Last Updated: October 12, 2026
DC Hub ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at dchub.cloud.
| Purpose | Legal Basis |
|---|---|
| Provide and maintain the Service | Contract performance |
| Process payments | Contract performance |
| Send service updates and notifications | Legitimate interest |
| Improve and personalize the Service | Legitimate interest |
| Analyze usage patterns | Legitimate interest |
| Prevent fraud and abuse | Legitimate interest |
| Comply with legal obligations | Legal compliance |
We use the following analytics services:
These run on the dchub.cloud website only. They do not run on the MCP server or the REST API, so tool calls made by an AI assistant are not sent to Google or Microsoft. To opt out on the website, install the Google Analytics Opt-out Browser Add-on and block cookies for clarity.ms in your browser. GA4 does not honor the browser "Do Not Track" setting.
We do not sell your personal information. We may share your information with:
We implement appropriate technical and organizational measures to protect your data, including:
However, no method of transmission over the Internet is 100% secure.
We retain your information for as long as your account is active or as needed to provide services. After account closure, we may retain certain information for up to 3 years for legal, tax, or audit purposes.
Depending on your location, you may have the following rights:
To exercise these rights, contact us at [email protected]. We respond within 30 days. Section 13.9 lists the specific controls for API keys, emails and AI-assistant use.
We use cookies and similar technologies for:
You can control cookies through your browser settings.
Your information may be transferred to and processed in the United States. By using the Service, you consent to this transfer.
The Service is a business data service. It is not directed to children under 13. Users aged 13 to 17 may use it only with the consent of a parent or guardian where the law of their country requires it. We do not knowingly collect personal information from children under 13; if you believe a child has given us personal information, contact us and we will delete it.
California residents have the right to:
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date.
This section covers the DC Hub MCP server at https://dchub.cloud/mcp (including the ChatGPT app at https://dchub.cloud/mcp/chatgpt) and the REST API at https://dchub.cloud/api/v1, including when an AI assistant such as ChatGPT or Claude calls them on your behalf.
We receive only what the assistant sends to us when it calls a DC Hub tool:
We never receive your conversation with the assistant, its memory, files you shared with it, or any other chat content beyond the tool arguments the assistant chooses to send. The server never asks for conversation content.
DC Hub tools take arguments that describe data-center sites and markets, not you:
execute_plan, plan_query, search, semantic_search, search_intelligence);find_sites, analyze_parcel, get_disaster_risk, get_climate_intel, get_water_risk, get_fiber_readiness, plan_fiber_leadin, cluster_sites_by_latency, rank_sites, get_hosting_capacity, get_infrastructure). These are locations being evaluated for a data center, not your own location. We never request your device location;Please do not put personal information in free-text questions. If you do, it is logged with the call like any other argument (section 13.3).
The ChatGPT app is read-only. Every tool at /mcp/chatgpt only looks data up. It cannot take an email address or API key as an argument, save anything to an account, send email, register alerts or webhooks, or return payment or checkout links. The general MCP server at /mcp also offers account tools (section 13.5); those are not part of the ChatGPT app.
We use these logs only to answer the request, to meter usage (daily and monthly call limits), to debug failures, to prevent abuse, and to produce aggregate statistics about which tools are used. We do not sell them, use them for advertising, or use your inputs to train any third-party AI model.
We do not keep a copy of the results we return to your assistant. The one exception is research_task on the general MCP server, which stores the finished dossier so you can fetch it later (section 13.5).
Each MCP connection gets a random session id. Our server holds the session in memory and drops it after 120 minutes without activity; the id is also recorded in the tool-call logs and in a session record (platform and client name) in our database, both deleted after 90 days. If ChatGPT sends its own session identifier, we store only a one-way SHA-256 hash of it, never the original value.
