Privacy policy

Last updated: 22 September 2026. This policy describes the service as it works today; we announce material changes in advance (section 18).

1. Controller

Escher Consulting GmbH, Höhenweg 2c, 44265 Dortmund, Germany. Email: hello@banking-mcp.com.

For questions about data protection or to exercise your rights, reach us at that address.

2. Overview

BankingMCP connects your bank accounts to AI assistants of your choice. We process only the data that service needs. We use no advertising tools, no cross-site tracking and no marketing cookies. We do not sell your financial data, do not use it for advertising and do not train AI models on it.

For anonymous visitor statistics we use a cookieless tool that runs on our own server (section 6). Fonts are served from our own server; your browser never calls Google.

3. Hosting and server data

Website, app and database run on servers of Hetzner Online GmbH in Germany (data centres in Nuremberg and Falkenstein). Hetzner processes the data solely on our behalf under a data processing agreement (Art. 28 GDPR).

When you open the website, the server processes technically necessary connection data such as your IP address. Our web server writes no access logs. To prevent abuse (for example mass sign-in attempts or requests), we count requests per IP address and per connection briefly in memory; those counters are never stored permanently and are discarded shortly after. Error messages from the app can contain an internal user ID and are stored temporarily for debugging.

The database is backed up every night. The backups are encrypted with AES-256, kept on the same server and deleted after 14 days.

Legal basis: Art. 6(1)(b) GDPR (providing the service) and Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation).

4. Account and sign-in

For your account we store your email address, your language, when you signed up, when your trial ends and whether you unsubscribed from tips and the trial reminder (section 7). You sign in with a 6-digit code we send by email. Codes are stored only as a cryptographic hash and expire after 10 minutes.

After sign-in we store a session: only the hash of the session key, when it started and when it expires. It ends after 7 days without use, after 30 days at the latest, or when you sign out. In your account settings you can sign out every other device.

If you turn on two-factor authentication, we additionally store your authenticator app's key encrypted (AES-256-GCM), when it was activated, and the last accepted time step, so a code cannot be used twice. Your 10 recovery codes are stored only as an HMAC, never in the clear.

If you change your email address, we confirm the new one with the same code procedure and then replace the old one. With two-factor authentication switched on, changing the address and deleting the account also ask for a current code.

We send a short notice to the address on the account when something security-relevant happens to it: a requested or completed change of the sign-in address, two-factor authentication switched on or off, an assistant connected, every device signed out, or the account deleted. These notices always go out — they are how you find out about a change you did not make — and they are not affected by unsubscribing from tips and reminders.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the protective measures.

5. Cookies and storage on your device

We use strictly necessary cookies only: a session cookie that keeps you signed in (up to 30 days), one cookie each for a sign-in or email-change in progress (up to 1 hour each), a cookie for the second sign-in step in progress (10 minutes), and a cookie that remembers your chosen language (1 year).

Your light or dark appearance setting is kept by your browser itself in local storage. That value never leaves your device.

All of this is strictly necessary for the service or expressly requested by you, so it needs no consent (§ 25(2) no. 2 TDDDG). We need no cookie banner because we store or read nothing beyond this.

6. Visitor statistics (Plausible)

To understand how the website is used, we count page views with the open-source software Plausible Analytics, which we run ourselves on our servers at Hetzner in Germany (section 3). The counting script and the requests go through our own domain, so your browser contacts no third party and no data is passed to Plausible or anyone else. Plausible sets no cookies, stores nothing on your device and builds no user profiles.

Per page view we process the page address, the referring website, browser, operating system and screen size, plus your IP address. The IP address is used only to determine your country and, together with the browser, to form a daily-rotating anonymous identifier for counting unique visitors; it is not stored. All statistics are anonymous and cannot be traced back to you. Statistics cover the public website only, not what you do while signed in. The one exception is that we count it, without any account details, when a visit ends in a sign-up, so we can see which pages and referrers lead to one.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving the website). As nothing is stored on or read from your device, no consent under § 25 TDDDG is required.

7. Sending email (Brevo)

Sign-in codes, cancellation confirmations and other service emails are sent through Brevo (Sendinblue SAS, Paris, France). Brevo receives the recipient address and the content of the email and processes them as our processor within the EU. The connection to Brevo is encrypted. For security reasons, Brevo routes links in emails through its own addresses and counts opens and clicks; we have set this counting to anonymous, so it isn't linked to you. We don't analyse whether you open an email or click a link in it.

In addition, we send you at most two emails about using the service: a day after you sign up, tips for getting started if your assistant hasn't accessed your accounts yet; and a day before your trial ends, a reminder if you haven't subscribed. To pick the right content, we check whether you have connected a bank and added an assistant, and how often it has accessed your accounts (section 9). We store which of these emails we sent you and when, so each is sent only once. We send no newsletters and no advertising for other products.

You can unsubscribe from these two emails at any time: through the link in each of them, through your mail app's unsubscribe option or in your account settings. Sign-in codes and confirmations still arrive, because we can't provide the service without them.

Legal basis: Art. 6(1)(b) GDPR for service emails; for the tips and the reminder, Art. 6(1)(f) GDPR (legitimate interest in helping you set up and keep using the service you chose). You can object at any time (Art. 21 GDPR), most easily by unsubscribing.

