Last Updated: August 2026

Privacy Policy

At Bendstack, we respect your code, your prompts, and your privacy. This policy explains how we protect your personal, project, and MCP integration data.

Policy Sections

1Information We Collect

When you use Bendstack and connect our Model Context Protocol (MCP) server, we collect information necessary to operate your cloud infrastructure:

  • Account & Auth Data: Your name, email address, OAuth profile, and developer identifiers.
  • MCP Tool & Project Data: Database schema definitions, API routes, workflow configurations, and prompts sent through your AI client (Claude, Cursor, ChatGPT, etc.).
  • Encrypted Secrets: API tokens, database credentials, and webhook endpoints managed within your sandbox environment.

2How We Use Data

We use your data strictly to power Bendstack's engine and execute your instructions:

  • Execute MCP tool calls to provision MySQL/TiDB database tables, endpoints, and authentication guards.
  • Host live application previews on *.bendstack.app domains.
  • Compile and package client code for Next.js, iOS/Android (Capacitor), and Desktop (Tauri) exports.
  • Monitor platform uptime, API health, and system security.

3AI & MCP Tool Privacy

Your prompts, schemas, and code logic are your intellectual property.

Bendstack does not sell your prompts or training data to third parties. When you connect Claude, Cursor, or ChatGPT to our MCP server at mcp.bendstack.com, your requests are processed strictly to execute tool instructions. We do not use your proprietary schemas, business logic, or generated frontend code to train global AI models.

4Cloud Infrastructure Security

We implement industry-standard encryption (AES-256 at rest, TLS 1.3 in transit) for all sensitive configurations and databases. Each project runs within an isolated environment, ensuring that your schemas, serverless functions, and application workflows remain completely segregated from other tenants.

5Third-Party Sharing

We do not sell, rent, or monetize your personal or project data. We only interact with trusted infrastructure providers:

  • Payment & Billing: Authorized merchant-of-record processors (e.g., Paddle) for commercial transactions.
  • Cloud Compute & Storage: Enterprise infrastructure providers (Firebase, Google Cloud, MySQL/TiDB providers) for reliable backend execution.

6Cookies & Tracking

We use essential cookies to manage authenticated sessions and secure dashboard access. Anonymous telemetry is used solely to monitor system latency, tool execution success rates, and site health.

7Your Privacy Rights

In accordance with GDPR, CCPA, and global privacy standards, you have the right to access, export, or permanently delete your account and associated database sandboxes at any time.

Have questions about your data?

Our privacy team is here to assist with any security inquiries.

Contact Privacy Team