Privacy Policy

Last Updated: August 19, 2026

1. Application Information

The data handling practices of the Infollion Services MCP application are described in this Privacy Policy. Use of the Service is also governed by the Terms of Service.

  • Application Name: Infollion MCP
  • Business Entity: Infollion Research Services Limited
  • Application Type: Model Context Protocol (MCP) Server / API Gateway
  • Core Functionality: Providing enterprise integration services that connect artificial intelligence clients (such as OpenAI's ChatGPT and Anthropic's Claude) with verified subject matter experts, proprietary expert-network search systems, industry value-chain maps, project index lookups, embedding computations, and semantic recommendation engines.

2. Personal & Professional Data Processed

The Service processes specific categories of personal and professional information strictly necessary to authenticate sessions, execute search tools, display relevant expert profiles, and facilitate user-directed consultations:

  • Subject Matter Expert & Network Profile Data (Proprietary Database): To fulfill expert discovery and industry mapping requests, the Service retrieves and displays structured professional profile data from Infollion's curated database. This includes:
    • System Identifiers: Unique expert reference IDs (Expert ID) and value-chain identifiers (Cluster ID) used for entity resolution and outreach routing.
    • Professional Identity: Full Name, Professional Headline, Summary/Bio, Domain Taxonomies (domain_l0..l3), and Functional Classifications.
    • Nested Employment & Career History: Specific designations, company/employer names, chronological tenure dates, employment locations, and detailed descriptions of responsibilities and technical projects.
    • Nested Academic Credentials: Academic courses/degrees, universities/institutions attended, and graduation timeframes.
    • Professional Geographic & Location Data: Expert Base Location (city and country of active practice) and Geographical Areas of Advisory Competency (e.g., APAC, EMEA, North America).
    • Nested Commercial & Vendor/Client Experience: Enterprise relationship types (Vendor/Client classifications), partner enterprise names, scope of services/solutions evaluated, decision-making authority level, and historical project budget scope.
    • Professional Accomplishments: Issued patents (titles, patent numbers), published literature/whitepapers, industry awards, and analyst-curated domain snippets.
    • Search Match & Relevance Scores: Algorithmic relevance and semantic similarity scores (Score) computed dynamically by our search and vector embedding engines to provide essential match confidence and relative ranking context to AI models.
  • Contact Information (User-Initiated): Name, Email Address, and Phone Number are collected from the end-user only when a consultation connection with an expert is explicitly requested via the "Connect to Expert" tool.
  • Authentication & Session Metadata: Email address (used to deliver a One-Time Password or verified via supported identity providers for social sign-on), JWT session tokens issued after verification, and request metadata (timestamps, request headers) necessary for authorization and security. One-Time Passwords (OTPs) are single-use and expire immediately after use.
  • Query History & Search Briefs: Search terms, keywords, natural language briefs, and value-chain concepts submitted to search tools for semantic recommendations.

Expert Network Data Sourcing, Authorization & Consent

Infollion Research Services operates a specialized B2B expert network connecting organizations with vetted industry specialists. All subject matter expert profile data surfaced through the Service is processed under strict compliance and lawful basis standards:

  • Registered Expert Network Consent: Profiles of registered network specialists are provided directly and voluntarily by the experts themselves. By joining the Infollion Expert Network, experts explicitly consent to having their professional credentials, career background, and advisory competencies indexed and presented to verified business clients for commercial consulting, research interviews, and advisory engagements.
  • Public Professional & Academic Records: Professional achievement data (including issued patents, peer-reviewed publications, corporate leadership roles, and academic affiliations) is curated from publicly accessible, verified domain registries, academic databases, and public corporate disclosures.
  • Non-Sensitive Business Scope: Data processing is strictly limited to professional and business-relevant attributes (such as designations, employment history, and industry domain taxonomies). Private home addresses, personal finances, sensitive personal characteristics, or private personal phone numbers of experts are never collected or displayed.
  • Expert Rights & Delisting Mechanism: Any expert may exercise their data protection rights—including requesting an update, correction, or complete delisting/removal of their profile from our search indices—at any time by contacting our Trust & Compliance Officer at support@infollion.com. Requests are processed within 30 business days.

End-User Privacy Scope: Real-time GPS/device location, browser/device fingerprints, contact books, biometric data, or financial payment details of the AI platform end-user are never collected. Location data processed by the Service is strictly limited to the business/work locations and regional domain expertise of profiled experts from Infollion's database. Third-party advertising or analytics trackers are not used.

