Privacy Policy

Last updated 19 August 2026.

This page says what docs2mcp collects, who else sees it, where it is processed and how long it is kept. It describes what the service does today, not what it might do later.

Who we are

docs2mcp is operated by Docs2MCP S.L., registered at Calle General Perón 1, 29620 Torremolinos in Spain under registration number B57429722. Docs2MCP S.L. is the controller of everything described here.

support@docs2mcp.com is the address for every request on this page, and for anything here you think is wrong.

What we collect

• The files you upload, and everything inside them.
• Their filenames, exactly as your computer gave them to us. A filename can identify a person on its own, and we do not rewrite yours.
• What we take out of a document to make it searchable: its text, how that text is laid out across pages and passages, the figures, and the numeric representations of the text that a search runs against.
• Your searches, as typed. We keep the words you searched for, alongside which tool was called and when.
• Your email address, if you create an account. Signing in is a code sent to that address rather than a password, so there is no password to store.
• Counts: how many tokens of text were processed for your organisation, how many queries it ran, and how many requests it made in the current window. That is how a plan's ceilings and its rate limits are enforced. We also keep a ledger of what our own model calls cost us, one line per call, in tokens and in money.
• If you pay us, a Stripe customer id and the record of each payment. Stripe itself collects the payer's email address and card details, and asks for a billing address where it needs one.

We ask you for no name, no job title and no company. If a document you upload contains any of those, we hold it because it is in your document, not because we asked for it.

Why, and on what basis

Everything needed to run the service — storing a document, converting it, indexing it, answering a search, keeping your account attached to your documents — we process to perform our contract with you.

The counts, and the record of which tool ran when, we process on our legitimate interest in keeping the service standing up: enforcing a plan's ceilings and its rate limits, and investigating abuse. The ledger we keep on the same interest, for the one thing it answers — what the service costs us to run.

The record of what you paid us we keep because tax law obliges us to.

Who else processes it

• OpenAI — receives text from your documents when we index them, and the words of every search you run. See the next section.
• Cloudflare — serves this site and the app (Pages), stores the files you upload (R2), and holds the retired waitlist table (D1). Like any host of a web page, it sees the IP address of every request made to one.
• Railway — runs our servers and the database holding your documents' text, your searches and your counts.
• Supabase — our sign-in provider. It holds your email address and the identity your session belongs to. Our own database records a reference to that identity and not the address itself.
• Stripe — takes payment. Your card details go to Stripe and never to us.

That is the whole list. We sell nothing to anybody, and we use your documents to train no model of our own.

Where it is processed

Everything we run ourselves sits within the European Union. Our servers and our database are on Railway, in its Amsterdam region. The files you upload live in Cloudflare R2, under R2's EU jurisdiction. Your sign-in identity is with Supabase, whose region is eu-west-1 — Ireland. Two countries, which is why this section names a union rather than a city.

Text from your documents is sent to OpenAI, and so is every search you run. It goes on two occasions: when we build the index, to generate the embeddings and extract the metadata that make search work, and each time a search runs, to turn the words you searched for into the same kind of embedding. There is no way to use docs2mcp without that happening, and running everything else within the European Union does not change it. If your documents are confidential, this is the paragraph to read twice.

How long we keep it

If you upload without an account, your documents go 48 hours after your first upload. The following go with them: the files, the text taken from them, the search index, your searches, and the anonymous identity itself. Creating an account before then keeps your documents and stops that clock.

With an account, your documents stay until you remove them, except on the Free plan, where a document may be removed 30 days after it was uploaded and we email you before that happens.

Four kinds of record about your use of the service outlast your documents, and none of them holds any part of one. We keep your searches, which hold the words you typed and not the passages we returned. We keep a count of what your organisation used, which holds no words at all. If you have paid us, we keep the record of what you paid and when. And we keep the ledger of what our own model calls cost us.

Deleting your organisation — by closing your account, or by letting the 48 hours run out — takes the first two of those with it. Three things stay after that. The record of what you paid, for as long as tax law requires us to hold it. Stripe holds a copy of that record too: the payer's email address, and a billing address where Stripe asked for one. Nothing here deletes Stripe's copy. The ledger, which is token counts and amounts of money, and which never carries a word of a document or of a search. And one thing that was not on that list: your email address, if you created an account. It sits with Supabase, our sign-in provider, and no deletion here reaches it — we remove it by hand when you ask. An identity created without an account never carried an address, and goes with everything else.

Your rights and how to use them

To erase your documents yourself: open your account page, find Danger zone, and use Delete all documents. It takes effect the moment you confirm it, and waits for nobody here.

To close your account entirely: use Request account deletion on the same page, which opens an email to us. That one is not automatic — a person acts on it, within 30 days.

You can also ask us for a copy of what we hold about you, for a correction to it, for it in a portable form, or to object to our processing it. Write to support@docs2mcp.com and we will answer within 30 days.

If you think we have handled your data badly, tell us first if you are willing to. Either way, you can complain to the data protection authority of the country you live in.

Cookies and local storage

This site sets no cookies. There is no analytics, no tag manager and no third-party script on any page of it.

One third-party request does happen, and it is fair that you know about it. Every page here loads a font stylesheet from Google Fonts, which then fetches the font files themselves from Google. Google receives your IP address each time a page loads. Nothing else on these pages comes from anywhere but us.

The app at https://app.docs2mcp.com keeps your sign-in session in your browser's localStorage. That is not a cookie and is never sent to us on its own, but it is data stored on your device, and clearing your browser storage signs you out.

The waitlist

These pages used to carry a waitlist form. The form and the endpoint behind it were removed in August 2026, and nothing on this site asks for your email address now. The Cloudflare D1 table the form wrote to was checked after it came down and held no addresses at all.

If you believe you gave us an address that way, write to support@docs2mcp.com and we will look and remove it.

Changes

We may change this policy. The date at the top of this page is the date it last changed, and the version on this page is the version that applies.

Where a change materially affects your rights, we will email the address on your account before it takes effect. If you use the service without an account, check this page.