MCP24 Privacy Policy
This Privacy Policy explains how personal data is processed when you use MCP24, a cloud application for Bitrix24 that connects AI assistants of your choice (for example Claude, ChatGPT, Gemini, Cursor or any other MCP client) to your Bitrix24 CRM via the Model Context Protocol, with controlled access (the "Application"). The Application is available at https://mcp-eu.ai-automation-agency.biz (MCP endpoint https://mcp-eu.ai-automation-agency.biz/mcp) and distributed through the Bitrix24 Marketplace.
This Policy is drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the Polish Act of 10 May 2018 on the Protection of Personal Data.
1. Who we are
ARTISMEDIA Sp. z o.o., Nowogrodzka 64/43, 02-014 Warsaw, Poland; KRS 0000868723; NIP (VAT ID) PL7011004442; REGON 387549826 ("we", "us"). Contact for privacy matters: artismediaeu@gmail.com, +48 693 124 346 (Monday–Friday, 9:00–18:00 CET). Website: https://apps.ai-automation-agency.biz/.
2. What you need to know before installing
2.1. The Application passes data from your Bitrix24 account to an external AI assistant. This is its purpose: the AI assistant reads your CRM and, on your instructions, changes it. The data leaves your Bitrix24 account and reaches the AI provider (for example Anthropic, OpenAI, Google) that you chose.
2.2. We are not an AI provider. We do not supply access to AI models and hold no keys to them. Your relationship with the AI provider, its prices, terms and data processing are between you and that provider.
2.3. We do not store your CRM data. It passes through our servers in transit and is discarded once the response is formed (Section 5).
2.4. You control what is passed. By default the AI assistant can only read, and phone numbers, e-mail addresses and addresses are masked (Section 6).
3. Our role: processor and controller
3.1. CRM data on your Bitrix24 account. Your organization (the "Customer") keeps data about its clients, contacts, companies, deals and employees in its own Bitrix24 account. For this data the Customer is the controller and we act as a processor under Article 28 GDPR, processing it only to provide the Application's features on the Customer's documented instructions. The Data Processing Terms in Section 14 form part of the MCP24 License Agreement.
3.2. The AI provider is the Customer's own recipient, not our sub-processor. When the Customer connects an AI assistant, CRM data is passed to it on the Customer's documented instructions. The AI provider is chosen and engaged by the Customer. We are not a party to the Customer's contract with the AI provider, we do not select it, and we are not responsible for its processing. Whether the AI provider acts as the Customer's processor or as a separate controller is determined by the Customer's contract with it.
3.3. Account, connection and technical data. For data about the installation (Bitrix24 account address, installation identifier), about Connections (the employee who confirmed a Connection, the AI assistant name), registrations of MCP clients, technical data (IP address, logs) and messages sent to us, we act as an independent controller.
4. What data the Application processes
4.1. Passed through our servers in transit (requested by the AI assistant from Bitrix24, or written by it to Bitrix24): CRM data accessible with the tools enabled by the Customer — contacts, companies, leads and deals, including names, job-related and contact details, amounts, pipelines and stages, responsible employees and timeline comments. The Application provides tools for search, record cards, deal lists, timeline comments, adding comments and deleting records; which of them are available depends on the access profile (Section 6).
4.2. Stored on our servers:
- the Bitrix24 account address, the installation ID (
member_id) and the application token with which Bitrix24 signs its notifications, including the uninstall notification; - OAuth tokens to the Bitrix24 account (access and refresh): those issued to the Application at installation, and those issued to an employee who has a Connection when that employee opens the Application — the AI assistant works with that employee's own Bitrix24 rights. An employee's tokens are deleted when their last Connection is revoked;
- Access policy settings: access profile, masking flag, enabled tools, allowed pipelines, limits on records per response and changes per hour, deletion confirmation flag, kill switch state;
- numeric IDs of the entities created in the Bitrix24 account: the "AI Actions (MCP24)" smart process, its stages and fields;
- hashes of Connection tokens, with the ID and name of the employee who owns the Connection, the AI assistant name, the time of creation and of last use. Tokens themselves are not stored in readable form;
- registrations of MCP clients: the issued client ID, the client name and redirect addresses;
- the service log described in Section 7.4;
- messages sent through the contact form on the Application page, if used: name, the contact given and the message text.
