Legal
Privacy Policy
Last updated: 24 October 2026
The short version
- We keep very little: the email you subscribe with, your Stripe customer ID, and the account you sign in with.
- Stripe handles your payment. We never see or store your card number.
- We don’t see your conversations with your AI assistant, only the searches it sends to Chorus.
- chorusmcp.com sets no cookies and has no ad trackers. It counts page views and clicks on its Connect buttons without identifying you. We don’t sell your data or use it for advertising.
- You can ask us for a copy of your data, or to delete it, at hello@chorusmcp.com.
1. Who we are
Chorus is run by CHO Public Equities (CVR 46841581), a sole proprietorship registered in Denmark, of Vanløse Allé 79, 2720 Vanløse, Denmark (“Chorus”, “we”, “us”). For the personal data described here, we are the data controller. You can reach us about anything in this policy at hello@chorusmcp.com.
2. What we collect and where it comes from
When you subscribe
Checkout happens on a page hosted by Stripe, our payment provider. Stripe collects your payment details, your email, and the billing details it needs (such as your country and, where required to work out tax, your address). Your card number goes to Stripe and never reaches our servers.
When your payment goes through, Stripe sends us your email address and your Stripe customer ID. We store those two things, with the time they were added, in our list of subscribers who have access. We can also see your Stripe customer record, subscription status and invoices in our Stripe account, but we don’t copy them into our own systems.
When you sign in and connect your AI assistant
To connect Chorus, your AI assistant opens our sign-in page at mcp.chorusmcp.com. You enter your email and we send you a one-time sign-in link (there is no password). When you subscribe, we also send you a welcome email explaining how to connect. This creates an account with our authentication provider, Supabase, holding your email address, a user ID and sign-in timestamps. Supabase also keeps standard security logs for sign-ins, which can include your IP address and browser details.
When you approve the connection, your AI assistant receives an access token so it can call Chorus on your behalf. You can end that connection at any time by removing Chorus from your assistant’s connector settings.
When you use Chorus
Your AI assistant decides when to call Chorus. Each call contains the search it chose to run (for example a company name or ticker, a speaker’s name, a podcast name or a topic) and your access token. We check the token and that your email is on the subscriber list, then return the matching data.
- We don’t receive your conversation with the assistant, only the call it sends to Chorus. What you type into the assistant is handled by its provider under its own privacy policy.
- Our server writes a log line for each request it accepts, containing your user ID and email address. It doesn’t write your searches to its logs.
- Our hosting and database providers keep their own technical request logs, which can include IP addresses and the details of a request.
When you visit chorusmcp.com
The website has no sign-up form, cookies or advertising trackers, and its fonts and images are served from our own domain. Our hosting provider, Vercel, processes the technical data any website receives, such as your IP address and browser type, to deliver the pages and protect them from abuse. We also use Vercel Web Analytics to count page views and see which pages people visit, and to count clicks on the Connect buttons, with which button was clicked, so we can tell how many visitors go on to start a trial. It sets no cookies, doesn’t follow you across other sites, and doesn’t identify you.
When you email us
We receive your email address, your message and anything you choose to include, and use them to reply.
Business API customers
If your organisation uses the Chorus API, we hold the organisation’s name, a hashed copy of its API key (we don’t keep the key itself), and when the key was last used, plus the contact and billing details exchanged while agreeing terms.
People who speak on podcasts
Chorus’s product is a record of what people said on publicly available podcasts. That includes speakers’ names, their roles, and quotes and summaries of what they said, taken from the published episodes. We process this to report public commentary accurately and with attribution. If you are a speaker and want to ask about, correct, or object to how you appear in Chorus, contact us at hello@chorusmcp.com.
3. How we use it, and our legal bases
Where data protection laws such as the GDPR or UK GDPR apply, we rely on these legal bases:
| Purpose | Data | Legal basis |
|---|---|---|
| Taking payment and running your subscription | Email, Stripe customer ID, billing details (held by Stripe) | Performing our contract with you |
| Signing you in and checking you have access | Email, user ID, access token | Performing our contract with you |
| Counting page views and Connect-button clicks on chorusmcp.com | Page visited, button clicked, referring site, country, device type (not linked to you) | Our legitimate interest in knowing how the website is used |
| Keeping the Service secure and fixing problems | Request and sign-in logs | Our legitimate interest in a secure, working service |
| Keeping tax and accounting records | Invoices and payment records (held by Stripe) | Legal obligation |
| Answering your messages and service emails | Email and what you send us | Performing our contract, or our legitimate interest in replying |
| Reporting what podcast speakers said | Speaker names, roles, quotes | Our legitimate interest in reporting public commentary, balanced against the fact that speakers chose to say it on a public broadcast |
Apart from service emails, such as sign-in links and the welcome email when you subscribe, we don’t currently send any emails.
