Privacy Policy

Effective 15 November 2026. This policy describes what data the bxmcp service (the website bxmcp.ru, the dashboard and gateway at mcp.bxmcp.ru, and the bxmcp module for 1C-Bitrix) receives, why, where and for how long it is kept, and who gets it. It is a translation of the Russian version, which prevails in case of a discrepancy.

1. Who we are

The service is run by Sergey Vasilyev, registered as self-employed in Russia (taxpayer ID 732729269763). Developer website: yurich.dev. For any question about your data, its correction or deletion, write to support@bxmcp.ru. We answer within 10 business days.

2. What data we receive

  • Account. E-mail, password (stored only as an Argon2id hash), when you signed up, accepted the terms and last signed in, your plan and paid period. For invited team members: e-mail, password hash, role and allowed sites.
  • Connected sites. Site address and name, access mode (for example read-only) and the key that signs requests to the site (stored encrypted). We never receive passwords of your site or of the Bitrix admin panel.
  • Sign-in from AI assistants. When you connect ChatGPT, Claude or another assistant with OAuth, we store that app's registration (name and redirect address) and the tokens issued to it. Tokens and integration keys are stored only as hashes.
  • Action log. For each request of the assistant to your site: time, type of action, result or error text, a short description of the change (for example “price of product 7: 100 → 150”), number of items, and which team member made it. To make a change undoable, the previous values (prices, texts, SEO fields) are stored with it. These previous values are deleted after 31 days, when undo is no longer available.
  • Site data the assistant asks for. Products, prices, page texts and, if you allowed it in the module settings, orders (including the buyer's name and contacts) and form submissions. The gateway passes them to the assistant in reply to your request and does not store them, except for the log and previous values described above.
  • Payments. Amount, plan, status and payment number. Card details are entered on the payment provider's page and never reach us. If you turn on auto-renewal, we store the identifier of the saved payment method issued by the provider (encrypted).
  • E-mails. Which service e-mails were sent (subject, time, delivery status): trial and payment reminders, team invitations.
  • Onboarding steps. Sign-up, module download, site connection: to see where users get stuck and offer help.
  • Request form on the website. Name, contact (e-mail, phone or Telegram), site address, role, platform, optionally your tasks and the AI you use, the referral source and the time of consent.
  • Public demo connector. Requests to the demo store without sign-in are logged with an anonymous session identifier (a hash), without e-mail or IP address.
  • Website analytics. bxmcp.ru and the dashboard page shown right after sign-up use Yandex Metrica (Yandex LLC): cookies and anonymous data about pages, referral source, device, clicks and session replay. Form fields are excluded from session replay. You can block cookies for the site or use the Metrica opt-out.

We do not receive your conversations with the AI assistant: the service gets only the tool calls and their parameters. The service never reads the assistant's memory, chat history or files.

3. Why

  • To carry out on your sites what you ask the assistant to do, show previews and undo changes.
  • To show the history of changes and the estimated time saved in the dashboard.
  • To sign you in and check the permissions of team members.
  • To take payments, send reminders and answer support requests.
  • To find errors and improve the service.

We do not sell data, do not use it for advertising and do not train models on it.

4. Legal basis

Performance of the contract (the Terms of Service) you accept when signing up; your consent for the request form and website analytics.

5. Who receives data

  • The AI assistant you connected (for example OpenAI ChatGPT or Anthropic Claude) receives the data from your site that it requested on your behalf. From then on it is handled under that service's rules: check its privacy policy.
  • Railway Corporation (USA): servers and database of the gateway and the dashboard, located in Western Europe (the Netherlands).
  • Yandex.Cloud LLC (Russia): hosting of the website bxmcp.ru.
  • Yandex LLC: website analytics (Metrica).
  • The payment provider (Robokassa): payments.
  • The e-mail provider that delivers service e-mails.
  • Public authorities, where the law requires it.

6. How long we keep data

  • Previous values for undo: 31 days.
  • Account, sites, the action log without previous values, payments: while the account exists. When an account is deleted, its sites and keys are deleted, its tokens stop working, and log entries lose the link to the account and remain only for aggregate statistics.
  • Unused authorization codes and sign-in requests: up to 10 minutes; access and refresh tokens: until they expire or are revoked.
  • Payment records are deleted with the account. Receipts required by law are kept in the Russian tax service app “My Tax”.
  • Request form entries: while we discuss the pilot and 12 months after the last contact.

7. Security

All connections use HTTPS. Requests from the gateway to your site are signed, site keys and payment methods are encrypted, and passwords, keys and tokens are stored as hashes. The assistant reaches only the sections you allowed in the module and only what the team member's role permits. To report a vulnerability, write to support@bxmcp.ru.

8. Your rights

You may ask what data about you we keep, correct it, get a copy, delete your account, withdraw consent, disconnect a site in the dashboard and revoke the assistant's access (in its connector settings or by changing your dashboard password). Write to support@bxmcp.ru from the account's e-mail address.

9. Changes

A new version is published on this page with a new date. We notify account owners of significant changes by e-mail.