4.3. Not stored on our servers: the content of CRM records, names, phone numbers, e-mail addresses and addresses of data subjects, comment texts, amounts, search queries and any other Bitrix24 data. Bitrix24 responses are processed in memory within a single request of the AI assistant and discarded once the response is formed. We do not use them for any purpose of our own: we do not analyse them, do not pass them to third parties and do not use them to train machine learning models.
4.4. Access permissions requested from Bitrix24: CRM (crm) — the purpose of the Application; embedding (placement) — the "AI Actions" tab in contact and company cards and the button in deal cards; user field settings (userfieldconfig) — the fields of the Journal smart process; notifications (im) — used only to notify an employee when a deletion needs confirmation. The Application does not request access to Drive, mail, telephony, open channels or sites, and it does not offer the AI assistant a tool for calling arbitrary Bitrix24 REST methods.
4.5. The Application is not intended for special categories of personal data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR). The Customer should not open such data to an AI assistant.
4.6. Technical data: IP address, timestamps and request metadata, processed to protect the service from abuse and to investigate errors.
5. How the data is processed and stored
5.1. In transit only. CRM data is fetched from Bitrix24 when the AI assistant calls a tool, filtered by the Access policy and masked (Section 6), sent to the AI assistant and discarded. It is never written to disk: not to a database, not to files and not to logs.
5.2. Location. The Application runs on servers of Hetzner Online GmbH in Germany (EU). We do not transfer personal data outside the European Economic Area ourselves. Data requested by the Customer's AI assistant is delivered to that AI assistant wherever its provider processes it (Section 10).
5.3. Tokens. OAuth tokens and the account data are stored in files readable only by the Application's service account (permissions 0600), are used solely to call the REST API of the corresponding Bitrix24 account, give no access to user passwords and are deleted when the Application is uninstalled.
5.4. Connections. A Connection is confirmed only from inside the Bitrix24 account: an employee opens the Application, requests a pairing code and enters it in the consent window of the AI assistant. The pairing code is issued only to a user signed in to Bitrix24, is valid for 10 minutes and can be used once. MCP clients authorise via OAuth 2.1 with mandatory PKCE; the authorisation code is valid for 60 seconds and can be used once. Connection tokens are stored only as SHA-256 hashes, from which the token cannot be recovered. A Connection is valid until it is revoked on the Application page or the Application is uninstalled.
5.5. Sessions. To keep the Bitrix24 access token out of the browser, the Application's management page uses a server-side session and passes only its identifier to the page. A session lives 1 hour. All sessions of an account are closed immediately on uninstall.
5.6. Uninstall. When the Application is uninstalled, Bitrix24 notifies us and we immediately delete the access tokens, the account data and settings and all Connection tokens of that account, close its open sessions and cancel pending deletion confirmation requests and pairing codes. The Journal, the smart process and all CRM data remain in the Customer's Bitrix24 account.
5.7. Retention:
| Data | Retention |
|---|---|
| CRM data passing through | in memory for the duration of one request |
| Bitrix24 OAuth tokens, settings, entity IDs | while the Application is installed; deleted immediately upon uninstall notification |
| Hashes of Connection tokens | until the Connection is revoked or the Application is uninstalled |
| Pairing codes | 10 minutes, single use |
| Management page sessions | 1 hour |
| Pending deletion confirmation requests | up to 30 minutes, in memory only |
| MCP client registrations | while the service operates; they contain no CRM data and are not linked to a Bitrix24 account |
| Contact form messages | 12 months from our reply |
| Service logs and the server-side action log | up to 12 months |
5.8. Security measures: TLS/HTTPS for all traffic; OS-level access restriction to token files; Connection tokens stored only as hashes and compared in constant time; Connections confirmed only from inside Bitrix24; the uninstall notification accepted only with the signature of the corresponding Bitrix24 account; access logging.
