Skip to content

Privacy policy

This page describes how The Chancery Lane Project ("TCLP") handles data when you use the Knowledge Graph API and its MCP connector. It covers both together, since the MCP server is a thin proxy in front of the API and the two share the same data handling.

Unauthenticated / try-it-out connections

If you connect without your own API key, the connector falls back to a shared public key so you can try it without registering first. Your query text is still logged for 28 days as described below, but it's stored against that one shared public client_id — the same identifier every other keyless user shares — not against you or your device. There's nothing in our logs that connects a keyless query back to a specific person or organisation.

Who this covers

This policy addresses API client organisations — the partner organisations and individuals we issue an API key to. It does not track or profile the people who use an MCP client (Claude Desktop, or any other MCP-capable assistant) beyond what's described below. We don't collect names, emails, or account profiles for end users of a client application.

Data controller

TCLP is the data controller for the API and MCP server. For any question, access request, or complaint about this policy, contact [email protected].

This page is the authoritative privacy notice for the Knowledge Graph API and MCP connector specifically — the tool inputs and outputs it processes, and how long it keeps them. For how TCLP handles data elsewhere (its main website, newsletters, general enquiries), see TCLP's main privacy policy.

What we collect

API keys

Each client organisation is issued an API key associated with a client_id (an operator-assigned label for that organisation, not an individual person). We store only an HMAC-SHA256 digest of the key, salted with a server-side pepper — never the raw key itself. The raw key exists only at issuance and on the client's side.

Request logs (tool inputs)

Every call to one of the four MCP tools — search, entity_lookup, taxonomy_facets, taxonomy_content — is logged to support debugging, abuse prevention, and service reliability. Logged fields include: a request ID, the client_id, which of the four tools was called and its parameters (e.g. a taxonomy facet slug, an entity name), a hash of the query text, timing, result counts, and status/error codes.

Search query text — the free-text input to search and entity_lookup — is also logged in full at present. It is retained for 28 days, after which an automated process strips the raw query text from the log files permanently, leaving only the anonymised metadata above. Anonymised log metadata is kept for longer (around 13 months) for operational and trend analysis, with no query content in it.

Operational logs unrelated to search content (access and error logs) are kept for 30 days and contain no query text.

Tool outputs (what we return)

The content a tool returns to you — the clauses, glossary terms, guides, or entity relationships in a response — is not stored or logged. Only the count of results returned is recorded, as part of the request log above; the content itself passes through the API and back to your client without being written anywhere.

IP addresses

Source IP addresses are used only to enforce rate limits, held in memory for at most 60 seconds, and are never written to any log file or other persistent store.

MCP session data

The MCP server forwards your API key to the underlying API on each call, and correlates requests using a hashed session identifier — the raw MCP session ID is not logged.

Hosting

The API and MCP server run on infrastructure provided by Krystal, under their data processing agreement. Krystal hosts the underlying server but does not otherwise process, view, or have any application-level access to request logs or query content. No other infrastructure or sub-processor sits in the request path.

What we don't do

  • We don't sell or share your data with third parties.
  • We don't run any third-party or cloud AI/LLM service as part of the API — search ranking is deterministic and self-hosted on our own software (see About). Krystal (see Hosting, above) hosts the underlying server but has no application-level access to the data on it.
  • We don't use your queries to train any model.

Where data protection law requires a stated basis (e.g. UK/EU GDPR), we process client organisation data — API keys, client_id, and request logs — on the basis of legitimate interests: operating the service, maintaining security, preventing abuse, and diagnosing faults. This is a business-to-business service; we don't rely on individual consent for these purposes.

Your rights

As a client organisation, you can ask us to confirm what we hold about your client_id, or to delete your API key and associated log records, by contacting [email protected]. We'll respond within a reasonable time and in line with applicable data protection law.

If you connected without your own key (the shared public client_id — see above), we have no way to distinguish your individual queries from any other keyless user's, so we can't act on an individual deletion or access request for that traffic. If this matters to you, request a named API key instead (see Install), so your usage is identifiable and these rights apply to it directly.

Changes to this policy

We'll update this page if data handling changes materially. Check back periodically if this matters to you.