Privacy policy for ORATS in AI apps

Applies to the ORATS connector for AI apps (the hosted ORATS MCP server). ORATS's general privacy policy at orats.com also applies.

What we collect

• Your ORATS account email and account ID, from ORATS sign-in, and your ORATS API token, looked up from your account when you connect. We store the token encrypted (AES-256-GCM) to make API requests on your behalf. AI apps never receive it.
• Connection records: the AI app's registered name and callback address, when you connected, and opaque access and refresh tokens (stored as one-way hashes).
• Request metadata: which tool was called, whether it succeeded, how long it took, and which AI platform made the call (for example Claude or ChatGPT). We record this to run and improve the service and to measure usage.

What we do not collect

• Your conversations, prompts or chat history. The server only sees the tool calls the AI app sends.
• Tool arguments and results are not written to our logs.
• No advertising, tracking cookies or third-party analytics.

How it is used and shared

Tool calls are forwarded to the ORATS API with your token and count toward your plan like any API request. Data is processed on Amazon Web Services in the United States. We do not sell personal data or share it except as required by law.

Retention and your controls

Access tokens expire after one hour and refresh tokens after 30 days without use. Disconnecting the app revokes them. Connection records are deleted within 400 days of last use, and request logs after 90 days. To delete your connection data sooner, contact support@orats.com.