4. What we don’t do
- We don’t sell your personal data, or “share” it for cross-context advertising.
- We don’t use your personal data to train AI models.
- We don’t make automated decisions about you that have legal or similarly significant effects.
5. Who processes data for us
We use these service providers. Each processes personal data only to provide its service to us.
| Provider | What it does for Chorus | Personal data involved |
|---|---|---|
| Stripe | Checkout, subscriptions, billing portal, invoices, tax calculation | Email, payment and billing details, subscription history |
| Supabase | Database and sign-in (authentication) | Email, user ID, subscriber list, sign-in and security logs |
| Railway | Hosts the Chorus MCP server and sign-in page | Request logs, including user ID and email |
| Vercel | Hosts chorusmcp.com, receives Stripe’s payment notifications, and counts page views and Connect clicks | Technical request data; email and customer ID passing through |
| Resend | Sends our emails: one-time sign-in links and the welcome email | Your email address and the email we send you |
| Google Fonts and jsDelivr | Serve the fonts and a code library used by the sign-in page | Your IP address and browser details when that page loads |
| ImprovMX | Receives email sent to hello@chorusmcp.com and forwards it to us | Your email and message |
Your AI assistant’s provider (such as Anthropic for Claude, OpenAI for ChatGPT, or xAI for Grok) is not our service provider. You choose it and have your own agreement with it, and it handles your conversations under its own privacy policy.
Podcast processing. We get transcripts from published YouTube captions or by sending podcast audio to a transcription service (Deepgram, with AssemblyAI as a fallback), and we use Anthropic’s Claude models to analyse them. These services process public podcast content, including what speakers said. They do not receive any data about our subscribers.
We may also disclose personal data if the law requires it, to protect our rights or the safety of others, or to a buyer or successor if the business is sold or reorganised, in which case this policy continues to apply to your data.
6. International transfers
Our database and sign-in accounts are hosted in the EU, in Frankfurt, Germany. Several of our other providers are based in, or process data in, the United States and other countries, which may have different data protection laws from where you live. Where we transfer personal data out of the EU, EEA or UK, we rely on safeguards recognised by those laws, such as the European Commission’s Standard Contractual Clauses in our providers’ data processing agreements, or a provider’s certification under the EU-US Data Privacy Framework and its UK extension.
7. How long we keep it
- Subscriber list entry (email and Stripe customer ID): removed automatically when your subscription ends.
- Sign-in account (email, user ID, sign-in times): deleted 12 months after your subscription ends, or sooner if you ask.
- Payment and invoice records held by Stripe: kept as long as Danish bookkeeping law requires, which is 5 years from the end of the financial year they belong to.
- Logs kept by our hosting and database providers: for the limited period each provider sets, after which they are deleted.
- Emails you send us: as long as needed to deal with your message, then deleted.
8. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how we use it, including use based on legitimate interests;
- receive your data in a portable format; and
- complain to a data protection authority: in Denmark, Datatilsynet (datatilsynet.dk), or the one in the country where you live or work.
If you live in a US state with a consumer privacy law (such as California), you also have the right to know what we collect, to delete or correct it, and to opt out of its sale or sharing for targeted advertising. We don’t sell or share personal data in that way. We won’t treat you differently for using any of these rights.
To use any of these rights, email hello@chorusmcp.com from the address your subscription uses, so we can confirm it’s you. We’ll respond within one month (or sooner if your local law requires). Deleting your data ends your access, so cancel your subscription first if you no longer want to be charged.
9. Security
Card details are handled entirely by Stripe. Sign-in uses one-time email links, so there are no Chorus passwords to steal. Our database denies access by default, and the subscriber list can only be read by our own servers. Business API keys are stored only as a one-way hash. All connections to Chorus use HTTPS. No system is perfectly secure, but we take reasonable steps to protect your data, and we’ll tell you and the relevant authorities about a breach where the law requires.
10. Cookies and local storage
- chorusmcp.com doesn’t set cookies or use any tracking. Its counting of page views and Connect clicks is cookieless (see section 2).
- The sign-in page at mcp.chorusmcp.com keeps your sign-in session in your browser’s local storage. This is strictly necessary for signing in; it isn’t used for tracking.
- Stripe’s checkout and billing pages are run by Stripe and use Stripe’s own cookies, including for fraud prevention. See Stripe’s privacy policy.
11. Children
Chorus is not for anyone under 18, and we don’t knowingly collect personal data from children. If you think a child has given us their data, contact us and we’ll delete it.
12. Changes to this policy
We’ll update this policy when what we collect or how we use it changes, and change the date at the top. If a change is material, we’ll email subscribers before it takes effect.
13. Contact
Privacy questions and requests: hello@chorusmcp.com.
CHO Public Equities, CVR 46841581, Vanløse Allé 79, 2720 Vanløse, Denmark.
See also our Terms of Service.