Privacy policy
Last updated: 1 October 2026
This policy explains what IntelMCP collects, why, and what you can ask us to do with it. Questions: intelmcp.ops@gmail.com.
What we collect about you
- Sign-in details. Your email address and the basic profile your sign-in provider shares (your name, and your Google profile if you choose "Continue with Google"). Sign-in is run by WorkOS.
- Subscription status. Whether your subscription is active. Payments are handled by Lemon Squeezy, our merchant of record; we never see your card details.
- What you create. Your alert rules, watch profiles, verdicts on matches, channel requests, and delivery settings (including any Slack or webhook address you give us).
- Usage records. Daily counts of tool calls and an audit log recording which account called which tool and when, with a SHA-256 hash of the arguments rather than the arguments themselves.
What we collect from Telegram
IntelMCP collects messages from public Telegram channels and groups only, and extracts indicators from them, such as IP addresses, domains, CVE identifiers, and email addresses and Telegram usernames that appear in posts. Messages can also show the name of the account they were forwarded from. We never collect private chats or invite-only groups. Messages deleted at the source are removed from IntelMCP when our collector sees the deletion. If you appear in a collected message, you can ask us to remove it by emailing intelmcp.ops@gmail.com.
How we use it
To provide the service, keep it secure, manage subscriptions and answer support requests. We do not sell data, we do not use it for advertising, and we do not train or fine-tune AI models on it.
Who processes it for us
- Fly.io: hosting and the database.
- Cloudflare: network protection and encrypted backup storage. All traffic to the IntelMCP service passes through Cloudflare's network.
- WorkOS: sign-in.
- Google: email (our support and subscription address is hosted on Gmail), and sign-in if you choose "Continue with Google".
- Lemon Squeezy: checkout, payments and tax, as merchant of record.
How long we keep it
- Account data, including your WorkOS sign-in record: while you are subscribed, and deleted within 90 days after your subscription ends.
- Audit logs: up to one year.
- Copies in encrypted backups expire within one year.
- Lemon Squeezy keeps payment records for as long as the law requires.
Your choices
You can ask us to show, correct or delete your data by emailing intelmcp.ops@gmail.com.
Cookies
This website sets no cookies and runs no analytics. The sign-in pages are run by WorkOS and Google under their own policies.
Changes
We will post changes on this page and update the date above.