Privacy Policy

Version 1.6. Effective 4 November 2026.

This policy explains how Manifold ("Manifold", "we", "us" or "our") collects, uses and shares personal data when you use the Manifold website at manifoldmcp.com (the "Site"), the application at app.manifoldmcp.com (the "App"), the MCP server at mcp.manifoldmcp.com and its HTTP API (the "Server"), and when you contact us (together, the "Service"). It also explains your rights.

We are Jesse Sibley, trading as Manifold, a sole trader in the United Kingdom. We are the controller of the personal data described in Sections 2 to 4, and we are registered with the Information Commissioner's Office (registration pending). Section 5 explains the different position for data about other people that the Service returns on your instruction.

Contact us about anything in this policy at jesse@manifoldmcp.com.

1. What the Service is

Manifold is one MCP server of marketing data tools. An AI agent or MCP client that you connect can ask it for search rankings and keyword data, backlinks, site health, what AI engines say about a site, data from your own Google Search Console, Google Analytics and Bing Webmaster Tools accounts, professional contact data, public ad libraries, and public posts and profiles on Reddit and other social platforms. It can also run monitors: lookups that you or your agent set up to repeat on a schedule, so the Service can report what changed since the last check. The Service reads and reports. The one exception is that, when your agent asks, it can submit a sitemap or URLs to your own connected Search Console or Bing account so the search engine crawls them. It never posts anything, and the only emails it sends are to you and the members of your workspace.

2. The personal data we collect about you

Account data. When you sign in we receive from our identity provider, Clerk, your name, email address, profile picture and a user identifier, and, if you sign in with Google, the identifier Google gives us for you. We do not see your password.

Workspace data. The name of each workspace you belong to, who its members are, their roles, and which workspace you last used.

Billing data. Your plan, your credit balance and its history, your invoices, the amount of any auto top-up you set, and a customer identifier at our billing providers, Autumn and Stripe. Your card details are collected and stored by Stripe; we never see the full card number.

Usage data. For every tool call made through your workspace: the tool called, the data provider used, the credits charged, whether the result came from the cache, the time, whether the call came through OAuth or an API key, which user or key made it, the target of the call (for example the domain or keyword looked up), and which MCP client made the call (for example Claude or Cursor). For the slower tools, the parameters and results of the task, for 30 days. This usage data is sent to our analytics provider, PostHog, to help us understand which tools are used, what they cost us, and how well the Service performs.

API keys. The name you give a key, its first characters, a hash of the key, and when it was created, last used and revoked. We do not store the key itself.

Connected accounts. When you connect a Google account (Search Console, and Google Analytics if you leave that permission ticked) or a Bing Webmaster Tools account: the email address and identifier the provider gives us for it, the permissions it granted, and an encrypted refresh token or, for Bing, the API key you pasted. The Search Console, Analytics and Bing data the tools fetch from those accounts is returned to your agent and cached for a short period as described in Section 8; we do not keep it otherwise.

Monitors. For each monitor in your workspace: its name, description, settings (the keywords, accounts, pages, sites or prompts it watches) and schedule, who created it, and when each check ran and what it cost. To tell what is new, a monitor keeps what each check saw and a record of each change it found. A change keeps a short summary we write (for example that a thread mentioning your keyword was posted, or that an AI answer stopped naming your brand) for as long as the monitor exists. The third-party text attached to a change (the title of a thread, post or page, the post's author, a short excerpt, and its likes, comments and views) is cleared after 30 days, and the text of an ad is cleared 30 days after the ad was last seen. We never store whole posts or the full text of an AI answer. We also keep each member's choice of which monitors may email them, and a record of the alerts we sent.

MCP client data. When an agent connects through OAuth, Clerk records which client it is (for example Claude or Cursor), the permissions you granted it, and when. For analytics purposes, we also record which client made each tool call, so we can understand which clients are being used and improve the Service accordingly.