6. Data minimisation and privacy by design
The Application is designed so that passing data to an AI assistant is controlled. These measures implement data minimisation (Article 5(1)(c) GDPR) and data protection by design and by default (Article 25 GDPR):
- Masking of personal data — enabled by default. Before data is sent to the AI assistant, the following fields are replaced with a "hidden" label: phone numbers, e-mail addresses, websites and messenger contacts; postal address fields; bank and tax identifiers in Bitrix24 requisite fields, including EU VAT ID and VAT certificate numbers, tax and registration numbers (for example REGON, KRS, PESEL, SIRET, SIREN), identity document numbers, IBAN, BIC/SWIFT, account numbers and other bank codes; and custom fields whose names indicate a phone, e-mail, mobile number, address, passport, IBAN, SWIFT, BIC, PESEL or VAT ID. The AI assistant is told which fields are hidden, so it does not assume they are empty.
- IBANs in free text. IBANs are also recognised in any text value, including record titles and comments, by country code, length and mod-97 checksum, and only the IBAN itself is replaced with the "hidden" label.
- Other free text is not masked. Apart from IBANs, free text such as record titles, comments and notes is passed as entered in Bitrix24: phone numbers, e-mail addresses, names or other data typed into a comment reach the AI assistant unchanged. The Customer should not keep data in free text that it does not want an AI assistant to receive.
- Names are not masked. First names, last names and company names remain visible, because without them the AI assistant cannot work. This is a deliberate limitation, not an oversight.
- Revealing a contact is a separate, logged action. The real contact details of a record (phone, e-mail, address, website) are available to the AI assistant only through a separate tool call with a stated reason. Each reveal is recorded in the Journal in the Bitrix24 account, together with the reason.
- Access profiles. "Read only" (default): the AI assistant cannot change or delete any record, and tools that change data are not even shown to it. "Manager": changes are allowed (currently, comments in CRM records), deletion is not. "Full": all actions, including deletion, subject to confirmation.
- Pipeline scope. Access to deals can be limited to selected pipelines; the check is performed by the Application, not only by the Bitrix24 filter.
- Limits. A maximum number of records per response (50 by default) and of changes per hour (60 by default).
- Confirmation of deletions — enabled by default. A deletion is not performed until an employee of the Customer confirms it on the Application page; the employee who owns the Connection receives a Bitrix24 notification. Unconfirmed requests expire after 30 minutes and are not executed after a restart of the service.
- Kill switch. One setting stops access of all AI assistants to the Bitrix24 account.
- Revocation. Any Connection can be revoked on the Application page; the AI assistant loses access immediately.
- The Access policy only narrows access. It can restrict what the Application's Bitrix24 authorisation allows, but never extends it.
These measures reduce risk but do not make the AI provider's processing compliant on their own; they are tools for the Customer as controller.
7. Action journal
7.1. Significant actions of the AI assistant — changes to data, reveals of contact details, actions refused by the Access policy and confirmation requests — are recorded in the Customer's Bitrix24 account as records of the "AI Actions (MCP24)" smart process. A record contains the AI assistant name, the tool, the CRM object, the reason, a flag showing whether contact details were revealed, the responsible employee and a link to the contact or company.
7.2. The Journal belongs to the Customer and remains in its Bitrix24 account after the Application is uninstalled. We keep no copy of it.
7.3. Ordinary reads are not written to the Journal (writing to Bitrix24 is costly for its limits); they are recorded only in our service log and shown in the summary on the Application page.
7.4. What our service log contains: Bitrix24 account address, employee ID, event type, tool name, CRM record type and ID, non-content request parameters (record type and ID, pipeline, stage, responsible employee ID, filters by days, amount and number of records), the reason stated by the AI assistant for a reveal, change or refusal, timestamp, duration and result, and error messages. It does not contain the content of CRM records: texts, contact details or search queries. Token values are never logged.
8. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Passing CRM data between the Customer's Bitrix24 account and the AI assistant connected by the Customer; masking; Access policy; recording the Journal | Art. 28 GDPR: processing on behalf of the Customer, who relies on its own legal basis |
| Installing the Application, confirming and revoking Connections, keeping the service secure and preventing abuse | Art. 6(1)(b): performance of the License Agreement; Art. 6(1)(f): legitimate interest in security |
| Service log and investigating errors | Art. 6(1)(b) and 6(1)(f) |
| Technical support and answering messages | Art. 6(1)(b) and 6(1)(f) |
| Compliance with legal obligations | Art. 6(1)(c) |
We do not use the data for marketing, profiling, sale to third parties, or training machine learning models.
