefer we not process your website analytics data, contact [email protected] and we will exclude you.

5.3 The Service itself

The application requires cookies and local storage that are strictly necessary to keep you signed in and to operate the Service. These cannot be disabled without preventing the Service from working.

With Your Consent: When you direct us to share information
Service Providers: With the vendors we use to operate the Service, including Hetzner (hosting), Google Cloud (encryption key management and analytics), Amazon Web Services (email delivery), Cloudflare (DNS and content delivery), OVHcloud (encrypted backups), and Stripe (payments). The sub-processors that handle data we process on a customer’s behalf are listed in Section 5.2 of our Data Processing Agreement.
Business Transfers: In connection with mergers, acquisitions, or asset sales
Legal Requirements: To comply with laws, regulations, or legal processes

Third-party services that you or your end-users connect to the Service — the applications your agents act upon — are not our service providers. You control those relationships. This is set out in Section 5.5 of the Data Processing Agreement.

6.2 We Do Not:

Sell your personal information to third parties
Access any secret or sensitive data unless on the explicit instruction from you
Share your MCP server data with unauthorized parties
Use your data to compete against your organization
Use your data to train artificial intelligence or machine learning models

7. Data Security

We implement appropriate technical and organizational measures to protect your information, including per-customer envelope encryption with keys held in Google Cloud KMS, encryption in transit, restricted and multi-factor authenticated access to production systems, and independent audit logging of key access.

The full set of measures is listed in Annex 2 of our Data Processing Agreement and summarised on our Security page.

8. Data Retention

Data	Retention period
Account information and credentials	Duration of the relationship, plus 30 days
Per-customer encryption keys	Duration of the relationship, plus 30 days, then destroyed
Application and infrastructure logs	90 days
Database audit log	12 months
Encryption key access logs	400 days
Database backups	30 days on a rolling basis
Invoices and accounting records	7 years
Incident records	3 years

Where a legal obligation requires a longer period, the longer period applies. Deletion of encrypted data is achieved by destroying the encryption key, which renders any remaining copies permanently unreadable.

9. International Data Transfers

Your information is stored at rest within the European Union. Three exceptions apply:

Traffic to the Service passes through Cloudflare’s global network before reaching our infrastructure.
Website analytics are processed by Google, as described in Section 5.
Payment processing is handled by Stripe.

Each of these providers operates under its own transfer safeguards, including Standard Contractual Clauses or the EU–U.S. Data Privacy Framework. Transfers of data we process on a customer’s behalf are addressed in Section 6 of our Data Processing Agreement.

10. Your Rights

Subject to the conditions in applicable law, you have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Delete your data
Restrict how we process your data
Port your data to another provider in a structured, machine-readable format
Object to processing based on our legitimate interests, including website analytics
Withdraw consent at any time, where we rely on consent

To exercise any of these, contact [email protected]. We respond within one month. You can also access and update your account information directly in the Service settings.

Complaints. If you believe we have handled your personal data improperly, you may lodge a complaint with a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC). In the EEA or the UK, you may complain to the authority in your country of residence.

Automated decision-making. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

11. Children’s Privacy

The Service is intended for business use and is not directed at children. We do not knowingly collect personal information from anyone under 16. If we become aware that we have, we will delete it.

12. Third-Party Services

Our Service may contain links to third-party websites, and allows you to connect third-party services through the MCP Gateway. This Privacy Policy does not apply to those services, and we are not responsible for their privacy practices. Review their policies before connecting them.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Where a change materially affects your rights, we will give at least 30 days’ notice by email or through the Service before it takes effect, consistent with Section 14 of our Terms of Service. Other changes take effect when posted, and we update the “Last updated” date above.

14. Contact Us

For questions about this Privacy Policy or our privacy practices, contact [email protected].

To report a suspected privacy incident, a security vulnerability, or unauthorised access to data, email [email protected]. We acknowledge these reports within one business day. See our Security page for details.

Our Privacy Policy