MercurAI Terms of Service
Last Updated: September 2026
1. Acceptance of Terms
By accessing or using the MercurAI Platform, WebMCP Studio, and Data Engine, you agree to be bound by these Terms of Service. This agreement governs the relationship between MercurAI and the business subscribers utilizing our agent-enablement and vector search plans.
2. Service Distinction: Actuation vs. Search
MercurAI provides two distinct services. The Data Engine (Plans 1–3) provides semantic vector search, dataset retrieval, and MCP streaming capabilities over publicly verified commercial intelligence. The WebMCP Studio (Plans 4–5 / Platinum) provides an in-browser execution bridge enabling autonomous agents to perform deterministic tasks (actuation). WebMCP is strictly an application-layer interaction protocol and does not function as a passive search engine crawler or indexing mechanism.
3. Automated Scanning & W3C Schema Mapping
By registering a domain and installing our verification tags, you grant MercurAI express authorization to execute the WebMCP Auto-Discovery Probe on your web properties. This includes scanning your Document Object Model (DOM), public API endpoints, forms, and JavaScript window functions to generate technical JSON Schemas that align with the W3C Web Machine Learning Community Group draft specifications.
4. Data Processing & Storage Boundaries
MercurAI stores only structural tool definitions (technical metadata, JSON schemas, DOM selectors, and static text embeddings). For WebMCP executions, MercurAI does not capture, store, or process live consumer Personally Identifiable Information (PII) submitted through your website's forms or interactions. Live data transmission during agent actuation remains strictly between the user's local browser, their chosen AI agent, and your own server infrastructure.
5. Limitation of Liability for AI Actions
MercurAI provides the WebMCP Runtime Bridge to expose your site's functionality to autonomous third-party AI agents (e.g., Claude, Chrome-native Copilots) via the native document.modelContext.registerTool() API and progressive polyfills. MercurAI does not control these third-party agents. We are not liable for any actions executed by an AI agent on your website, including but not limited to hallucinated form submissions, unintended API triggers, or incorrect data retrieval initiated by the end-user's agent.
6. Customer Responsibilities
You are responsible for ensuring that the implementation of WebMCP tools on your website complies with all applicable privacy laws. You agree to utilize the is_auth_required flag for any tools that expose secure user data or execute sensitive account actions, ensuring conditional execution tied to active user sessions.
MercurAI Privacy Policy
Last Updated: September 2026
1. Information We Collect
- Account Data: We collect your name, email address, phone number, company name, and encrypted credentials when you register for a MercurAI subscription.
- Technical Metadata (WebMCP): When you configure WebMCP Studio, we collect and store structural blueprints of your website, including tool names, JavaScript function signatures, HTML selectors, and W3C draft-compliant JSON schemas. This data does not contain end-user consumer PII.
- Telemetry and Network Logs: Our API Gateway logs IP addresses, request timestamps, endpoint paths, status codes, and latency metrics for system monitoring, rate-limiting, and security auditing. Audit logs are retained for a maximum of 90 days.
2. How We Use Your Data
We use your information to provision API keys, authenticate domain ownership, facilitate FastMCP SSE connections, maintain pgvector datasets, enforce usage quotas, and manage billing transactions.
3. Third-Party Data Sharing
We do not sell your personal data or technical metadata. We share data strictly with essential infrastructure service providers operating under binding data protection commitments:
- Google Cloud Platform: Cloud Run compute, container execution, and Vertex AI / AI Studio API gateways.
- Supabase: Managed PostgreSQL and pgvector database hosting with encrypted storage.
- Cloudflare: Turnstile anti-bot verification and DDoS edge security.
- Lemon Squeezy: Merchant of record for international payment processing and invoice fulfillment.
B2B Data Processing Addendum (DPA)
Effective Date: September 2026 | Enforceable across Plans 1 to WebMCP Platinum
Overview: This Data Processing Addendum supplements the MercurAI Terms of Service. It establishes the contractual privacy commitments between MercurAI ("Processor") and the subscribing business customer ("Controller" / "Fiduciary") for operations across international jurisdictions including the European Union, the United Kingdom, the United States, and India.
1. Scope and Legal Classifications
Depending on the service tier provisioned, the parties acknowledge their respective roles under GDPR (Regulation EU 2016/679), UK GDPR, CCPA/CPRA, and India's Digital Personal Data Protection Act, 2023 (DPDPA):
- Account Management & Tollbooth Access (All Plans): MercurAI acts as an independent Data Controller / Data Fiduciary regarding subscriber account registration, billing data, API key hashes, and telemetry logs.
- Data Engine & Retrieval (Plans 1, 2, 3): MercurAI operates as a Data Controller / Data Fiduciary providing structured commercial intelligence compiled from publicly accessible business listings.
- WebMCP Pro & WebMCP Platinum (Plans 4 & 5): Customer operates as the Data Controller (GDPR) / Data Fiduciary (India DPDPA) with respect to their website visitors and actuation requests. MercurAI operates strictly as a Data Processor (GDPR) / Data Processor (India DPDPA) providing the W3C draft bridge infrastructure.
