Your data,
handled in plain sight.

GripMCP (“GripMCP”, “we”, “us”) makes the GripMCP plugin for WordPress and runs this website. This policy covers two different things, and it helps to keep them apart:

When you connect an AI assistant such as Claude or ChatGPT to your site, your conversation with that assistant is handled by its provider under their privacy policy. GripMCP doesn’t see your chats.

Messages you send us

The contact form asks for your name, email address, a topic and your message. It is delivered by email to our team inbox; the form doesn’t keep a copy in the website’s database. To stop spam, we hold a one-way hash of your IP address for 10 minutes so no one can send more than three messages in that window. The raw IP address isn’t stored.

Blog comments

If you comment on a post, WordPress stores the name, email, website and comment you enter, plus your IP address and browser details to help catch spam. A hash of your email may be checked against Gravatar to show your profile picture.

Server logs

Like every website, our host keeps standard technical logs: IP address, browser, the page requested and the time. They are used to keep the site running and secure.

What we don’t do

We don’t use Google Analytics or any other analytics service, advertising networks or tracking pixels on this website, and we don’t build profiles of visitors.

When you buy a paid plan we collect what we need to sell you a licence, deliver updates and support you:

• Your name, email address and billing country, plus company name and tax ID if you give them.
• Your plan, licence key, renewal dates and which sites the licence is activated on.
• Your support conversations with us.

Paid plans are sold through Freemius, which runs the checkout, takes payment, issues your licence key and sends your invoices. When you click a plan on our Pricing page, the Freemius checkout opens and the details you enter there go to Freemius under the Freemius privacy policy. We never see or store your full card number.

It runs on your server

GripMCP is installed on your own WordPress site. When an AI assistant uses it, requests go from that assistant straight to your site, never through us. Your posts, pages, media, products, orders, customers, users, tool calls and their results, passwords and access tokens stay on your site.

No analytics of its own

The plugin has no analytics or tracking. It contacts another server only when you or your assistant ask for something that needs it:

• Freemius, the service that sells and licenses our paid plans. After you activate GripMCP it asks whether you want to opt in. Only if you do, or when you start a purchase, a trial or a licence activation, does it send Freemius your site’s address, your WordPress, PHP and GripMCP versions, and the email you opt in with. While you stay opted in or have a licence active on the site, it checks in with Freemius once a day to keep your licence and updates current. Skip the opt-in and nothing is sent.
• WordPress.org, through WordPress’s own update check and plugin and theme APIs: the site health check asks for pending updates the same way your Dashboard does, and paid plans search, install and update plugins and themes.
• A web address you or your assistant supply, to download a file into your Media Library.
• Your own site, to check how a page renders.

What it stores on your site

Its settings, hashed access tokens, OAuth clients and tokens, an activity log of tool calls (time, tool, user, result, duration and IP address: kept 3 days on the free plan, 7 on Creator and 90 on Operator and Fleet, and up to 30 days longer after a licence lapses), a connection log, file backups, page-builder restore points and a short list of recent PHP fatal errors. Deleting the plugin from the Plugins screen removes all of it. Themes your assistant created are left in place, like any other theme.

Problem reports

The plugin can write a problem report for you under Activity → Report a problem. It includes your description, your WordPress, PHP and plugin versions, your GripMCP settings and recent error lines, and leaves out passwords, tokens, email and IP addresses, phone numbers, your site address and your content. On a paid plan it is an email to our support team; on the free plan you send it to us through the contact form. Read it before you send it. The plugin never sends it: only you do.

This website doesn’t use analytics or advertising cookies. The only cookies are the ones WordPress itself sets, and most visitors never get any of them:

If you open the checkout on our Pricing page, Freemius may set its own cookies to run it.

We only use personal information for the reasons below. Where data protection law asks for a legal basis, it’s shown alongside.

We don’t sell personal information, we don’t use it for advertising, and we don’t make automated decisions about you.

We share information only with the service providers that help us run GripMCP, and only what each one needs:

We may also disclose information if the law requires it, to protect our rights or users’ safety, or to a buyer if GripMCP or its assets are sold. In that case this policy keeps applying to the information transferred.

Depending on where you live, including the EU, UK and California, you have the right to:

• See the data we hold about you
• Correct it
• Delete it
• Get a copy to take elsewhere
• Object to or limit how we use it
• Withdraw consent you gave

Email support@gripmcp.com and we’ll respond within 30 days. We may need to confirm it’s really you first. We can’t delete records the law requires us to keep, such as invoices.

You can also complain to your local data protection authority, though we’d appreciate the chance to sort it out first.

This website is served over HTTPS, and access to personal information is limited to the people who need it. In the plugin, access tokens are stored hashed and can be revoked at any time, passwords and API keys stored in other plugins’ settings are shown to the assistant as “[redacted]”, and password and key columns are redacted from database query results. No system is perfectly secure, but if a breach ever affects your information we’ll tell you as the law requires.

Our service providers may process information in countries other than yours. Where the law requires it, we rely on recognised safeguards such as the European Commission’s Standard Contractual Clauses.

When the plugin or this website changes what it collects, we update this page and the date at the top. If a change is significant, we’ll say so clearly here, and email customers where appropriate.