Technical data. Our hosting provider, Cloudflare, logs each request to the Site, App and Server: IP address, browser or client identifier, the URL, timing and result, and a request identifier. We keep error and invocation logs and per-call metrics for the operation of the Service.

Communications. Anything you send us by email or through a support channel, and our replies. This includes the feedback reports your agent sends with the submit_feedback tool, described below.

We do not collect sensitive (special category) data and ask you not to send us any.

Feedback and free-form content

The submit_feedback tool lets your agent send us a report: an error it hit, a result that looked wrong, a missing tool, or anything you ask it to pass on.

What we store. For each report: the free-form message your agent wrote (up to 4,000 characters), the kind of report, the tool and request identifier it is about if your agent gave them, the name and version of the MCP client it was sent from, whether it answered our one request for feedback (below), your workspace identifier, whether it came through OAuth or an API key, which user or key sent it, and when. Because the message is free-form, it contains whatever your agent chose to write, which can include domains, keywords or parts of your conversation. Please do not ask your agent to send personal or confidential information in a report.

Asking for feedback. Once per workspace, after it has been used on a few different days, one tool result asks your agent to ask you, when your task is done, whether you have feedback on Manifold. Your agent sends a report only if you answer.

Where. Reports are stored in our database at Cloudflare and emailed to our team's inbox through Cloudflare's email service (Section 7). We read them to fix problems and improve the Service. The message is not sent to PostHog or any other provider; our analytics record only that the tool was called.

How long. Reports are not deleted automatically, and deleting a workspace does not delete them. We keep them until we no longer need them or you ask us to delete them. To have your reports deleted, email jesse@manifoldmcp.com.

Free tools on the Site

The Site's free tools (at manifoldmcp.com/free-tools) run without an account.

What we process. What you type into a tool (a brand, domain, keyword, topic, handle or video link) is sent to the same data providers that answer the Server's tools, to produce the result, and the result may be kept in our cache as Server results are (Section 8). To stop automated abuse, each run is checked by Cloudflare Turnstile, which looks at signals from your browser and your IP address, and your IP address is used to limit how often you can run each tool. We store that limit as a count per tool per day against a keyed hash of your IP address, never the address itself.

How long. The counts are deleted after two days. Our analytics record that a tool was run and whether it answered, not what you typed.

3. Why we use it, and our lawful bases

We do not use your personal data for marketing to third parties, for advertising, for profiling, or for automated decisions that have a legal or similarly significant effect on you. If we send you product news, you will be able to opt out in every message, and we will rely on the soft opt-in for existing customers under the Privacy and Electronic Communications Regulations 2003 or on your consent.

4. Who we share it with

We share personal data only with the providers below, who process it on our behalf under contracts that require them to protect it, and otherwise only as stated after the table.

The data providers in the last four rows receive only what a tool call needs. They do not receive your name, email address or account identifier.

We may also share personal data with our professional advisers (lawyers, accountants, insurers) where they need it to advise us; with a buyer or successor if we sell or transfer our business, in which case this policy will continue to apply; and with courts, regulators and law enforcement where we are required to, or where we believe in good faith that it is necessary to protect the rights, property or safety of Manifold, our users or others.

We do not sell personal data, and we do not share it with advertisers.

5. Data about other people that the Service returns

Several tools return information about identifiable people: the leads_* tools return names, job titles, employers, work email addresses and similar professional data from verified email lookup providers; the social and Reddit tools return public profiles, posts and comments; and the AI answer tools may quote content that names people.

For that data, the customer whose agent made the call is the controller. They decide what to look for and what to do with the result, and they are responsible for having a lawful basis for it. We act as their processor: we pass the request to the data provider, return the result to their agent, and hold a copy in our cache, in our task store for the slower tools, and in the customer's monitors, for the periods in Section 8. We do not build or keep a database of people from these results, we do not combine results across customers, and we do not use them for any purpose of our own beyond operating the cache.

Our data providers are independent controllers of the data they hold and supply. Search, keyword and AI answer data is covered by DataForSEO's privacy policy. Social, Reddit, ad library, company and professional contact data come from specialist providers that receive only the parameters of each call.

