Privacy Policy

Last updated: 2026-07-30.

This page says what we collect, what we do not collect, and who else sees your data. It is written in plain English on purpose. If anything here is unclear, email us and we will explain it.

This service is operated by Atac Studio LLC (a United States company), which runs EROAD MCP at eroadmcp.co.nz. You can reach us at support@eroadmcp.co.nz.

What we collect

Your email address. It is your login. We send you a 6-digit code to sign in, and we use the address to reply if you contact us.
An encrypted copy of your EROAD API key. The key is encrypted before it is stored and is never shown again after you paste it. It is used only to read data from EROAD on your behalf.
Your subscription and billing status. Whether you are on a trial, active or cancelled, and the identifiers Stripe gives us for your customer and subscription records. Card details are held by Stripe and never reach us.
Operational logs and error reports. Requests and errors, so we can keep the service working and fix faults. Error reports go to Sentry. They may include the page or tool involved and your user id, and we do not put API keys or fleet data in them.
Feedback you send us. Anything you write in the feedback form, or ask your AI assistant to send us, arrives in our support inbox as an email.
A short-lived login code. A hashed copy of your 6-digit code, which is deleted once it is used or expires.

What we do not do

We never store your fleet data. Vehicle, driver, geofence and hours-of-service data is fetched live from EROAD at the moment your AI assistant asks for it, and passed straight through to the answer. It is not written to our database.

There is one narrow exception, and it is worth naming. Live vehicle state is held in memory for up to 60 seconds so that several questions asked in a row do not hammer EROAD's API with the same request. That copy exists only inside the running server process, is never written to disk, and disappears when the process ends.

We do not sell your data. We do not use it for advertising. We do not use your data, or your fleet data, to train AI models.

Who else sees your data

Stripe — payments. They collect and hold your card details directly.
Resend — sends your login codes and delivers your feedback to us.
Cloudflare — hosting. The service runs on Cloudflare's network, and your account data is stored there.
Sentry — error reports, so faults get found and fixed.
EROAD — every question your AI assistant asks becomes a read request to EROAD's API, sent with your own API key.

Your AI assistant is not on this list, because it is your choice and your relationship. When you connect Claude, ChatGPT, Cursor or any other MCP client, the answers we return are handled by that app under its own privacy terms.

Fleet data can be personal information

Vehicle locations, driver names, licences and hours-of-service records can identify real people. That data belongs to your organisation, not to us, and we only ever pass it through. You are responsible for having the right to connect the EROAD account you connect and for meeting whatever obligations your organisation has to its drivers.

Where your data is processed

We handle personal information in line with the New Zealand Privacy Act 2020. You should also know that Atac Studio LLC is a United States company, and that the service runs on Cloudflare's global network, so your account data may be processed in the United States and in other countries where Cloudflare operates.

How long we keep it

Account data — your email address, your encrypted API key and your subscription status — is kept for as long as you have an account. Login codes are deleted within minutes. Billing records are kept by Stripe for as long as their own rules require.

Deleting your data, and cutting off access

Email support@eroadmcp.co.nz to ask for your account and data to be deleted, or to ask for a copy of what we hold about you. You can also stop access yourself, at any time, without asking us:

Delete your API key from your dashboard, or delete it in MyEROAD, which stops it working everywhere immediately.
Revoke any connected AI client from your dashboard.
Cancel your subscription from your dashboard, through the Stripe billing portal.

Changes to this policy

If we change what we collect or who we share it with, we update this page and change the date at the top. If the change is significant, we will email you.