Skip to content

Privacy policy

This page describes how The Chancery Lane Project ("TCLP") handles data when you use the Knowledge Graph API and its MCP connector. It covers both together, since the MCP server is a thin proxy in front of the API and the two share the same data handling.

Unauthenticated / try-it-out connections

If you connect without your own API key, the connector falls back to a shared public key so you can try it without registering first. Your query text is still logged for 28 days as described below, but it's stored against that one shared public client_id — the same identifier every other keyless user shares — not against you or your device. There's nothing in our logs that connects a keyless query back to a specific person or organisation.

Who this covers

This policy addresses API client organisations — the partner organisations and individuals we issue an API key to. It does not track or profile the people who use an MCP client (Claude Desktop, or any other MCP-capable assistant) beyond what's described below. We don't collect names, emails, or account profiles for end users of a client application.

Data controller

TCLP is the data controller for the API and MCP server. For any question, access request, or complaint about this policy, contact [email protected].

This page is the authoritative privacy notice for the Knowledge Graph API and MCP connector specifically — the tool inputs and outputs it processes, and how long it keeps them. For how TCLP handles data elsewhere (its main website, newsletters, general enquiries), see TCLP's main privacy policy.

What we collect

API keys

Each client organisation is issued an API key associated with a client_id (an operator-assigned label for that organisation, not an individual person). We store only an HMAC-SHA256 digest of the key, salted with a server-side pepper — never the raw key itself. The raw key exists only at issuance and on the client's side.

Request logs (tool inputs)

Every call to one of the six MCP tools — search, entity_lookup, find_legal_resources, get_legal_resource, taxonomy_facets, taxonomy_content — is logged to support debugging, abuse prevention, and service reliability. Logged fields include: a timestamp, a request ID, the client_id, which tool was called and its parameters (e.g. a taxonomy facet slug, an entity name, a jurisdiction filter, or the identifier of a law or standard), a hash of the query text, timing, result counts, and status/error codes.

Query text — the free-text input to search, entity_lookup and find_legal_resources — is also logged in full at present. It is retained for 28 days, after which an automated process strips the raw query text from the log files permanently, leaving only the anonymised metadata above. Anonymised log metadata is kept for longer (around 13 months) for operational and trend analysis, with no query content in it.

Operational logs unrelated to search content (access and error logs) are kept for 30 days and contain no query text.

Tool outputs (what we return)

The content a tool returns to you — the clauses, glossary terms, guides, entity relationships, or details of the laws, regulations, standards and frameworks that TCLP content cites — is not stored or logged. Only the count of results returned is recorded, as part of the request log above; the content itself passes through the API and back to your client without being written anywhere.

IP addresses

Cloudflare (see Cloudflare, below) sees your IP address when it forwards your request. We use source IP addresses in two ways:

  • Rate limiting. Cloudflare passes your IP address to our server. The connector passes it on to the API, which holds it in memory for at most 60 seconds to enforce rate limits. The connector and the API do not write it to their own logs.
  • Web server access log. Our web server records the IP address that connects to it, together with the time, the request path, the response status, the referrer and the user agent. Requests arrive through Cloudflare, so this is normally the address of a Cloudflare server, not yours. We use this log only for security and troubleshooting. It contains no query text and no API keys. The server's log rotation deletes it automatically after 28 days.

MCP session data

The MCP server forwards your API key to the underlying API on each call, and correlates requests using a hashed session identifier — the raw MCP session ID is not logged.

Hosting

The API and MCP server run on infrastructure provided by Krystal, under their data processing agreement. Krystal hosts the underlying server but does not otherwise process, view, or have any application-level access to request logs or query content.

Cloudflare

Requests to the connector pass through Cloudflare, which proxies our domain for security and performance. The encrypted connection from your client ends at Cloudflare, so Cloudflare processes each request decrypted while it is in transit: the request headers (including your API key), the URL and the tool arguments, including any query text. Cloudflare then forwards the request to our server over a separate encrypted connection, and checks our server's certificate. Cloudflare processes this data under its data processing addendum. Krystal and Cloudflare are the only processors in the request path.

What we don't do

  • We don't sell or share your data with third parties.
  • We don't run any third-party or cloud AI/LLM service as part of the API — search ranking is deterministic and self-hosted on our own software (see About). Krystal (see Hosting, above) hosts the underlying server but has no application-level access to the data on it. Cloudflare (see above) processes requests as our processor.
  • We don't use your queries to train any model.

Where data protection law requires a stated basis (e.g. UK/EU GDPR), we process client organisation data — API keys, client_id, and request logs — on the basis of legitimate interests: operating the service, maintaining security, preventing abuse, and diagnosing faults. This is a business-to-business service; we don't rely on individual consent for these purposes.

Your rights

As a client organisation, you can ask us to confirm what we hold about your client_id, or to delete your API key and associated log records, by contacting [email protected]. We'll respond within a reasonable time and in line with applicable data protection law.

If you connected without your own key (the shared public client_id — see above), we have no way to distinguish your individual queries from any other keyless user's, so we can't act on an individual deletion or access request for that traffic. If this matters to you, request a named API key instead (see Install), so your usage is identifiable and these rights apply to it directly.

Website analytics

This documentation site uses Fathom Analytics to count page visits. Fathom is cookieless and doesn't collect or store any personal data or IP addresses — it can't identify you or be used to track you across other sites. This is separate from the API/MCP request logging described above.

Changes to this policy

We'll update this page if data handling changes materially. Check back periodically if this matters to you.

Last updated: 6 October 2026 (Cloudflare added as a processor in the request path; IP addresses: rate limiting and the web server access log described). Previous update: 1 October 2026 (two tools added for the laws, regulations, standards and frameworks that TCLP content cites).