If you are one of the people this data is about, you can ask us at jesse@manifoldmcp.com to remove any copy of your data from our cache, task store and monitors, and we will do so within 30 days and tell you which providers the data came from so that you can contact them. We cannot remove you from our providers' databases or from the public platforms the data describes.

6. Google API Services User Data Policy

The App connects to Google Search Console and Google Analytics 4 through Google APIs. The Search Console scope allows reading your Search Console data and submitting sitemaps; the Google Analytics scope (analytics.readonly) allows reading your Google Analytics data. The tools use those permissions for nothing else.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use that data only to provide the console and analytics tools to the workspace that connected the account; we do not transfer it to anyone except as necessary to provide those tools, to comply with law, or as part of a merger or acquisition with notice to you; we do not use it for advertising; we do not use it to train AI or ML models; and no human at Manifold reads it except with your permission, for security purposes, to comply with law, or in aggregated and anonymised form for internal operations. Google user data is not used to develop, improve or train generalized AI or ML models.

7. International transfers

We are based in the United Kingdom, and our providers store and process data in the United Kingdom, the European Economic Area and the United States. Cloudflare processes requests at the data centre nearest the caller and stores our data in the United Kingdom and the European Economic Area (Cloudflare's D1, KV and R2 services). Where personal data leaves the United Kingdom for a country the UK Government has not found to give adequate protection, we transfer it under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or, for providers certified under the UK Extension to the EU-US Data Privacy Framework, under that framework. You can ask us at jesse@manifoldmcp.com for details of the mechanism used for a particular provider.

8. How long we keep it

When we no longer need personal data we delete it or anonymise it. Where deletion from a backup is not immediately possible, the backup is overwritten on its normal cycle and the data is not restored from it.

9. Cookies and similar technologies

The Site sets no cookies. The App uses only cookies that are strictly necessary to run it: Clerk's session cookies, which keep you signed in and protect against cross-site request forgery, and which last until you sign out or the session expires. The App stores your theme preference in your browser's local storage. Neither is used for analytics or advertising, so no consent banner is shown. You can clear these through your browser, though the App will then sign you out. The Server sets no cookies; it authenticates each request by its bearer token.

10. Security

Everything in transit is encrypted with TLS. API keys are stored as SHA-256 hashes. Connected-account refresh tokens are encrypted at rest with AES-256-GCM under a key held in our hosting provider's secret store, separate from the database. Access to production systems is restricted to the people who operate the Service and protected by multi-factor authentication. Payment card details never touch our systems. No system is perfectly secure; if we learn of a breach that is likely to affect your rights, we will tell you and the ICO without undue delay, as the law requires.

11. Your rights

Under the UK GDPR you have the right to: access the personal data we hold about you; have it corrected if it is inaccurate; have it erased where we no longer need it or you object and we have no overriding reason to keep it; restrict how we use it while a question about it is resolved; receive a copy of the data you gave us in a portable format; object to processing we base on our legitimate interests, and to any direct marketing; and withdraw consent where we rely on it, without affecting what was done before.

You can see and change your account details, workspace, keys, connected accounts and billing in the App, and delete a workspace from its settings. For anything else, email jesse@manifoldmcp.com. We will reply within one month, and we may ask you to confirm your identity first. There is no fee unless a request is manifestly unfounded or excessive.

If you are unhappy with how we handle your data or your request, you can complain to the Information Commissioner's Office at ico.org.uk, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to resolve it first. If you are in the European Economic Area you may also complain to your local supervisory authority.

12. Children

The Service is not for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We will post any new version here with a new date and version number. If a change materially affects how we use your personal data, we will tell you by email or in the App at least 30 days before it takes effect.

14. Contact

Email: jesse@manifoldmcp.com. Postal address: available on request from jesse@manifoldmcp.com.

Adapted from the General Legal Privacy Policy (GDPR Enhanced) template, released under CC0 1.0, for a controller in the United Kingdom.