Privacy Policy
Last updated: October 30, 2026
This policy explains what Nicola Lapenna ("we") collects when you use OpsGates Cloud (https://mcp.opsgates.com), the OpsGates Agent for servers (Server mode) and the OpsGates app for computers (Computer mode), and why. OpsGates is designed to collect as little as possible.
What the OpsGates Agent sends us
The Agent runs on your server. It sends us only:
- the number of tool calls since its last report,
- a random installation identifier and a random batch identifier,
- the Agent version,
- your server's public connector URL (so your dashboard can show it),
- your license key (to identify your account), and, as with any internet request, the server's IP address, which we use only to answer the request and for abuse protection, and do not store.
The Agent never sends us your server passwords, login password, tokens, files, file names, paths, commands, command output, database content or anything your AI assistant reads or writes. Those stay on your server.
Computer mode: what passes through us
A personal computer usually cannot receive connections from the internet, so in Computer mode the OpsGates app on your computer keeps a connection open to OpsGates Cloud, and your AI app reaches your computer through it. This means:
- The requests your AI app sends to your computer (for example a file path, a command or the text to write) and your computer's answers (for example the content of a file or the output of a command) pass through OpsGates Cloud, encrypted with HTTPS. They are kept in memory only while the request is in progress and are never written to disk, logged or used for any other purpose.
- We keep, for each computer: the name you gave it, its operating system, computer name and app version, the folders it reports as available (home, Desktop, Documents, Downloads), the folders and permission level you chose, the names of the AI apps you connected, and, for each tool call, the tool name, time, duration and whether it succeeded (kept 90 days, at most the last 1,000 per computer). We do not keep paths, file contents, commands or output.
- The app on your computer keeps its own local logs (in its folder in your user profile), which never leave your computer.
If you do not want any of your data to pass through us, use Server mode.
What we collect on OpsGates Cloud
| Data | Purpose | Kept |
|---|---|---|
| Email address | Account, sign-in, service and billing emails | While your account exists |
| Password | Sign-in (stored only as a scrypt hash) | While your account exists |
| License key | Licensing (stored only as a SHA-256 hash) | Until you remove the server |
| Usage counts per month, day and server | Metering, limits, your usage charts | While your account exists |
| Server identifiers, Agent version, connector URL, last seen | Your servers list | Until you remove the server |
| Linked computers: name, operating system, computer name, app version, folders and permission level, connected AI apps | Your computers list and permissions | Until you remove the computer |
| Tool-call records for computers (tool name, time, duration, success — never content) | Your activity list, support, abuse prevention | 90 days |
| Sign-in tokens of connected AI apps (stored only as SHA-256 hashes) | Letting your AI apps reach your computer | Up to 30 days, or until you disconnect the app |
| Language you chose | Showing the site and emails in your language | While your account exists |
| Session data: IP address, browser user agent | Security, "Sessions" list in Settings | Up to 30 days after last use |
| Account events (sign-ups, sign-ins, plan changes) with IP address | Security and fraud prevention | Up to 12 months |
| Plan, subscription status, Stripe customer ID | Billing | While your account exists, then as required by tax law |
We do not use advertising trackers or third-party analytics, and we do not sell personal data.
Payments
Payments are processed by Stripe. Card details (and Apple Pay / Google Pay tokens) go directly to Stripe and never reach our servers. Stripe's privacy policy applies to the data it processes: https://stripe.com/privacy. We receive from Stripe your subscription status, a customer ID and, if you add them, invoice details such as company name, address and tax ID.
Service providers
- Stripe — payments and invoices.
- Our email provider — sending confirmation and password-reset emails.
- Our hosting provider — runs OpsGates Cloud.
They process data only to provide their service to us.
Cookies
We use only necessary cookies: a session cookie (og_session) when you are signed in, a security cookie against cross-site request forgery (og_csrf), your theme choice (og_theme) and your language choice (og_lang). No advertising or tracking cookies.
Legal bases (where applicable, e.g. GDPR)
Performing our contract with you (account, service, billing), our legitimate interests (security, fraud prevention, improving the service) and legal obligations (tax and accounting records).
Your rights
You can see and update your data in the dashboard and delete your account at any time from Settings → Delete account, which removes your account, license keys, linked computers and usage history (billing records may be kept where the law requires). Depending on where you live you may also have rights to access, correct, port, restrict or object to processing, and to complain to a data protection authority. Write to support@opsgates.com to exercise them.
Security
Passwords are stored as scrypt hashes; sessions, license keys, computer secrets, sign-in tokens and email links only as SHA-256 hashes. Traffic is encrypted with HTTPS. See Security.
International transfers
Our providers may process data in other countries. Where required, transfers are covered by appropriate safeguards such as standard contractual clauses.
Children
OpsGates is not directed to anyone under 18.
Changes
We will announce material changes by email or in the dashboard before they apply.
Contact
Nicola Lapenna — support@opsgates.com