Privacy policy

Last updated: 2026-10-27. Operator: Mirai Studio, Inc. (株式会社みらいスタジオ), Tokyo, Japan. Questions and requests: security@spendctl.dev.

The sidecar you run

The spendctl sidecar runs on your machines. Without a licence key it sends nothing to us: no keys, no signed payment authorizations, no request or response bodies, no ledger rows. Policy, approvals and the ledger stay on the systems you control.

With a licence key (Pro, Team, Enterprise; sidecar 0.3 and later) the sidecar checks in with our control plane at start and once a day, sending five values: a random sidecar id it generated, its version, the month, the number of governed payments that month and the number of agents in its policy file. We use them to meter your plan, to renew or revoke the key and to detect abuse of a key, and we keep them for 13 months together with your organisation’s name, billing email and licence records. Nothing else leaves the sidecar: no agent names, hosts, bodies, prompts or network addresses; Cloudflare rate-limits that endpoint per client address inside its own service and we store no addresses. Setting SPENDCTL_CHECKIN=off stops the check-in. When ledger sync and approvals through the control plane launch, they will receive only the data you choose to sync, and this policy will be updated before that happens.

This website

Waitlist. If you join the waitlist we store your email address, the language of the page you used, and the plan you clicked, with a timestamp. We use them for one purpose: to tell you when the control plane opens. We do not send a newsletter. Each new sign-up also posts a notification with the same fields to a private Slack channel of ours.

Analytics. We use Google Tag Manager and Google Analytics to count visits and see which pages are read. In the EEA, the United Kingdom and Switzerland no analytics cookie is set unless you accept it in the banner shown on your first visit; until you do, visits are measured without cookies only. Elsewhere, analytics cookies are set by default. Your choice is stored in your browser only (localStorage key spendctl-consent) and can be changed at any time with the button below; declining also removes the Google Analytics cookies already set. Advertising features are off everywhere.

Hosting. The site is served by Cloudflare, which processes IP addresses and request metadata to deliver and protect it.

Rate limiting. The waitlist endpoint keeps a per-IP counter for one hour to block abuse. It is deleted automatically.

Sandbox connector. mcp.spendctl.dev hosts the login-free sandbox described on the Sandbox page. Each sandbox (its policy, mock receipts and approvals) is kept in isolated storage until it expires, two hours after its last call and 24 hours after creation at the latest. For product metrics we count tool calls by tool name, outcome and client family only; tool arguments, request and response bodies and client addresses are not recorded. Cloudflare rate limits requests per client address inside its own service; we store no addresses.

Processors

Cloudflare (hosting, DNS, email routing, waitlist storage, control-plane storage), Google (Tag Manager, Analytics), Slack (internal notifications). Data may be processed in the United States and other countries where these providers operate.

Retention

Waitlist entries are kept until the control plane launches and for 12 months after, or until you ask us to delete them. Sidecar check-in records are kept for 13 months; organisation and licence records until the organisation is deleted. Analytics data follows Google Analytics’ retention setting (14 months). Rate-limit counters expire after one hour.

Your rights

You can ask what we hold about you, ask for it to be corrected or deleted, or object to processing by writing to security@spendctl.dev. We answer within 30 days. If you are in the EEA or the UK you may also complain to your supervisory authority.

Changes

We will post changes here with a new date. Material changes to what the sidecar sends us will be announced before they take effect.