8. Bank data (finAPI)

The connection to your bank is made by finAPI GmbH (Munich), an account information service supervised by BaFin. You enter your banking credentials only in finAPI's form; BankingMCP never sees them.

For each BankingMCP account we create a separate user at finAPI. Its password is stored encrypted (AES-256-GCM).

What we store is the connected banks (the bank's name and logo address) and, per account, its name, IBAN, type and currency, along with the identifiers finAPI keeps these accounts under and the status of a connection in progress. We do not store balances or transactions: they are fetched from finAPI for every request your assistant makes and passed only to that assistant.

On the landing page you can check whether your bank is supported without an account. We send only your search term to finAPI and keep the result in memory for an hour. Neither the search nor any link to you is stored.

Legal basis: Art. 6(1)(b) GDPR. When you disconnect a bank or delete your account, the data is deleted here and at finAPI.

9. AI assistants

Every assistant you add gets its own secret MCP address. We store the name you give it, when it was added and last used, whether it is active, and the address itself (encrypted) plus its hash, which we use to match incoming requests.

For every request we log the time, the kind of request (for example balances or transactions) and the account involved, so you can follow the activity. We do not store the content of your questions or the transactions that were passed on. These entries are deleted after 90 days.

If you connect an assistant such as Claude (Anthropic), ChatGPT (OpenAI), Le Chat (Mistral AI) or Cursor, that provider receives the account data and transactions the assistant retrieves to answer your questions. You initiate that transfer yourself; from then on the provider's own privacy terms apply, it acts on its own responsibility and may process data outside the EU. Please check its settings, for example on using your chats for training.

You can deactivate or remove any assistant at any time. Legal basis: Art. 6(1)(b) GDPR.

10. Payments (Stripe)

Subscriptions are handled by Stripe Payments Europe, Ltd. (Dublin, Ireland). You enter payment details directly with Stripe; we do not store them. From Stripe we receive only a customer and subscription identifier, the subscription status, the end of the billing period and whether it was set to cancel.

Before checkout you confirm that we may start the service before the withdrawal period ends. We store the time of that confirmation as a record, as does Stripe on the subscription.

Stripe may also process data in the USA, on the basis of the EU-US Data Privacy Framework and the EU standard contractual clauses.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for documenting the confirmation and for statutory retention of invoices.

11. Cancellations

The cancellation button lets you cancel without signing in. For that we process what you enter in the form: the type of cancellation, any reason, your account's email address, optional further details identifying the contract, the end date you want and the address the confirmation should go to. The time it arrived is recorded as well.

We need these details to act on the cancellation and to confirm its receipt in text form, as § 312k of the German Civil Code requires. If the confirmation address differs from your account's address, it only learns that the declaration arrived; whether a contract exists and when it ends goes solely to the account's address.

Legal basis: Art. 6(1)(b) GDPR (performing the contract) and Art. 6(1)(c) GDPR (the statutory duty to confirm). We keep the declaration and the confirmation for as long as claims under the contract can be raised.

12. Internal notifications

For important account events (for example sign-up, sign-in, a connected bank, a started or ended subscription, a cancellation, account deletion) we receive a short internal email with your email address, your user ID and the event. It helps us fix problems and look after the service. It contains no sign-in codes, bank data or transactions.

These emails are sent through Brevo and received in our mailbox at Google (Google Ireland Limited, Dublin, Ireland). Google may also process data in the USA, on the basis of the EU-US Data Privacy Framework and the EU standard contractual clauses.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable operation).

13. Contacting us by email

If you write to us, we process your message and email address to answer your request (Art. 6(1)(b) or (f) GDPR) and delete them once they are no longer needed.

14. How long we keep data

We keep your data for as long as your account exists. If you delete your account, we immediately remove your account data, sessions, assistants including their activity and your bank data, disconnect your banks at finAPI and cancel your subscription at Stripe. The data disappears from the encrypted database backups after 14 days at the latest.

Independently of that, we delete your assistants' activity after 90 days and expired sign-in codes and sessions on an ongoing basis.

Data we have to keep for legal reasons (for example invoices for up to 10 years) is blocked until that period expires and not used further.

15. Security

All connections are encrypted with TLS and enforced through HSTS. Session keys, sign-in codes and recovery codes are stored only as hashes; MCP addresses and keys are encrypted (AES-256-GCM). Sign-in and request attempts are rate-limited to prevent abuse, and you can additionally protect your account with an authenticator app.

The database cannot be reached from outside. The website sets protective headers against being embedded in other sites and against leaking addresses to third parties.

16. No automated decision-making

We make no automated decisions within the meaning of Art. 22 GDPR and build no profiles about you. What an AI assistant makes of your data is up to the assistant you connect, not to BankingMCP.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data based on legitimate interests, you can object (Art. 21). You can change your email address and delete your account yourself in your account settings.

Giving us your email address and connecting at least one bank is not required by law, but it is required to use the service: without them we cannot provide BankingMCP.

You can also lodge a complaint with a data protection supervisory authority. Ours is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW) in Düsseldorf.

18. Changes to this privacy policy

As the service develops or the law changes, we update this policy. The version published here, with the date given above, is the one that applies. We inform you about material changes in advance by email or in the app.