Legal
What we collect, why, and your rights. The short version: the free scanner runs locally and never sends the inventory of the servers you scan to us.
Nativerse Ventures Ltd ("we", "us") is the data controller for the personal data described in this policy. We make mcpgawk (the free mcpgawk scanner and the paid mcpgawk Platform subscription) and run the websites at gawk.dev and mcp.gawk.dev.
The free mcpgawk scanner runs on your machine. When it measures an MCP server, the server's tool inventory and the results stay on your machine, and they are not transmitted to us or to any third party. Two other connections exist and are worth naming: on each run it asks pypi.org what the newest version is, because a stale scanner misses checks a newer one catches — that request carries no information about you or your servers, and you can switch it off with MCPGAWK_NO_UPDATE_CHECK=1. If you pass --supply-chain, it looks each server's package up on registry.npmjs.org or pypi.org; that sends the package name, and it only happens when you ask for it. And if you run mcpgawk install-node, it downloads the Node runtime that sandboxed verification needs from nodejs.org, with a signed checksum — again, only when you ask for it. If you choose to run a hosted scan from our website instead, that is different and is covered in section 3.
We collect only what we need to run the Service:
| When | What |
|---|---|
| You run a hosted scan on our website | The server URL you submit, your email address, the scan result, and anti-abuse signals from Cloudflare Turnstile. |
| You subscribe to mcpgawk Platform | Your payment is taken by Lemon Squeezy (our Merchant of Record), so we do not see your card details. We receive your order and licence details (name, email, order/licence-key reference, subscription status) from Lemon Squeezy to fulfil and support your subscription. |
| You sign in to mcpgawk Platform / claim access | Your GitHub account identifier, so we can grant repository access to the paid tools. |
| You use a paid Licence Key | The Software validates your key with Lemon Squeezy's licensing API. This confirms your subscription and seat; it does not send us the contents of the servers you scan. |
| You contact us | Your email address and the contents of your message. |
| You visit our website | Standard server logs (IP address, user agent, pages requested) kept for security and to run the site. |
We do not sell your personal data, and we do not use it for third-party advertising.
We use a small set of trusted processors to run the Service. They act on our instructions:
| Processor | Purpose |
|---|---|
| Lemon Squeezy | Merchant of Record: payments, tax, subscription billing, licence keys, refunds. |
| Vercel | Website and API hosting. |
| Supabase | Database for orders, licence grants and hosted-scan records. |
| Resend | Transactional email (e.g. your access-claim link). |
| Loops | Subscription lifecycle email (e.g. renewal and payment-failure notices). |
| Cloudflare (Turnstile) | Bot / abuse protection on forms. |
| GitHub | Repository access for the paid tools. |
We may also disclose data where required by law, or to establish, exercise or defend legal claims.
Some of our processors are based outside the UK (for example in the United States). Where personal data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, as applicable.
We keep personal data only as long as needed for the purpose it was collected, then delete or anonymise it. Order and billing records are kept as long as required for accounting and tax law (typically six years). Support messages are kept while relevant to your relationship with us. Hosted-scan records and email captures are kept for a limited period to run and improve the scan service, then removed. You can ask us to delete your data sooner (see section 8).
Under UK GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. To exercise any of these, email hello@nativerse-ventures.com. We will respond within one month. There is no charge unless your request is manifestly unfounded or excessive.
We keep cookies to a minimum. We use only what is necessary to run the site and to secure our forms (for example, Cloudflare Turnstile may set a token to verify you are not a bot). We do not use advertising or cross-site tracking cookies. If we introduce optional analytics in future, we will ask for your consent first and update this policy.
We protect data with measures appropriate to the risk, including encryption in transit, access controls, HMAC-verified webhooks for billing events, and keeping the number of systems that touch your data small. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the regulator of any breach where the law requires.
We may update this policy from time to time. We will change the "Last updated" date above and, for significant changes, take reasonable steps to tell you.
For any privacy question or request: hello@nativerse-ventures.com, or Nativerse Ventures Ltd, Flat 27, Pechiney House, The Grove, Slough, SL1 1QP, United Kingdom. If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to resolve it first.
