Privacy
Effective November 4, 2026. FeedDoctor is operated by AUSSIE-AI LTD, Companies House no. 17193460, the data controller. Contact [email protected].
AUSSIE-AI LTD is registered with the UK Information Commissioner's Office, no. ZC277836
What we process
When you connect, we process OAuth authorization codes, access tokens, refresh tokens, and merchant account and product data needed for the requested diagnostics. We do not request Google profile or email scopes. Credentials are encrypted inside your own bearer token, not stored by us in a database. They are decrypted in memory to serve requests. The bundle expires within 30 days. Your MCP client holds the token and receives diagnostic results; its own privacy policy applies.
We use a temporary Secure, HttpOnly cookie for up to 10 minutes to protect the OAuth connection against cross-site request forgery. It is cleared after a verified callback. It is not an analytics cookie.
Service providers and logs
Cloudflare hosts the service and may process request metadata, IP addresses, and operational or security logs under its retention settings. OAuth callback URLs include temporary codes; Pro success URLs include checkout references. We do not intentionally log tokens or response bodies. Operators must keep sensitive query strings and authorization headers out of application logging.
Stripe processes payments, billing information, subscriptions, and customer portal access. We do not receive your card details. A Stripe customer identifier is included in Pro bearer tokens to check subscription status. Stripe maintains payment records under its own retention requirements. We have no merchant-data database.
Analytics
Pro waitlist: if you join, we store your email address and the src label of the link you arrived from in our MailerLite account (group “FeedDoctor waitlist”), only to tell you when Pro opens. Unsubscribe from any email or write to [email protected] to be removed.
Our beacon counts page views and waitlist sign-ups, including the source label in a URL's src parameter, without analytics cookies. The function derives a daily hash from IP address and user agent and sends that pseudonymous hash and a page or event key to the beacon. The beacon receives requests from the hosting service. Counts distinguish test traffic and crawlers. Do not put personal information in source labels.
Use and sharing
We process data to provide the service you request, administer subscriptions, and protect and measure service operation. We do not sell Google user data or use it for advertising. FeedDoctor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Merchant information is used only to provide the diagnostics you request and is returned to your chosen MCP client. Infrastructure and payment providers may process data outside your country, subject to their applicable safeguards.
Revoke access and your rights
Revoke FeedDoctor in your Google Account third-party connections or Microsoft account app permissions. Remove the bearer token from your MCP client and delete saved copies. Revoke provider access promptly if a token is exposed. Canceling a subscription does not revoke OAuth consent. Reconnecting does not invalidate older bundles; revoke at the provider to withdraw their access.
Contact support to request access, correction, deletion, or restriction of data we hold, or to object to processing where applicable. We cannot delete local copies held by your MCP client. Billing and security records may remain where required. You may raise privacy concerns with the UK Information Commissioner's Office or your local authority.