Revelata deepKPI MCP Privacy Policy

This Privacy Policy explains how Revelata, Inc. ("Revelata," "we," "us," or "our") collects, uses, discloses, retains, and protects information when you connect to or use the Revelata deepKPI Model Context Protocol service (the "deepKPI MCP") through ChatGPT, Codex, or another OpenAI client (collectively, an "OpenAI Client"). The deepKPI MCP is available at https://deepkpi-chatgpt-mcp.revelata.com/mcp.

1. Service overview

The deepKPI MCP provides read-only research tools for existing Revelata account holders. The tools retrieve financial and operating key performance indicators, public-company descriptions and segments, and public SEC filing information. Using a tool does not edit a filing, company record, or other user working data. Some successful tool calls deduct deepKPI credits from the user's existing Revelata account and update the account's credit ledger.

The deepKPI MCP uses OAuth to connect an OpenAI Client to a Revelata account. The OpenAI Client decides when to request a deepKPI tool and sends Revelata the structured arguments needed for that tool. Revelata returns the requested result to the OpenAI Client for inclusion in the user's conversation. Revelata does not request or retrieve the user's full OpenAI conversation history.

2. Information we collect and receive

A. Account and authentication information

When you connect the deepKPI MCP, we and our authentication provider may process:

• Your Revelata account email address and the authentication information needed to sign you in;
• A unique Cognito user identifier (sub) associated with your Revelata account;
• OAuth client-registration information, authorization codes, access-token mappings, refresh-token metadata, consent state, requested scope, redirect URI, and token expiration information;
• Connection, revocation, and authentication status; and
• Revelata account entitlement and deepKPI credit-balance information.

Authentication is provided through Amazon Cognito. Revelata does not receive or store your Cognito password in the deepKPI MCP application logs or tool records. Do not place passwords, API keys, one-time codes, or other authentication secrets in a tool request.

The deepKPI MCP currently requests only the openid OAuth scope. This scope allows us to associate an authenticated connection with the correct Revelata account.

B. Tool inputs received from an OpenAI Client

An OpenAI Client sends only the arguments selected for a particular tool call, not the user's entire conversation. Depending on the tool, those arguments are:

The service may also offer workflow templates that accept a company, theme, topic, filing type, or research focus and return instruction text to the OpenAI Client. Revelata does not separately retain those template parameters unless they are later submitted as part of a tool call or captured in ordinary service logs.

The free-text fields are intended only for public-company and investment-research topics. Please do not include personal information about yourself or another person. The deepKPI MCP is not designed to collect payment-card data, protected health information, government identification numbers, precise location, passwords, API keys, authentication secrets, or sensitive personal information.

C. Tool outputs returned to an OpenAI Client

Depending on the request, Revelata may return:

These outputs ordinarily concern public companies and public filings rather than the user. Revelata sends tool outputs to the OpenAI Client that made the request. OpenAI may retain or use the resulting conversation and tool content under the user's OpenAI settings and OpenAI's applicable terms and privacy policies. Revelata does not control OpenAI's independent processing.

Public filings and company information can contain personal information about people other than the user, such as the names, job titles, professional biographies, compensation, share ownership, related-party transactions, or business contact information of officers, directors, employees, shareholders, and advisers. Revelata obtains this information from public SEC filings and related public-company source materials, indexes it for financial research, and returns relevant portions when requested. We do not use this public-source information for advertising, consumer profiling, employment screening, credit decisions, or decisions about a person's eligibility for a product or service.

D. Usage, audit, and technical information

When the deepKPI MCP is used, we may collect:

• Cognito user identifier;
• Tool or endpoint name;
• Date and time of the request;
• Request outcome, error category, and result count;
• Company identifier, filing source, requested result count, and similar structured arguments;
• Company-name, KPI, thematic-search, or filing-accession query text submitted to a tool;
• Credits checked, deducted, and remaining;
• IP address, user agent, HTTP method, response status, latency, request or correlation identifier, and other security or hosting metadata generated by our infrastructure; and
• Authentication failures, rate-limit events, and security events.

We use this information for authentication, credit accounting, reliability, support, fraud and abuse prevention, debugging, security monitoring, and aggregate service analysis. We do not use MCP query activity for targeted advertising, behavioral profiling, or the sale of personal information.

Revelata does not use MCP tool queries, account identifiers, or tool results to train a general-purpose artificial intelligence model.

We do not intentionally log full tool outputs or full OpenAI conversations. Tool-query text may appear in service logs, so users should not include personal or sensitive information in research queries.

The OAuth sign-in process may use cookies or similar local storage that are strictly necessary for authentication, security, session continuity, and fraud prevention. The deepKPI MCP does not use advertising or cross-site behavioral-tracking cookies.

E. Information we do not collect through the deepKPI MCP

The deepKPI MCP does not ask for or intentionally collect:

• The user's complete ChatGPT or Codex conversation history;
• Payment-card numbers or bank-account credentials;
• Health or medical information;
• Government-issued personal identifiers;
• Precise GPS location;
• Advertising identifiers; or
• Passwords, API keys, one-time codes, or other authentication secrets as tool inputs.

The MCP does not serve advertisements and does not sell personal information or share it for cross-context behavioral advertising.