A free key from claim_free_key is a random value starting with dch_live_. API keys are stored in our database as issued (not hashed), so that recover_my_key can email your key back to your bound address. When a key is created we record the IP address, user agent and client name of the request that created it.
bind_email, recover_my_key, subscribe_digest, set_market_alert, set_site_alert, set_shortlist_alert, register_standing_intent and request_capacity_intro store the email address you give with your key and use it to make the key recoverable, send receipts, send the alerts, digests or introductions you asked for, and confirm requests. We use it for marketing only if you explicitly opt in. recover_my_key sends the key to the bound address and never returns it in the tool response.save_site and save_to_shortlist store the sites and shortlists you save; register_standing_intent stores your watch settings and the webhook URL you supply; accept_capacity_terms records that you accepted the Capacity Source terms, with the time and terms version.report_finding stores the text submitted by an approved partner key.research_task stores your question and the finished dossier.Assistants that support OAuth, including ChatGPT, can sign in through AuthKit, which WorkOS operates. The scopes requested are openid profile email offline_access. We receive and store your WorkOS user id, the issuer and your email address, linked to a DC Hub key for your account. WorkOS processes your sign-in under its own privacy policy.
| Provider | Purpose | Data involved |
|---|---|---|
| Railway | Hosts the MCP server and backend | All request data, in transit and in memory |
| Cloudflare | Edge network and CDN; R2 storage for database backups | All requests pass through it; nightly database backups |
| Neon (PostgreSQL) | Database | Logs, keys, email bindings and saved items |
| WorkOS (AuthKit) | OAuth sign-in | Sign-in identity and email |
| Resend | Sends account, key-recovery and alert emails | Your email address and the message |
| Stripe | Payments, on the website only | Billing details |
| Mistral AI | Turns search text into embeddings for semantic_search, search_intelligence and related search | The search text only, with no identifiers |
| OSRM (router.project-osrm.org) | Public road-routing service that draws the road-following route for plan_fiber_leadin | The start and end coordinates of the route, with no identifiers |
| Esri ArcGIS geocoding, Nominatim (OpenStreetMap), Photon (Komoot) | Turn a street address or place name you give plan_fiber_leadin into coordinates; tried in that order, the next only if the one before finds no match | The address text only, with no identifiers. Not used when you give latitude and longitude. |
| Anthropic | Writes research_task dossiers (general MCP server only) | The research question and retrieved DC Hub records, with no identifiers |
| Google, Microsoft | Website analytics (section 3) | Website visits only, not MCP or API calls |
We also disclose data when required by law, and in a merger, acquisition or sale of assets (section 4). The AI assistant you use (for example OpenAI for ChatGPT, or Anthropic for Claude) receives DC Hub's tool results under its own privacy policy.
To answer some questions, DC Hub's servers also read public data sources at request time, for example the FEMA National Risk Index (served through Esri ArcGIS Online), USGS and NOAA climate data, the U.S. Drought Monitor, the U.S. Energy Information Administration, PeeringDB, and the published feeds of grid operators. These requests carry the location, region or market being evaluated, never your name, email or key. Coordinates are sent at the precision you give them.
| Data | Kept for |
|---|---|
| Tool-call logs (tool, arguments, status, timing) | 90 days, then deleted. Aggregate counts with no identifiers may be kept longer. |
| Raw IP addresses in MCP and API logs and in key records | 30 days, then replaced with a one-way hash |
| MCP sessions | In memory, dropped after 120 minutes without activity. The session record in our database is deleted after 90 days. |
| Per-day rate-limit counters | 3 days |
| Free API keys | Until you ask us to delete them. A free key not used for 24 months is deactivated automatically. |
| Bound email, saved sites, shortlists, alerts and standing intents | Kept with your key until you delete them or ask us to (section 13.9) |
| OAuth link (WorkOS user id and email) | Until you disconnect DC Hub in your assistant's settings and ask us to delete it |
| Research dossiers | 90 days |
| Billing records | Up to 7 years, as tax law requires |
| Database backups | Overwritten on a rolling 30-day cycle |
delete_standing_intent removes a watch yourself, immediately.Send any request to [email protected]. We respond within 30 days.
For any question about this Privacy Policy, including the MCP server and API, contact us at:
DC Hub
Email: [email protected]
Address: Phoenix, Arizona, USA