Privacy Policy

1. What we collect

Account data. When you sign in we collect your email address and, optionally, your organisation name. Authentication is handled by Clerk; we do not store passwords or raw authentication tokens.

Submission data. When you submit an agent we record the agent name, submission timestamps, agent type (hosted endpoint URL or Docker image reference — not the agent code itself), and the target evaluation tier.

Evaluation data. Each benchmark run produces run metadata (task IDs attempted, pass/fail outcomes, tool-call counts) and a run transcript. Transcripts are stored with task goal text redacted by default — the goal is replaced with [REDACTED]; tool calls and their arguments are retained. Full transcript publication is opt-in per submission.

Usage data. We collect page-view analytics through Cloudflare Analytics. This uses no cookies and no cross-site tracking.

2. How we use it

We use collected data solely for the following purposes:

• To provide the MCPBench evaluation service and return results to you.
• To compute and display leaderboard scores for submissions you choose to make public.
• To detect anomalous scoring patterns and maintain benchmark integrity.

We do not use your submission data or run transcripts to train AI models. We do not sell, rent, or trade personal data to third parties.

3. Storage and infrastructure

Submission metadata and evaluation results are stored in Cloudflare D1, encrypted at rest.

Run transcripts are stored in Cloudflare R2 object storage, encrypted at rest.

Authentication is managed by Clerk. Clerk processes your email address and session tokens in accordance with Clerk's privacy policy. We do not store passwords or raw tokens on our own systems.

4. Retention

• Submission rows are kept until you request deletion.
• Run transcripts are retained for 12 months in Cloudflare R2, after which they are archived.
• Account data is retained while your account is active and deleted within 30 days of account closure.

5. Your rights

You can request access to, correction of, or deletion of your personal data at any time by emailing privacy@compatool.com. We will respond within 30 days.

Residents of the United Kingdom have rights under the UK GDPR, including rights of access, rectification, erasure, restriction, portability, and objection. Residents of the European Union have equivalent rights under EU GDPR. Where we rely on legitimate interests as a legal basis, you have the right to object. Please contact us to exercise any of these rights.

6. Cookies

We use no tracking or advertising cookies. Cloudflare may set strictly necessary performance and security cookies as part of its CDN and DDoS-protection services. These cookies do not identify you personally and do not require consent under UK or EU law.

7. Contact

For any privacy-related questions or data requests, contact us at privacy@compatool.com.