2. Zero-Retention of Consumer Actuation Inputs
The WebMCP runtime bridge (mercurai-webmcp.js) executes deterministically within the end-user's local browser environment via the document.modelContext interface.
MercurAI does not intercept, store, record, or retain live personal data, form values, credentials, or session states transmitted between browser AI agents and Customer's origin server endpoints. MercurAI servers store only structural tool schemas and verification tokens.
3. Sub-Processor Governance
Customer grants general written authorization for MercurAI to engage the following sub-processors for platform operations:
| Sub-Processor | Purpose | Location |
|---|---|---|
| Google Cloud Platform (GCP) | Serverless container hosting (Cloud Run), AI Studio / Vertex AI inference | United States / Global Regions |
| Supabase Inc. | PostgreSQL database hosting, pgvector intelligence storage | AWS ap-southeast-1 / Global |
| Cloudflare Inc. | Edge security, Turnstile bot mitigation, DNS proxying | Global Edge Network |
| Lemon Squeezy LLC | Merchant of record, international payment processing, tax compliance | United States |
4. Technical and Organizational Safeguards
MercurAI enforces enterprise security practices to safeguard all platform data:
- Container Hardening: All Cloud Run instances run as unprivileged, dedicated non-root users (UID 1001) with read-only root filesystems where applicable.
- Cryptographic Protections: API keys are hashed via SHA-256 before storage; live user passwords use salted bcrypt hashing; and all transit is encrypted via TLS 1.3.
- Connection Isolation: Database pools enforce statement cache disabling (
statement_cache_size=0) to prevent cross-tenant pool leakage behind transaction poolers. - Incident Response: Security incidents involving personal data are assessed and reported to customers without undue delay, adhering to statutory notification timelines (including India CERT-In 6-hour reporting and GDPR 72-hour notifications).
5. Cross-Border Data Transfers
Where the performance of services involves transfers of personal data outside the European Economic Area (EEA), UK, or India, the parties agree to abide by standard contractual clauses or statutory cross-border transfer mechanisms recognized under applicable data protection laws.
India DPDPA & International Privacy Framework
Compliance with the Digital Personal Data Protection Act, 2023 & Global Standards
1. Compliance with India's DPDPA 2023
For subscribers and data principals governed by the Digital Personal Data Protection Act, 2023 (DPDPA), MercurAI processes digital personal data solely on the basis of informed, specific, and affirmative consent or for legitimate uses explicitly permitted under the Act.
2. Summary of Data Principal Rights
Right to Access & Information
Request a summary of your personal data being processed, identities of third parties with whom it was shared, and the underlying purposes.
Right to Correction & Erasure
Request correction of inaccurate data, completion of incomplete records, or permanent erasure of your account and associated API keys.
Right to Grievance Redressal
Access a direct, responsive mechanism to resolve questions or complaints regarding the processing of your personal data.
Right to Nominate
Nominate any other individual who shall, in the event of death or incapacity, exercise data principal rights in accordance with the DPDPA.
3. Exercising Your Rights (DSAR & Account Erasure)
Subscribers may request complete account erasure and purging of all associated technical metadata directly through our authenticated API (DELETE /v1/user/account) or by submitting a Data Subject Access Request (DSAR) to our compliance desk. Requests are acknowledged within 48 hours and resolved within 30 days without cost.
4. Statutory Grievance Redressal Officer (India)
In accordance with Section 12 of the Digital Personal Data Protection Act, 2023 and the Information Technology Rules, the designated Grievance Officer is:
Title: Grievance Redressal & Data Protection Officer
Entity: MercurAI Platform Operations
Grievance Desk Email: [email protected]
Response SLA: Acknowledgment within 48 hours; resolution within 30 calendar days.
If your grievance is not addressed within the statutory period, you retain the right to register an appeal with the Data Protection Board of India.
End-User Privacy Addendum
Copy and embed this disclosure into your public Privacy Policy when deploying WebMCP.
Integration Notice: AI Agent Actuation & Accessibility
Our website utilizes the MercurAI WebMCP protocol (aligned with the W3C Web Machine Learning Community Group draft specification) to make our platform services deterministically accessible to autonomous browser agents, assistive copilots, and client-side AI models.
- Local Client Execution: When you authorize an AI assistant to complete actions on our site (such as checking service availability, submitting an inquiry, or initiating a booking), the assistant interacts directly with our application architecture through the browser's
document.modelContextinterface. - Zero Intermediary Logging: Your live inputs, form parameters, and session commands are executed directly between your local browser environment and our secure web servers. The WebMCP runtime bridge does not intercept, inspect, or store your personal transaction inputs on external servers.
- Third-Party Model Governance: We do not operate or control third-party AI models (e.g., Anthropic Claude, Chrome Copilots). Please consult the privacy policy of your selected AI provider to understand how your client-side model handles prompt context and execution approvals.