Service operator: Transmedia Corporation ("we", "us", "the Service")
Service URL: https://www.xataco.com
MCP endpoint: https://mcp.xataco.com/mcp
Contact: privacy@xataco.com (general inbox: general@xataco.com)
Co-Founder: Strategy Layer Engine is a remote MCP (Model Context Protocol) service that runs MBB-style strategic-consulting engagements inside the AI client of your choice (Claude, ChatGPT, Cursor, Codex, VS Code, and any other MCP-compatible client). We are operated by Transmedia Corporation, a corporation organised under the laws of the State of Florida, USA, with its registered address at 251 Crandon Blvd, Miami, FL 33149, USA.
For GDPR purposes, we act as the data controller for account data and as a data processor for the analysis inputs you submit through tool calls.
We collect and store the following data in our user database (hosted on Google Cloud Platform) for the lifetime of your account:
| Data | Source | Why we need it | Stored where |
|---|---|---|---|
| Email address | You (registration form or Google sign-in) | Account identity, transactional emails | User database (GCP) |
| Password hash (bcrypt, salted) | You — we never store plaintext | Email/password sign-in | User database (GCP) |
Google account identifier (google_sub) | Google OAuth | "Continue with Google" sign-in | User database (GCP) |
| Email verification status & timestamp | System | Block unverified accounts | User database (GCP) |
| Subscription tier (free / paid / subscription) | System | Rate limiting and billing | User database (GCP) |
The user database is encrypted at rest. Access is restricted to authorised personnel listed in §8. Your email address is the only personally-identifying piece of data we require to operate the Service — we do not ask for your full name, phone number, address, payment card directly (payment will be delegated to Stripe, Inc. when billing launches; see §6 of our Terms of Service), or any government identifier.
When you call a tool, you supply business context — for example a company name, an investment thesis, a person's bio, a LinkedIn URL, or financial data you've copied in. This content is:
research/<run_id>/ or strategies/<run_id>/) for the duration described in §6;We do not train any model on your engagement data.
| Data | Retention | Purpose |
|---|---|---|
runs.db — run_id, tool name, timestamps, status, client_id | 12 months (then anonymised) | Engagement history & rate limiting |
actions.db — Daily Loop tracking | 90 days | Subscription-tier feature |
| Web server access logs (IP, user agent, path, status) | 30 days | Security, abuse detection |
| OAuth tokens & session cookies | Session lifetime + grace period | Authentication |
| Processing | Lawful basis |
|---|---|
| Running engagements you request | Contract performance (Art. 6(1)(b)) |
| Verification emails | Contract performance |
| Security logs, abuse detection | Legitimate interest (Art. 6(1)(f)) |
| Marketing emails (only if you opt in) | Consent (Art. 6(1)(a)) |
We share data with the following sub-processors only to the minimum extent required to deliver the Service:
| Sub-processor | Data shared | Purpose | Region |
|---|---|---|---|
| Anthropic, PBC (Claude API) | Engagement inputs + intermediate prompts | LLM inference | US |
| Google Cloud Platform | All hosted data (server, databases) | Hosting & compute | us-central1 (Iowa, USA) |
| Resend, Inc. | Email address, verification token | Transactional email | US |
| Google LLC (OAuth) | OAuth sub identifier, email | "Continue with Google" sign-in | US |
| Notion Labs, Inc. | Engagement output files (only if you enable Notion export) | Public-page export | US |
A current list is maintained on this page. We will give 30 days' notice in this document before adding a new sub-processor.
Data may be transferred outside the European Economic Area (primarily to the United States). We rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework adequacy decision.
| Data | Retention |
|---|---|
| Account record (email, password hash, tier) | Until you delete your account, plus 30 days for backups |
Engagement data (research/<run_id>/, strategies/<run_id>/) | 90 days after engagement completion, then permanently deleted |
Engagement metadata in runs.db | 12 months for analytics & support, then anonymised |
| Server logs | 30 days |
| Notion exports | Until you delete the Notion page; we no longer hold the content after Notion has it |
You have the right to:
To exercise any right, email privacy@xataco.com. We respond within 30 days.
We use only strictly necessary cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie (OAuth flow) | Keep you logged in during sign-in | Session |
| CSRF token | Protect against cross-site request forgery | Session |
We do not use advertising, analytics, or third-party tracking cookies on the marketing site or the MCP server.
The Service is not intended for children under 16. We do not knowingly collect data from children under 16. If you believe a child has registered, contact privacy@xataco.com and we will delete the account.
The Service uses LLM-generated analysis as the core product. The output is advisory — it is not legally binding and should not be the sole basis of decisions with legal or significant similar effects on you. You always retain human oversight over actions taken on the analysis.
We will update this document when the data we collect, the sub-processors we use, or the retention periods change. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced by:
| Reason | Contact |
|---|---|
| Privacy questions, data requests | privacy@xataco.com |
| General support | support@xataco.com |
| Security disclosures | security@xataco.com |
| Postal | Transmedia Corporation, 251 Crandon Blvd, Miami, FL 33149, USA |