← TaggingDocs MCP
Privacy Policy
Last updated: 2026-04-16
TaggingDocs MCP Server ("we", "us", "the Server") is a hosted Model Context Protocol server at mcp.taggingdocs.com that lets AI clients (Claude, ChatGPT, Cursor, and others) search the TaggingDocs library and manage Google Tag Manager containers you have access to. This policy explains what data we handle and how.
The Server is open source under the MIT License at github.com/mrwbranch/taggingdocs-mcp. If you self-host your own instance, this policy does not apply to you — you are the operator and should publish your own.
What we collect
When you authenticate with Google:
- Your Google account email address, used to identify your session across devices.
- A Google OAuth refresh token and short-lived access tokens for the Tag Manager scopes you granted.
- A session identifier (random UUID) we issue to your AI client as a bearer token.
When you use the Server:
- IP addresses — read transiently by our rate limiter to prevent abuse, not stored persistently.
- Structured server logs — the MCP method called, session metadata, HTTP status, and timestamps, used for operational debugging.
- Tag Manager API responses — forwarded to your AI client as the result of your request and not persisted on our side.
We do not collect:
- The content of your AI conversations.
- Any analytics, tracking pixels, cookies, or third-party trackers on this domain.
- Payment, billing, or identity-verification information.
How we use it
Solely to fulfill requests you make through your AI client. Specifically:
- Your Google refresh token is used to mint access tokens that we forward to the Google Tag Manager API on your behalf, only when your AI client invokes a tool.
- Your email identifies your session if you reconnect from a different device.
- Logs are reviewed only for operational monitoring and debugging.
We do not use your data for advertising, profiling, model training, or any purpose beyond serving your own requests.
Google API Services User Data Policy
Limited Use disclosure
TaggingDocs MCP Server's use and transfer to any other app of information received from Google APIs will adhere to the
Google API Services User Data Policy, including the Limited Use requirements.
In practical terms:
- We only access Google user data to provide user-facing features within your current request to the Server.
- We do not transfer Google user data to third parties except as necessary to provide or improve those user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale with notice to users.
- We do not use Google user data to serve advertisements, including retargeted, personalized, or interest-based advertising.
- We do not allow humans to read Google user data, except with your explicit consent for specific pieces of data, or as strictly necessary for security purposes, to comply with applicable law, or for internal operations where the data has been aggregated and anonymized.
Where we store it
- OAuth tokens, session IDs, and dynamically-registered client metadata — persisted server-side in a JSON file on a disk volume at our hosting provider.
- MCP transport sessions — held in memory only and lost on every server restart.
- Request logs — written to stdout and retained by the hosting provider on a short rolling window (typically 7 days) before they are discarded.
Third parties
- Google — the Tag Manager data originates from and returns to Google's API under your consent. See Google's Privacy Policy.
- Your AI client (Claude, ChatGPT, Cursor, etc.) — MCP responses are sent directly back to whichever client you installed the connector in. Review that client's privacy policy for how it handles responses.
- Our hosting provider — the server runs on infrastructure operated by a reputable European hosting provider that processes requests as part of normal operation.
- Cloudflare — sits in front of
mcp.taggingdocs.com for DDoS protection and TLS termination; may log connection metadata.
We do not sell, trade, or otherwise share your data with any other third party.
How long we retain it
- Your OAuth tokens and session — kept until you revoke access at myaccount.google.com/permissions, request deletion, or Google expires / revokes the refresh token.
- Logs — rolling 7-day window at the hosting layer.
- In-memory session state — cleared on every restart or when your AI client disconnects.
Your rights and choices
Children
The Server is not directed at children under 16 and we do not knowingly collect information from them.
International users
The Server is operated from the European Union. By connecting to the Server from another jurisdiction, you acknowledge that your data may be processed in the EU.
Changes to this policy
We may update this policy. Material changes will be reflected here with a new "Last updated" date. Your continued use of the Server after a change constitutes acceptance.
Contact