Q4 MCP privacy policy

What the connector does

After you sign in, your AI client can call Q4 tools to look up Saudi listed companies and retrieve verified figures and cited excerpts from filings and earnings-call transcripts. Q4 returns text excerpts and metadata. It does not send PDF or audio file bytes through MCP.

Personal data we process

• Account. Name, email address, and a hashed password, collected when you sign up on the connect page or when Q4 creates your account. We do not store your password in plain text.
• Subscription. Whether you have platform or MCP-only access, your free trial dates, expiry, and the StreamPay customer and subscription identifiers needed to confirm payment.
• OAuth. The client identifier and redirect URL your AI tool presents, which we check against its published client metadata, and a PKCE challenge. The authorization code (valid for 5 minutes) and access token (valid for 7 days) are signed tokens; we do not store them, and we do not issue refresh tokens.
• Tool requests. The parameters your client sends (for example a company symbol or search phrase) so we can return results. For each call we record the tool used, the company, the first 200 characters of a search, whether it succeeded, how long it took, and the name and user agent of your AI tool.
• Technical logs. IP address, user agent, timestamps, and error codes generated by our hosting provider when you reach the authorize page or MCP endpoint. Our server logs also record your account ID and email address with each MCP request.

Q4 does not receive your full Claude or ChatGPT conversation. We only see the tool calls the client sends to Q4 and the excerpts we return.

How we use it

• Authenticate you and enforce an active MCP entitlement, including a free trial for new accounts.
• Return research results you asked the client to fetch.
• Process MCP-only checkout through StreamPay when you subscribe from the connector.
• Operate, secure, and debug the service (including rate limiting).
• Respond to support requests you send to contact@q4.sa.

Sharing

We share personal data only as needed to run the connector:

• Your AI client (Claude, ChatGPT, Cursor, or another MCP client) receives the excerpts and citations you requested.
• OpenAI, Cohere and Jina AI receive search phrases to find and rank the relevant passages in Q4’s research library.
• StreamPay processes MCP-only payments. We share your name, email address and account ID with StreamPay; card details are handled by StreamPay, not stored by Q4.
• Infrastructure providers that host the API and database (including Vercel and our PostgreSQL host).
• Authorities when required by applicable law.

We do not sell personal data. We do not use MCP tool queries to train third-party foundation models.

Retention

Account and subscription records are kept while your account is open and as long as we need them for billing, security, or legal obligations. Authorization codes expire in minutes. Access tokens expire in 7 days. Hosting and application logs are kept only as long as needed for operations and abuse prevention.

Security

Access to tools requires a valid token and an active subscription. Passwords are hashed. OAuth uses PKCE. We apply per-user rate limits and sanitize error responses. No method of transmission or storage is completely secure; if you believe an account is compromised, email contact@q4.sa.

Your rights

Depending on applicable law, including the Saudi Personal Data Protection Law, you may request access, correction, or deletion of your personal data, or object to certain processing. Email contact@q4.sa. We may need to verify the request and keep limited records where the law requires it.

Children

The connector is intended for professional use and is not directed at children under 18.

Changes

We may update this policy. The date at the top of the page will change when we do. The current version is always published at https://q4.sa/mcp/privacy.