Privacy policy of the MCP connector for SPIP

This translation is provided for convenience. In case of discrepancy, the French version (« Politique de confidentialité ») prevails.

Who processes what

Kimoun publishes, hosts and operates the connector (the MCP server that relays requests) and this site. Full details: legal notice.
Your SPIP site holds your content and your accounts. Its publisher (you, or the organisation you work for) remains responsible for that content. The connector acts with the SPIP rights of the key holder, no more, no less.
Your AI assistant (Claude by Anthropic, ChatGPT by OpenAI or another MCP client) sends the requests and receives the tool results, which it processes under its own terms (see below).

Your personal API key is created in the private area of your SPIP site. The connector relays it unchanged to your site on every call, so that SPIP checks your identity and your rights.
It is never written to disk, to a database or to logs. The server only handles it in memory, while the request is processed; the rate-limiting counters keep only a fingerprint of it (SHA-256 hash), cleared whenever the server restarts.
With OAuth, you enter the key on the connector’s authorisation page. The server checks it with your SPIP site, then issues a single-use authorisation code, held in memory only and valid for 10 minutes at most. The code is deleted as soon as it is exchanged; an expired code is refused, then cleared from memory.
The access token handed to your AI assistant is your API key itself: your assistant is the one that keeps it. To revoke access, revoke the key in the SPIP private area (Publication → MCP API keys).

The connector forwards your AI assistant’s requests to your SPIP site’s API (sections, articles, documents, forms, etc.) and returns the responses. It keeps no copy: nothing is written to disk or to a database.
Your content stays in your SPIP site, with your usual backups and rules. Every action respects your SPIP rights: whatever you cannot do yourself, the assistant cannot do either.

Our servers (entry proxy, connector server, this site’s web server) write one line per HTTP request: date, originating IP address, requested path and response status; depending on the server, also the declared browser and the referring page. If an incident occurs, a technical error trace may be added, without any email address.
They contain neither your API key nor the content of your exchanges with your AI assistant.
Purpose: service security (detecting and investigating abuse, unauthorised access and incidents) and diagnostics. Legal basis: our legitimate interest in protecting the service and its users.
They are kept for one year at most, then deleted automatically. Access is restricted to Kimoun’s technical administrator.

The email address entered on the trial form is used solely to create the demo account and send the trial key. It is not used for any prospecting without your consent.
It is stored in the demo site and deleted at the next periodic reset, like the accounts, trial keys and content created between two resets.

Audience measurement: Umami, free software (MIT license) self-hosted by Kimoun on its own infrastructure in France (mesure.kimoun.com, OVH). No tracker, no browser fingerprinting, IP address not stored: visits are counted through an anonymous salted-hash identifier rotated every calendar month. No consent required; aggregated data, shared with no third party.
The connector server also reports an event to this tool when a demo account is created, with the language only, never the email address.
Cookies: none, including technical ones. Only your dismissal of the language suggestion is remembered in your browser’s local storage; it is never transmitted.
Emails: no pixel or open tracker; some links carry aggregate campaign parameters (utm) with no individual identifier.

OVH (OVHcloud): hosting of the connector servers, this site, the demo site and audience measurement, in datacenters in France.
Stripe: online payment of the subscription and the setup. Stripe receives the payment and billing details you enter; Kimoun has no access to your card numbers.

Tool results (content read, write confirmations) are sent to the AI assistant you use: Anthropic for Claude, OpenAI for ChatGPT, or the publisher of your MCP client.
These publishers process them under their own terms and privacy policies, which Kimoun does not control.

You have the rights of access, rectification, erasure, restriction and objection provided by the GDPR.
Contact: mcp@kimoun.com, or support.kimoun.com.
You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Last updated: 9 October 2026