Privacy Policy

Last updated: 17 October 2026

This policy explains what personal data MCP Harbor (mcpharbor.app) collects, why, and the choices you have. We keep it short because we collect very little.

Who we are

MCP Harbor is operated by SPONE FZCO, DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates ("we", "us"). For privacy questions or requests, email privacy@gcctenderalerts.com (our operator's privacy inbox) and mention MCP Harbor.

What we collect

Directory listings. Listings are built from public metadata on GitHub and npm: project name, description, repository and homepage URLs, the public owner/organisation name, stars, language, licence and topics. We do not collect private contact details from those sources.
Submission form. When you submit a tool we store the tool name, URL, description, whether you are interested in a featured listing and, only if you provide it, your email address. To limit spam we store a one-way hash of your IP address (we do not store the IP itself). We receive an email notification of each submission.
Payments. Featured listings and job posts are paid through Stripe Payment Links. Stripe collects your name, email, billing details and card information and processes them under its own privacy policy. We receive the payment record (for example your name, email, amount and what you bought) but never your full card number.
Remote MCP endpoint. Search queries sent to /mcp are processed to return results. We do not store them or link them to a person.
Technical data. The site is hosted on Cloudflare, which processes standard request data (such as IP address, user agent and time) to deliver and secure the service. We do not use analytics, advertising or tracking cookies.
Cookieless analytics. We count page views, referring sites and button clicks in aggregate, without cookies or identifiers and without storing IP addresses.

How we use it

To run the directory, review and publish submissions, deliver featured listings and job posts you pay for, answer you when you write to us, prevent abuse, and meet our legal and accounting obligations. We do not sell personal data and we do not send marketing emails.

Who we share it with

Only with service providers that help us run MCP Harbor: Cloudflare (hosting, storage and email delivery) and Stripe (payments). They may process data outside the UAE. We may also disclose data if the law requires it.

How long we keep it

Submissions: while we review them and, if accepted, for as long as the listing is live. Rejected submissions are deleted on request, and you can ask us to delete yours at any time.
Payment and invoice records: as long as UAE accounting and tax laws require.
Public listings: until the project is removed from the directory, for example after a removal request.

Your rights

You can ask us to access, correct or delete your personal data, to object to or restrict its use, or to withdraw consent, including under the UAE Personal Data Protection Law and, where it applies to you, the GDPR. Project maintainers can ask us to correct or remove a listing. Email privacy@gcctenderalerts.com; we reply within 30 days. You can also complain to your data protection authority.

Security

Data is stored on Cloudflare's infrastructure with access limited to what is needed to run the service. Admin access is protected by a secret token.

Changes

If we change this policy we will update this page and the date above.