3. Purpose of Data Processing & Legal Basis

Each data category is processed to support the technical capabilities, operational fulfillment, and security of the MCP services under recognized legal bases (GDPR / Data Protection Laws):

Data Category Processing Purpose Legal Basis (GDPR / Privacy Laws)
Subject Matter Expert & Value Chain Profiles Enabling business users to search, evaluate, and identify specialized advisory talent and industry value-chain structures from Infollion’s curated database. Consent (Art. 6(1)(a)) (provided by registered experts upon network enrollment)
Legitimate Interest (Art. 6(1)(f)) (commercial B2B research & knowledge sharing)
Performance of a Contract (Art. 6(1)(b)) (fulfilling user search requests)
User Contact Information (Outreach Requests) Connecting the requesting user with the Infollion operations team to coordinate and schedule consultations with the selected expert upon explicit invocation of the "Connect to Expert" tool. Consent / Performance of a Contract (Art. 6(1)(a)/(b)) (initiated and requested directly by the user to establish consultation contact)
Authentication & Session Metadata Verifying user identity via email OTP or social sign-on, validating active entitlements, enforcing scoped JWT session access (e.g. 'mcp'), and securing endpoints. Performance of a Contract / Legitimate Interest (Art. 6(1)(b)/(f)) (ensuring secure, authenticated access to the service)
Query History & Search Briefs Executing requested integration tools (such as searching database indices, calculating vector embeddings, computing relevance match scores (Score), and ranking relevant experts). Performance of a Contract (Art. 6(1)(b)) (necessary to execute the requested search tool/query)
Technical Connection & Audit Logs Troubleshooting system errors, monitoring performance, maintaining security audit trails, and protecting infrastructure against unauthorized access or spam. Legitimate Interest / Legal Obligation (Art. 6(1)(f)/(c)) (maintaining service availability, reliability, and security compliance)

4. Third-Party Sharing

Personal data is not sold. Data is shared with subprocessors and third parties only when explicitly initiated by the user or required for the system to function:

  • AI Platforms (OpenAI / Anthropic): When tools are installed or triggered within OpenAI or Anthropic environments, transaction contents (queries/responses) are processed through these platforms. In this context, these platforms act as independent controllers. Their respective privacy policies apply.
  • Hosting & Subprocessors: Services are deployed in secure cloud hosting environments (such as AWS/OpenSearch clusters) which act as data processors. Logs and configuration data are stored strictly under Infollion's directive.

5. Data Retention & Storage

Strict data retention limits and storage boundaries are maintained to prevent unnecessary data accumulation:

  • User Contact & Consultation Requests: Dispatched to the Infollion operations team via secure email and logged with connection metadata (user name, email, phone number, expert ID, request timestamp, and audit IP) in secure infrastructure for a maximum of 90 days to verify delivery, prevent spam/abuse, and audit outreach fulfillment, after which records are permanently deleted.
  • Subject Matter Expert & Value Chain Profiles: Maintained in Infollion's proprietary database subject to continuous curation, expert-initiated profile updates, and delisting/removal requests.
  • Query History & Search Briefs: Retained in the secure search index for a maximum of 180 days (6 months), after which they are automatically purged.
  • One-Time Passwords (OTPs): OTP codes sent to the registered email address for login are single-use and expire immediately upon use or within a short validity window (typically 10 minutes). Plain text OTP codes are never stored.
  • JWT Session Tokens & Connection Metadata: Session tokens issued after OTP or OIDC verification are retained to authorize continued access and expire automatically. Upon a revocation request, tokens are invalidated immediately and fully removed from systems within 30 days.
  • Technical Connection & Security Logs: Access logs, IP records, and security telemetry are stored for 90 days for security monitoring and troubleshooting, then automatically rotated and deleted.

6. User Rights and Controls

Regardless of jurisdiction (including GDPR, CCPA, or similar regulations), the following control and privacy options are available:

  • Revocation & Session Deactivation: Since access is granted via One-Time Password (OTP) delivered to the registered email address, immediate revocation of an active session or account access may be requested at any time by contacting the support team.
  • Access, Correction & Export: A summary of connection logs and session records associated with the account may be requested by contacting support.
  • Erasure: Complete deletion of any connection records, search history, or email mappings associated with the account may be requested by contacting the privacy team.

7. Security Measures

Reasonable, industry-standard organisational and technical measures are employed to secure credentials and queries:

  • Transit Security: All connections to service endpoints enforce high-strength TLS (HTTPS) transport layer encryption.
  • Credential Hashing: Credentials are never stored in plain text; one-way cryptographic SHA-256 hashing is applied.
  • Access Controls: System database ports and internal service hosts are protected inside a secure private bridge network and are not exposed directly to the internet.
  • State Isolation: Thread-safe memory allocation ensures separate execution context boundaries are maintained for each incoming client.

8. International Data Transfers

Application infrastructure, databases, and security services are hosted exclusively on servers located in India (Mumbai data centres). Data accessed from outside India may be transferred to India for processing. Strict data processing agreements are maintained to ensure data is handled with equivalent protection standards in compliance with applicable Indian data protection law.

9. Children's Privacy

The Infollion Services MCP is designed exclusively for business professionals. It is not intended for children under 13 (or the applicable minimum age in the user's jurisdiction). Data from minors is not knowingly collected or retained.

10. Policy Updates

This policy may be modified periodically to align with evolving regulatory requirements or new features. Material changes will be indicated on this page, and the "Last Updated" value at the top will be updated accordingly.

11. Contact Information

For compliance inquiries, subject access requests, or privacy questions, the Trust Officer may be contacted:

  • Company Name: Infollion Research Services Limited
  • Privacy Contact Email: support@infollion.com
  • Website: https://www.infollion.com
  • Mailing Address: 5th Floor, Tower C, Unitech Cyber Park, Sector 39, Gurugram, Haryana - 122001, India