3. How we use information

We use the information described above to:

1. Authenticate users and maintain the authorized connection between an OpenAI Client and a Revelata account;
2. Receive, validate, route, and execute the requested deepKPI tool call;
3. Retrieve public-company KPI data, company information, SEC filing metadata, and filing text;
4. Return relevant results and source links to the requesting OpenAI Client;
5. Check account entitlements, meter successful requests, deduct credits, and maintain an accurate credit ledger;
6. Prevent misuse, protect accounts and infrastructure, investigate failures, and maintain service reliability;
7. Respond to support, privacy, and security requests;
8. Produce aggregated or de-identified statistics about service operation and tool performance; and
9. Comply with law, enforce our agreements, and establish, exercise, or defend legal claims.

Where applicable law requires a legal basis, we rely on performance of our agreement with the user, our legitimate interests in operating and securing the service, consent where requested, and compliance with legal obligations.

4. How information is disclosed

We disclose information only as needed for the purposes described in this Policy:

• OpenAI. OpenAI operates the requesting client and receives tool results for presentation in the user's conversation. OpenAI may also transmit the structured tool inputs selected by its client or model.
• Amazon Web Services. We use Amazon Cognito for account authentication and OAuth sign-in, and Amazon DynamoDB for account-linked credit and service records. AWS processes information on our behalf as an infrastructure provider.
• Google Cloud Platform. We use Google Cloud Run to operate the MCP and related internal services, Firestore for encrypted OAuth connection state, Secret Manager for service credentials, and Google Cloud logging and analytics services for operational and security records.
• Revelata internal services. Tool inputs are sent to Revelata-controlled company, KPI, vector-search, provenance, and filing services as necessary to produce the requested result.
• Professional advisers and service providers. We may disclose limited information to vendors, auditors, attorneys, insurers, and other providers that assist us with security, compliance, support, and business operations, subject to appropriate obligations.
• Legal and safety disclosures. We may disclose information when reasonably necessary to comply with law or legal process, protect users or the public, investigate fraud or security incidents, or protect Revelata's rights.
• Corporate transactions. Information may be transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to applicable law.

We do not authorize infrastructure providers to use MCP information for their own advertising. We do not sell MCP personal information.

5. Data retention

We retain each category only for the period reasonably necessary for the purposes described below:

Revelata does not maintain a user-specific archive of full tool outputs as conversation history. Public-company source data, SEC filings, and reusable provenance references are maintained as part of Revelata's research database while the information remains public and useful for the service; they are not retained as records of a particular user's conversation when they are not linked to an identifiable user. OpenAI may retain conversation and tool content separately under its own policies and user controls.

We may retain information longer when required by law, subject to a litigation hold, or reasonably necessary to investigate fraud or a security incident. When retention is no longer necessary, we delete or de-identify the information.

6. User choices and controls

You may:

• Disconnect the integration. Remove or disconnect Revelata deepKPI in the applicable OpenAI Client to stop future tool calls. Disconnecting does not delete prior conversations retained by OpenAI.
• Revoke authorization. Reconnecting after revocation requires a new OAuth authorization. You may contact us if you need help revoking an active Revelata connection.
• Access or correct account data. Contact us to request access to or correction of personal information associated with your Revelata account.
• Delete personal information or close an account. Contact us to request deletion or account closure. We will delete or de-identify information subject to the retention exceptions described above.
• Object, restrict, or withdraw consent. Where applicable law provides these rights, you may object to or request restriction of processing or withdraw consent. Withdrawal does not affect processing already performed lawfully.
• Request a portable copy. Where required by law, you may request a copy of personal information you provided in a commonly used format.
• Appeal or complain. Where applicable, you may appeal our response or complain to your local data-protection authority.

To make a request, email support@revelata.com. Please state that the request concerns the "deepKPI MCP." We may need to verify your identity before completing a request. Authorized agents may submit requests where permitted by law, subject to verification of their authority.

Deleting data held by Revelata does not delete public SEC filings or public-company information and does not automatically delete conversations or other information controlled by OpenAI. Requests concerning OpenAI-controlled data should be directed to OpenAI through the controls associated with the user's OpenAI account.

7. Security

We use administrative, technical, and organizational measures designed to protect information, including encrypted network transport, OAuth authorization-code flow with PKCE, access controls, encrypted storage of OAuth connection state, secret-management systems, and monitoring for authentication and service failures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If you believe your Revelata account or MCP connection has been compromised, disconnect the integration and contact support@revelata.com.

8. International processing

Revelata and the infrastructure described in this Policy primarily process MCP information in the United States. If you use the service from another country, your information may be transferred to and processed in the United States. Where required, we use legally recognized safeguards for international transfers.

9. Children

The deepKPI MCP is a professional financial-research service and is not directed to children under 13. We do not knowingly collect personal information from children under 13 through the MCP. If you believe a child has provided personal information, contact us so we can review and delete it as appropriate.

10. Changes to this Policy

We may update this Policy to reflect changes to the deepKPI MCP, its tools, its service providers, or applicable requirements. We will update the date at the top of the Policy and provide additional notice when required by law. Material changes apply prospectively unless otherwise permitted by law.

11. Contact us

Questions, privacy requests, and complaints concerning the deepKPI MCP may be sent to: