1. Scope
1.1. This Notice applies where you connect to, and use, the Attest platform through the Attest MCP server or connector (the “Connector“) made available via third-party artificial intelligence assistants, including Anthropic’s Claude, OpenAI’s ChatGPT and Microsoft 365 Copilot (each an “AI Assistant“).
1.2. The Connector allows an AI Assistant to call a defined set of Attest tools on your behalf to retrieve information from your own Attest account, such as study details, survey questions and answer options, survey results, saved segments, available demographic filters, boards and key findings and, where the Explore feature is enabled for your account, Explore interview transcripts and project analysis. The tools available may change from time to time, but unless otherwise stated, will fall within the categories of data described in this Notice.
1.3. This Notice covers only personal data handled in connection with the Connector. It does not change how Attest handles personal data in any other context, which continues to be governed by the Main Privacy Policy.
1.4. Your use of an AI Assistant is governed by the terms and privacy policy of the relevant AI Assistant provider. Attest isn’t responsible for how your chosen AI Assistant provider handles your data within its own product.
2. Categories of personal data we collect
2.1. In connection with the Connector, we may collect, store and process the following categories of personal data:
(a) account and authentication data, such as your name, work email address and the OAuth access and refresh tokens issued when you connect the Connector to your Attest account. We never collect or store your Attest password through the Connector;
(b) tool request data, being the parameters sent by the AI Assistant to Attest when a tool is called, such as search terms, study or project identifiers and filters;
(c) data returned to the AI Assistant in response to a tool call, such as study details, survey questions and answer options, survey results (both aggregated totals and individual respondents’ answers together with their associated demographic data), saved segments, boards and key findings and, where Explore is enabled, interview transcripts and project analysis; and
(d) technical and log metadata, being: (a) for each tool call, the tool name, timestamp, duration, Attest user ID, organization ID, OAuth client ID and, if the call fails, the error message; (b) for each request to the Connector, the request method, path, status and duration (for onward requests to the Attest platform, the path only); (c) when you first connect, the name and version of the AI Assistant client (for example, Claude Desktop); and (d) for login events only, your IP address and user agent.
3. What we do not collect
3.1. Through the Connector, Attest does not collect, request or process:
(a) the full conversation history, assistant memory, conversation summaries or other context from your session with the AI Assistant;
(b) files or documents that are not sent to Attest as part of a specific tool call; or
(c) access credentials and authentication secrets (such as API keys, one-time passcodes or passwords).
3.2. The Connector is designed to collect only the data necessary to perform the function of the tool that has been called. We do not collect extraneous conversation data, including for logging purposes.
4. Purposes and legal bases
4.1. We process personal data in connection with the Connector for the following purposes and on the following legal bases:
(a) to authenticate you and establish and maintain the connection between your Attest account and the AI Assistant, which is necessary to perform our agreement with you, or in our legitimate interest in providing a secure and functioning Connector;
(b) to receive and act on tool calls and to return the requested results to the AI Assistant, which is necessary to perform our agreement with you, or in our legitimate interest in delivering the Attest service;
(c) to maintain the security, integrity and reliability of the Connector and the Attest platform, including troubleshooting, fraud prevention and abuse detection, which is in our legitimate interest in keeping our services secure; and
(d) to comply with our legal and regulatory obligations.
4.2. Where Attest processes survey respondent and survey response data on behalf of a customer through the Connector, Attest acts as a processor and the customer acts as controller, as described in clause 9.
5. Categories of recipients
5.1. We may share data (including limited personal data) handled through the Connector with:
(a) the relevant AI Assistant provider, which receives the data returned in response to a tool call and handles that data under its own terms and privacy policy;
(b) Attest’s service providers who help us provide the Attest service, including Amazon Web Services, which hosts the Attest platform on servers located in Dublin, Ireland, as further described in the Main Privacy Policy;
(c) other Attest group companies, including Attest Technologies, Inc., in order to provide and support the Connector; and
(d) governmental, law enforcement or regulatory bodies, or other third parties, where we are required or permitted to do so by law, or where necessary to protect the security of the Attest service or to enforce our legal agreements.
6. Retention
6.1. We retain personal data handled through the Connector for no longer than necessary for the purposes set out in this Notice, in accordance with the following periods:
(a) technical and log metadata is retained for 30 days, after which it is deleted;
(b) OAuth access and refresh tokens are retained for no longer than 7 days, after which they expire and are deleted; and
(c) survey content, survey results and other data processed on behalf of a customer are retained in accordance with the relevant customer agreement and the Data Processing Agreement.
6.2. We may retain anonymised data that can no longer be linked to an individual for platform, usage and analytics purposes.
7. Your controls and rights
7.1. You can control the Connector and your data in the following ways:
(a) by disconnecting or removing the Connector within your AI Assistant application at any time;
(b) by contacting us at [email protected] to ask us to revoke the Connector’s access to your Attest account
(c) where you use the Attest service as part of an organization, through the controls made available to your account administrator; and
(d) by exercising your privacy rights set out in the Main Privacy Policy, including the rights of access, rectification, erasure, restriction, portability and objection, by contacting us at [email protected].
8. Use of AI and model training
8.1. Neither Attest nor its service providers use customer content or personal data handled through the Connector to train any artificial intelligence or machine learning models. As noted above, Attest is not responsible for how your chosen AI Assistant provider handles your data within its own product.
9. Processing on behalf of customers
9.1. Where Attest processes personal data on behalf of a customer through the Connector, that processing is governed by Attest’s Data Processing Agreement, available at askattest.com/legal/data-processing-agreement, under which Attest acts as processor and the customer acts as controller.
10. Security
10.1. Attest is certified to ISO/IEC 27001 and applies appropriate technical and organizational measures to protect personal data handled through the Connector, including encryption of data in transit and at rest, and access controls limiting access to those with a business need to know.
11. International transfers
11.1. Personal data handled through the Connector may be transferred to, and stored in, countries outside the United Kingdom and the European Economic Area. Where this happens, we apply appropriate safeguards. For example, including reliance on adequacy decisions and standard contractual clauses.
12. Contact and support
12.1. If you have any questions, concerns or complaints about this Notice or about how we handle your personal data through the Connector, or if you need product or technical support relating to the Connector, you can contact us at [email protected].
12.2. Our EU representative is as set out in the Main Privacy Policy.
13. Updates to this Notice
13.1. We may update this Notice from time to time. Any changes will be posted on this page and, where significant, notified to you by email or through the Attest service. Please check back to see any updates.
