Privacy and data handling for Cookiedeal MCP

This addendum explains how Cookiedeal handles data when users connect Cookiedeal MCP to ChatGPT, Claude or another MCP client. It supplements the main Cookiedeal Privacy Policy and does not replace it.

What this addendum covers

Cookiedeal MCP provides Korean company search, public summaries, supported OpenDART disclosures, view-only corporate and real-estate registry documents, company lists, account-scoped business signals and notifications. It supports explicitly requested changes such as marking selected notifications read. Access follows the connected account, OAuth scopes, current organization, existing subscription and applicable permissions. Business-card lookup is not provided by the current MCP tools.

Data Cookiedeal MCP may access

The exact data depends on the tool called, the user’s OAuth scopes, and the user or organization’s Cookiedeal access rights.

Account context

Basic connected account information, the active organization context, organization role, and billing owner context needed to enforce access rights.

Company data

Company search results, public summaries, supported OpenDART disclosures, availability and access status, and authorized content. Normalized financial, ownership, people and supply-chain details are opened on the Cookiedeal website rather than returned by these MCP tools.

Usage credits

Existing Cookie balance, maximum usage estimates, applicable entitlements, and actual Cookie usage returned by an authorized execution. Quotes and balances are not payment instructions.

Registry data

Supported corporate and real-estate search or request information, request and analysis status, authorized view-only document links, and applicable re-view status.

Company lists and signals

Accessible lists and their company membership, tracking summaries, signal categories, event dates, descriptions and source links. Signal queries follow the requested tracked-company, accessible-list or explicit-company scope. The MCP does not edit tracking settings.

Notifications

The connected account’s web inbox items, related company and event information, read state and unread counts. A user-directed read operation changes only the specified notifications belonging to that account, or its entire inbox only if explicitly requested. The MCP does not send notifications.

Audit data

Tool name, user, organization or billing owner, target company or registry request, charged credits, result code, timestamp, and technical request metadata needed for support, security, and billing audit.

How Cookiedeal uses MCP data

Answer user requests

Cookiedeal uses tool inputs and authorized service data to fulfil the user’s request and return grounded company intelligence to ChatGPT, Claude or another connected MCP client.

Enforce access rights

Cookiedeal checks user authentication, OAuth scopes, organization membership, credit balance, company detail entitlements, and corporate registry re-view eligibility before returning protected data.

Track credit consumption

Credit-consuming MCP actions are recorded so users, organizations, and Cookiedeal support can understand which actions consumed credits and why.

Provide support and security

Audit logs and technical metadata are used to troubleshoot connector issues, investigate abuse, protect the service, and meet legal or operational obligations.

How tool results are shared with the connected AI service

User-directed tool results

When a user or authorized client calls a Cookiedeal MCP tool, its results are returned to that client for the requested interaction. ChatGPT, Claude and other clients process those results under their provider’s applicable terms, privacy policy, workspace settings and user controls. This addendum does not replace those policies or promise identical retention or model-training settings across providers.

• Cookiedeal does not send MCP tool results to a client unless the user or authorized client calls the MCP tool.
• Users should avoid requesting unnecessary personal or confidential information in prompts.
• Organization users should follow their organization’s internal AI and data handling policies.

Retention and audit logs

Cookiedeal retains account, organization, list, tracking, notification, entitlement, Cookie-usage, registry and audit records according to Cookiedeal service policies, legal obligations, security needs, and operational support requirements.

• MCP access tokens and refresh tokens are managed by Cookiedeal OAuth infrastructure.
• Paid MCP actions are logged for credit consumption, entitlement, support, and fraud-prevention purposes.
• Registry document links may expire and can be refreshed through Cookiedeal MCP status tools when allowed.

User and organization controls

Client disconnection

Users can disconnect Cookiedeal MCP through the connected client’s settings. Disconnecting does not by itself delete existing Cookiedeal account data or required audit records.

Cookiedeal account access

Users can manage their Cookiedeal account, organization access, lists, tracking and notification settings through Cookiedeal products, subject to applicable service policies. Read-state changes require the relevant scope and remain limited to the connected account.

Organization controls

Cookiedeal Pro organization owners and admins can manage members and review organization credit usage, purchased company access, and related organization activity.

Credit-consuming actions

Some features included in an existing eligible subscription consume Cookies already held by the selected organization. These are real balance debits. The MCP does not initiate cash payments, sell or top up Cookies, start or upgrade a subscription, or refund, transfer or exchange Cookies.

• Quotes report maximum applicable Cookie usage without consuming Cookies. Execution requires the user’s explicit maximum-usage approval and service-side eligibility checks.
• An authorized data operation may create a seven-day access entitlement; an authorized registry operation may create a view-only document request and consume applicable Cookies. The result reports actual usage.
• Insufficient-credit and quote-mismatch responses do not consume credits.
• Account-scoped list, signal and notification reads do not consume Cookies.

Security measures

• OAuth 2.1 authorization is required for authenticated and protected data access.
• Tool access is limited by OAuth scopes and Cookiedeal service-side authorization checks.
• MCP requests are rate-limited and audited to protect users, organizations, and Cookiedeal systems.
• Users should only connect the official MCP server URL: https://mcp.cookiedeal.io/mcp.

Privacy requests and data rights

Users may contact Cookiedeal to ask questions about privacy, access, correction, deletion, or other rights available under applicable law and Cookiedeal policies.

Support contact

For Cookiedeal MCP privacy or support questions, contact info@cookiedeal.io. For connector setup and usage details, see the Cookiedeal MCP documentation.