Privacy Policy

Last updated: September 1, 2026

salarymcp ("we", "us") provides normalized salary data via an API and MCP server at salarymcp.com. This policy explains what personal data we collect, why, and your rights over it.

1. Data we collect

• Waitlist & contact. When you request early access or contact us, we collect your email address and any message you send, processed via our form provider.
• Account & API usage. Your API key (stored hashed) and request metadata — endpoints called and monthly usage counts — to operate metering, billing, and security.
• Payments. Handled by Stripe. We receive limited billing metadata (e.g., plan and subscription status); we do not store your full card details.
• Technical. Server logs and IP address, used for security and rate limiting.

2. What we don't do

We do not use advertising or cross-site tracking cookies, and we do not sell your personal data.

3. How we use data

To provide and secure the Service; to meter usage and process payments; to respond to you and send service-related messages; and to comply with legal obligations.

4. Legal bases (GDPR / LGPD)

Where the EU GDPR or Brazil's LGPD applies, we rely on: performance of a contract (providing the Service), legitimate interests (security, metering, and improving the Service), consent (waitlist emails), and legal obligation.

5. Processors and third parties

We share data with service providers strictly to run the Service, including Stripe (payments), Cloudflare (hosting, CDN, and security), and our email/form provider (waitlist). Each processes data under its own terms and appropriate safeguards.

6. International transfers

Your data may be processed outside your country (for example, in the EU or the United States) by us or our processors, subject to the safeguards required by applicable law.

7. Retention

We keep data only as long as needed for the purposes above or as required by law. Waitlist emails are kept until you ask us to remove them, or until we launch and you choose not to continue.

8. Your rights

Depending on where you live (GDPR, LGPD, and similar laws), you may have the right to access, correct, delete, port, or object to the processing of your personal data, and to withdraw consent. To exercise any of these, email [email protected].

9. Security

We use reasonable technical and organizational measures, including hashed API keys, encrypted transport (HTTPS), and least-privilege access. No method of transmission or storage is 100% secure.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

11. Changes

We may update this policy; the "Last updated" date reflects the latest version.

12. Contact

Privacy questions or requests? Email [email protected].