Privacy policy

Version October 2026 · English convenience translation – the German version is legally binding.

1. Controller

PIT Webservices GmbH, Richard-Wagner-Gasse 16, 2301 Groß-Enzersdorf, Austria · Email: support@mcpbrief.de

2. Data we process

• Account data: name or company, contact person, email, address (also used as the sender details on letters), VAT ID, password (stored only as a hash).
• Letter data: recipient address, document content, number of pages, subject, delivery type, timestamps, dispatch status, tracking number.
• Payment data: package, amounts, invoice details. Card data is processed exclusively by Stripe.
• Technical data: IP address, time, access channel used (web, MCP, API) in log files.

3. Purposes and legal bases

• Performance of contract – sending letters, account management, billing (Art. 6(1)(b) GDPR).
• Legal obligations – bookkeeping, tax retention (Art. 6(1)(c) GDPR, § 132 Austrian Federal Fiscal Code (BAO)).
• Legitimate interests – security, abuse prevention, error analysis (Art. 6(1)(f) GDPR).

4. Recipients

• LetterXpress (Germany) – printing, enveloping and posting of letters within Germany, as processor.
• Pingen GmbH (Switzerland; adequacy decision of the European Commission) with print centres in Europe – printing, enveloping and posting, as a processor.
• Postal service providers in the destination country (e.g. Österreichische Post, Deutsche Post, Swiss Post) – delivery; they receive the address on the envelope.
• Stripe Payments Europe, Ltd. (Ireland) – payment processing and invoicing.
• Hosting providers within the EU – operation of the servers.
• The respective recipient naturally receives the content of the letter and your sender details.

If you connect mcpbrief to an AI assistant (e.g. Claude by Anthropic or ChatGPT by OpenAI), its provider processes your inputs under its own terms. We only receive the data that the assistant passes to mcpbrief for sending.

4a. Data flow with AI assistants

AI assistant (e.g. Claude, ChatGPT) → mcpbrief server (TLS-encrypted, OAuth token or API key) → Pingen (TLS) → print centre → postal service provider → recipient. mcpbrief only receives the data needed for sending: recipient address, document or letter text, and optionally subject and delivery options. Your login credentials are never transmitted through the chat; sign-in takes place exclusively on mcpbrief.de.

4b. Logging

Technical logs contain the timestamp, request ID, account number, letter ID, result and error code. Recipient addresses are shortened in logs (only the beginning of the name, postcode, city, country); document contents are never logged.

5. Retention period

• Letter documents and previews: automatic deletion after 30 days (previews after 24 hours).
• Letter metadata and invoice data: 7 years (statutory tax retention obligation).
• Log files: max. 90 days.
• Account data: until termination, thereafter within the scope of statutory obligations.

6. Cookies

We only use technically necessary cookies (session cookie for login, language cookie). We do not use external fonts. Only if you expressly consent in the cookie notice do we use Google Ads conversion tracking (Google Ireland Ltd.) to measure the effectiveness of our advertising (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by deleting the cookie “mcpbrief_consent”.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. To exercise these rights, contact support@mcpbrief.de. You may also lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, dsb.gv.at).

8. Security

Transmissions are TLS-encrypted. We store passwords and access tokens exclusively as cryptographic hashes.