Your data on MCP Toplist
Short version: browsing needs no account. If you sign in we keep what you need for an account and what you create. We email you about your account, and send updates only if you said yes. We never sell or share your data for advertising.
Who we are
MCP Toplist is run by Exklamera AB (org. nr 559565-4053, Malmö, Sweden), the company behind BIFF.ai. Exklamera AB is the controller of the personal data described here. Contact: hello@biff.ai.
What we store and why
- Purpose
- Your account and public profile
- Legal basis
- Contract — needed to provide the account
- Kept
- Until you delete your account
- Purpose
- Signing you in; verifying claims and publishing to the official MCP registry on your request
- Legal basis
- Contract
- Kept
- Until you disconnect the provider or delete your account
- Purpose
- Keeping you signed in and letting you revoke sessions
- Legal basis
- Contract; security (legitimate interest)
- Kept
- 30 days after last use
- Purpose
- The features you use them for; approved servers and claims are public
- Legal basis
- Contract
- Kept
- Until you delete them or your account (approved servers stay in the catalog, unlinked from you)
- Purpose
- Confirming actions on your account — sign-in changes, submission reviews, claims
- Legal basis
- Contract; security (legitimate interest)
- Kept
- Until you delete your account
- Purpose
- Sending the monthly updates only if you said yes, and proving it
- Legal basis
- Consent — withdraw any time
- Kept
- Until you delete your account
Emails
Account emails confirm things you did or that happened to your account: a new account, a connected sign-in method, a submission received or reviewed, a verified claim, an account deletion. They contain no marketing and you get them as long as you have an account.
Email updates — the monthly MCP ecosystem report, how your claimed servers are doing, and new maintainer features — are sent only if you opted in. Switch them off any time in your account settings or with the unsubscribe link in any update.
Who processes it for us
- Google Cloud (Firestore, Cloud Run) — Hosting and the account database, in the EU (europe-west1).
- Google and GitHub — Sign-in, when you choose that provider.
- Scaleway (Transactional Email) — Delivering account emails and, if you subscribed, email updates, in the EU (Paris).
- Google Analytics — Site analytics, only if you accept analytics cookies.
Some of these providers may process data outside the EU/EEA under the European Commission's standard contractual clauses or the EU–US Data Privacy Framework. Cookies are covered in the cookie policy.
Your rights
You can see and correct your profile, disconnect providers, revoke sessions, change your email choice and delete your account yourself on your account page. For a copy of your data, or anything else — access, rectification, erasure, restriction, portability or objection — email hello@biff.ai. You can also complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or the data protection authority where you live.