Skip to content

Privacy Policy

Effective date: 2026-01-19

This Privacy Policy describes how Nancy ("the Service") handles information when you use:

  • Nancy Slack bot (the conversational assistant)
  • Nancy Brain MCP/HTTP API (the RAG backend at nancy-brain.malpas.nz)

If you use Nancy through a third-party client (e.g., Custom GPT, Claude Desktop, VS Code MCP), that client may also collect data under its own policy.

What We Collect

We collect the minimum data needed to operate the Service:

  • Requests and queries you send to Nancy (Slack messages, API queries).
  • Identifiers needed for functionality and abuse prevention (Slack user ID, API key prefix, IP address, timestamps).
  • Optional contact you provide when requesting an API key.

We do not intentionally collect sensitive personal information.

How We Use Data

We use collected data to:

  • Provide search and retrieval responses
  • Operate, secure, and debug the Service
  • Monitor reliability and prevent abuse

Data Sharing

We do not sell your data. We may share data only with service providers required to operate the Service, such as:

  • Slack (for Slack bot messaging)
  • Cloudflare (for tunneling/edge protection)
  • Anthropic (for LLM responses in the Slack bot, when enabled)

Data Retention

Operational logs and API key records are stored on self-hosted infrastructure and retained as needed for service reliability and security. You can request deletion of your data (see Contact below).

Security

We use API keys, access controls, and TLS to protect data in transit and restrict access to the Service.

Your Choices

  • You can use the MCP API directly without Slack.
  • You may request deletion of your API key and associated records.
  • You can stop using the Service at any time.

Contact

To request data deletion or ask questions, contact: amber@malpas.nz

This policy may be updated as the Service evolves. If changes are material, we will update the effective date.