Privacy Policy.

This Privacy Policy explains how MSR Builds (“we”, “us”, “our”), the maker of EMCP Tools, collects, uses, and protects personal data when you visit emcptools.com (the “Site”). We are based in Pakistan and serve users worldwide, so where the EU/UK General Data Protection Regulation (GDPR) applies to you, this policy is written to respect those rights.

This policy covers the website and optional EMCP Cloud and Gatewayservices. The plugin runs on your WordPress site. Local tools do not require an EMCP Cloud connection. If you connect Cloud or enable Gateway, the service receives the information described below. You control which site, WordPress identity, tools and AI client you connect.

Website chatbot

MSR Builds is the controller for the website chatbot. Using it is optional. Before your first message, we ask for your consent to process your question, the current page path and up to four recent messages on our server to provide documentation-based support. You can use the rest of the Site without starting a chat. Please do not submit sensitive personal data, other people's personal data, passwords or API keys.

• Built-in answers: we search our public website knowledge. These requests do not send your conversation to an AI provider.
• Optional AI answers: before each AI request, we identify the selected provider (OpenAI or Anthropic) and ask for separate consent. If you agree, that provider receives your question, up to four recent messages and relevant public documentation to generate an answer. Choosing not to use AI does not prevent built-in support.
• Abuse prevention: when you send a chat message, Cloudflare Turnstile processes browser and connection signals to verify the request. We send the verification token to Cloudflare for server validation, without your question or conversation. Cloudflare also applies rate limits to chatbot traffic at the network edge. These security checks do not require an account. See Cloudflare’s privacy policy.
• Storage and retention: the chatbot does not save a conversation in our database, cookies, local storage or session storage. The visible conversation stays in this page's memory until you clear it or reload the page. Requests are processed transiently on the server. We retain aggregate AI usage counters without conversation text. Hosting and security services process connection information under the server-log practices described in this policy.
• Provider retention: OpenAI API abuse-monitoring logs may be retained for up to 30 days by default, with exceptions and account-specific controls. Anthropic generally deletes API inputs and outputs within 30 days, with exceptions for safety, legal requirements or agreed settings. We do not promise zero retention. See OpenAI API data controlsand Anthropic API retentionfor their current terms.
• International processing: our service is operated from Pakistan. AI providers may process data outside the EEA/UK, including in the United States. Their applicable data-processing terms and transfer safeguards govern these transfers; consenting to AI does not waive your data-protection rights.
• Your controls: open “Privacy & controls” to download the conversation visible in this page, or choose “Withdraw consent & clear chat”. Clearing removes the browser conversation and stops it being reused in future requests. It also cancels the browser's pending request, but cannot recall a request already received by our server or a provider, or erase their retained records. Withdrawal does not affect processing already performed. A downloaded copy remains on your device until you delete it.

The basis for processing your chatbot messages and optional AI sharing is your consent. Security and abuse prevention rely on our legitimate interests in protecting the service. The chatbot offers support information; it does not make decisions with legal or similarly significant effects. For access, correction, deletion, restriction, objection or other privacy requests, contact[email protected]. Your rights and complaint options are explained below.

Optional Cloud and Gateway connections

• Cloud connection: connecting sends the site URL, site name, installation identifier and OAuth registration and authorization information to emcptools.com. We use connection credentials and account information to identify your workspace, maintain the connection and provide service status.
• Settings sync: when requested, Cloud stores supported plugin preferences, including tool toggles, modules and free-text site context. Site context is not automatically redacted. Do not include passwords or API keys.
• Gateway: enabling Gateway separately sends a revocable WordPress credential to the service. Gateway relays MCP requests and results between the connected AI client and your site. Results may include unpublished content or personal data, according to the enabled tools and the authorizing user's WordPress permissions. Those tools can perform content writes.
• Connected AI clients: the client you choose receives the requested results and handles them under its own privacy policy. Review that policy and your obligations to people whose data your site holds before connecting.

You can disable Gateway and disconnect Cloud in the plugin's Connection screen. Revoking access prevents future authorized requests; it does not erase data already received by an AI client or automatically delete stored Cloud settings. For access to or deletion of service-side data, contact[email protected].

Who is responsible

The data controller for the Site is MSR Builds. For any privacy question or to exercise your rights, contact us at[email protected].

What we collect and why

• Newsletter email: if you subscribe, we store the email address you provide (and the subscription source/timestamp) so we can send you release notes. Legal basis: consent. You can unsubscribe at any time via the link in every email.
• Analytics (Google Analytics 4): only with analytics consent. We collect aggregate usage data such as pages viewed, referrer, approximate (city-level) location, and device/browser type, with IP anonymization enabled. This helps us understand what's useful and improve the Site. Legal basis:consent. Until you accept, no analytics cookies are set and GA does not load. Purchase measurement includes a transaction ID, amount, currency and product details. We verify payment with Freemius before reporting a purchase. With your analytics consent, server-side checkout context may retain browser/session identifiers and measurement choices for up to 30 days to report verified payments and refunds. We use an opaque token to associate the completed Freemius checkout, keep advertising consent separate, and stop pending reporting when you withdraw consent through Cookie settings. Financial records remain in Freemius independently of analytics. With separate ad-measurement consent, these events may also be used by our linked Google Ads account to measure campaign outcomes. Personalized advertising remains disabled.
• Google Search Console: provides us aggregate search performance for the Site (queries, impressions, clicks). It does not identify individual visitors to us and sets no cookies on your device via the Site.
• Server & security logs: our hosting keeps standard logs (IP address, user agent, request time) to operate and secure the Site and prevent abuse. Legal basis: legitimate interests.
• Embedded content: some pages (e.g. tutorials) embed YouTube videos. When a video loads/plays, YouTube (Google) may set its own cookies and receive your IP address, governed byGoogle's Privacy Policy.
• Web fonts: the Site loads Geist and JetBrains Mono from Google Fonts, which connects to Google's servers and may log your IP address to serve the font files.

Cookies

We use a small number of cookies and similar storage. Non-essential (analytics) cookies are off until you consent. See ourCookie Policy for the full list and how to change your choice at any time.

How we share data

We do not sell your personal data. We share it only with service providers that help us run the Site:

• Google: Analytics, consented Google Ads measurement, Search Console, and Fonts.
• Our hosting provider: serves the Site and keeps operational logs.
• Email/newsletter processing: to deliver the emails you asked for.
• Freemius: handles licensing and updates for the EMCP Tools Pro plugin (only if you are a Pro customer; governed by Freemius's own privacy policy).

International transfers

Because we use global providers (such as Google), your data may be processed on servers outside your country, including outside the EEA/UK. Where required, such transfers rely on the providers' safeguards (e.g. Standard Contractual Clauses).

How long we keep it

• Newsletter email: until you unsubscribe or ask us to delete it.
• Analytics: retained per our Google Analytics configuration (default up to 14 months), in aggregate.
• Server logs: kept for a limited period for security and then rotated/deleted.

Your rights

Subject to applicable law (including the GDPR), you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time (this does not affect processing already carried out).

To exercise any of these, email[email protected]. If you are in the EEA or UK and believe we have not handled your data properly, you also have the right to lodge a complaint with your local data-protection supervisory authority.

Children

The Site is not directed at children under 16, and we do not knowingly collect personal data from them.

Security

We use reasonable technical and organizational measures (HTTPS, access controls, least-privilege) to protect data. No method of transmission or storage is 100% secure, but we work to protect your information and address issues promptly.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.

Governing law & contact

This policy is governed by the laws of Pakistan, without prejudice to the mandatory data-protection rights you may have under the GDPR or other local law. Questions? Email [email protected].