Privacy notice

Updated 16 October 2026 · Private preview

Who operates this service

MCP by SI Lab is a BLACK& product operated by BLACK HOLDINGS S.R.L., Romania. For privacy questions, contact hello@silab.ro.

Data processed

The hosted service receives your Supabase account identifier, email and display name. It stores your workspace name, connector configurations, datasets, tool definitions, published snapshots, hashed server keys, approval requests and operational audit events. Approval arguments and approved execution results are stored to support review. Avoid uploading sensitive personal information during this preview.

Why data is processed

Data is processed to provide the workspace, authenticate access, execute the operations you configure, enforce approvals and support security and troubleshooting. Providing the requested service is the purpose of account and configuration processing. Security logging supports the operator’s legitimate interests in protecting the service. This notice does not substitute for a data processing agreement for organizational deployments.

Infrastructure and external systems

This edition uses Vercel for hosting and server execution, Supabase Auth for account authentication, and PostgreSQL for storage. Configured API tools send their arguments to the endpoints you authorize. If you connect external AI clients, their handling of tool outputs is governed by their own terms and your agreements. The service does not itself send workspace data to an AI model for inference.

Credentials and security

Server bearer keys are shown once and stored as hashes. Upstream credentials must be configured as runtime secrets; connector configurations store variable names. Secret-like output keys are masked, but this does not guarantee removal of all personal or confidential data.

Retention and your rights

Records remain while your workspace is active unless removed through available controls or by contacting the operator. Published snapshots retain the configuration used at publication, even if a draft tool is removed. Audit and approval records are retained for review; automatic retention schedules are not configured in this preview. Contact the operator to request access, correction, export or deletion, and to discuss objections or restrictions. Where applicable, you may complain to the competent data protection authority.

Browser storage

The app does not use advertising or analytics trackers. Authentication cookies are managed using Supabase SSR. The browser URL hash records the selected dashboard section. The operator has not verified a particular data residency region for this preview.

Organizational use

Do not connect production personal data until your organization has approved the processing arrangements, retention, transfers and access controls. Contact the operator for the deployment-specific terms and contractual details.