9. Recipients and sub-processors
9.1. We do not sell, rent or disclose data to third parties except as described here or required by law.
9.2. Sub-processors:
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — server hosting (EU).
9.3. The AI assistant chosen by the Customer receives the data it requests through the Application. It is the Customer's own recipient, engaged by the Customer, and not our sub-processor (Section 3.2).
9.4. Bitrix24 is the Customer's own service provider; the Application only calls the Customer's Bitrix24 REST API.
9.5. Data of one Customer is never used to provide the Application to another Customer.
9.6. We will inform Customers of any intended change of sub-processors at least 30 days in advance by updating this Policy; Customers may object by uninstalling the Application.
10. Transfers outside the EEA and the AI provider
10.1. Our servers are in Germany, and we do not ourselves transfer personal data outside the European Economic Area.
10.2. The AI provider chosen by the Customer may process data outside the EEA, for example in the United States. MCP24 cannot control what the AI provider does with data it has received, including its storage, retention, use for its own purposes or onward transfers. These are governed by the Customer's contract with the AI provider and the provider's own terms and settings.
10.3. As controller, the Customer is responsible for: choosing the AI provider and its plan and settings; concluding the required agreements with it (including a data processing agreement where the provider acts as processor); ensuring a lawful transfer mechanism under Chapter V GDPR where data leaves the EEA, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses; carrying out a data protection impact assessment where required (Article 35 GDPR); and informing data subjects (Articles 13 and 14 GDPR).
10.4. We recommend assessing this before connecting an AI assistant and using the measures in Section 6 to limit what is passed.
11. Your rights
Under the GDPR, data subjects have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl.
Because CRM data is kept in Bitrix24 by the Customer, requests concerning that data should be addressed to the Customer as controller; we assist the Customer in fulfilling them. Requests concerning data processed by the AI provider should be addressed to the Customer or to the AI provider.
The Customer may at any time revoke Connections, switch off access with the kill switch, change the Access policy and uninstall the Application.
Requests to us: artismediaeu@gmail.com. We respond within one month (Art. 12(3) GDPR).
12. Cookies
The Application does not use analytics or advertising cookies. The management page uses only a short-lived server-side session identifier required for its operation and security.
13. Changes to this Policy
The current version is published at https://mcp-eu.ai-automation-agency.biz/legal/privacy. Material changes will be communicated to Customers in advance. Continued use after the effective date means acceptance of the updated Policy.
14. Data Processing Terms (Article 28 GDPR)
14.1. Subject matter and duration: provision of the Application for as long as it is installed on the Customer's Bitrix24 account.
14.2. Nature and purpose: passing CRM data between the Customer's Bitrix24 account and the AI assistant connected by the Customer, applying the Access policy and masking, and recording significant actions in the Journal in the Customer's Bitrix24 account.
14.3. Data subjects: the Customer's clients, contacts, representatives of companies, leads and other persons whose data is kept in the Customer's CRM, and the Customer's employees and users of its Bitrix24 account. Categories of data: as listed in Sections 4.1 and 4.2.
14.4. We process personal data only on the Customer's documented instructions, which consist of installing and using the Application, its Access policy and the requests of the AI assistants connected by the Customer. These instructions include passing personal data to the AI assistant chosen by the Customer, including where its provider processes data outside the EEA (Art. 28(3)(a) GDPR); the Customer is responsible for the lawfulness of that transfer (Section 10). We will inform the Customer if, in our opinion, an instruction infringes the GDPR.
14.5. Persons authorised to process the data are bound by confidentiality.
14.6. We implement the technical and organisational measures described in Sections 5 and 6 (Art. 32 GDPR).
14.7. We engage sub-processors listed in Section 9 under written terms providing equivalent protection; the Customer gives general authorisation for them. The AI provider is not our sub-processor.
14.8. We assist the Customer with data subject requests and with its obligations under Articles 32–36 GDPR, taking into account the nature of processing and the information available to us.
14.9. We notify the Customer of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it.
14.10. On uninstall, the data stored for the Customer's Bitrix24 account is deleted as described in Section 5.6; CRM data is not stored by us at any time; the service log is kept as stated in Section 5.7.
14.11. We make available information necessary to demonstrate compliance and allow for audits on reasonable prior notice, at the Customer's expense, no more than once a year.