IVERIOS Trust Center connector — Privacy Policy
| Controller | IVERIOS OÜ, registry code 17516618, Tartu mnt 67/1-13b, Tallinn, Estonia |
|---|---|
| Contact | info@iverios.eu |
| Version | 1.0 — effective 6 November 2026 |
This policy explains how we process personal data when you use the IVERIOS Trust Center connector (https://trust.iverios.eu/mcp) with Claude or another AI assistant. The general IVERIOS privacy policy also applies.
1. What we collect
| Data | Why | Legal basis |
|---|---|---|
| Your email address | to send a one-time sign-in code and to determine in which trust centers you are an approved visitor | contract / your request (Art. 6(1)(b) GDPR) |
| Name of the AI client (e.g. "Claude") and its redirect address | OAuth client registration | legitimate interest (Art. 6(1)(f)) |
| Access and refresh tokens (stored only as hashes) | keep your assistant connected | contract (Art. 6(1)(b)) |
| Request log: time, tool name, tool arguments (e.g. a search query or document id), result status, AI client name, IP address | security, abuse prevention, rate limits and transparency towards the companies whose information you access | legitimate interest (Art. 6(1)(f)) |
We do not receive or store your conversations with the AI assistant, your prompts, the assistant's answers, your chat history or memory, or any files in your assistant. We only receive the tool calls that the assistant sends to the connector.
We do not use the connector data for advertising, do not sell it and do not use it to train AI models. The connector itself does not use any AI model.
2. Who can see it
The company whose trust center is accessed sees the request log for its own trust center:
- which tools were called and with which arguments;
- when, from which AI client and from which IP address;
- if you are its approved visitor, your visitor account, including your email.
For restricted documents, reading a document is recorded like a download. That company is the controller for its visitor data, and we process it on its behalf.
Our sub-processors:
- hosting: Hetzner Online GmbH, Germany;
- sending of sign-in codes: Microsoft Ireland Operations Ltd (Microsoft 365).
The full list is in our trust center. We disclose data to authorities only where required by law.
3. Where
All connector data is stored and processed in the European Union (Germany).
4. How long
- One-time sign-in code: 10 minutes. The code is never stored in plain text.
- Browser sign-in session for the connection screen: 30 days.
- Tokens: until they expire (refresh tokens after 30 days without use) or are revoked, then deleted within 30 days.
- Request log: 12 months.
5. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a supervisory authority (in Estonia: Andmekaitse Inspektsioon). Contact us at info@iverios.eu; we respond within one month.
For data held by a company in its trust center (for example your visitor account), you can also contact that company directly.
6. Security
- Connections use HTTPS.
- OAuth uses PKCE.
- Codes and tokens are stored only as hashes.
- Access to restricted information is re-checked on every request.
See the security overview in our trust center for more.
7. Changes
We publish changes on this page and update the version and date above.