Privacy Policy

What this policy covers

This policy applies to Stock Photo MCP — the website at www.stockphotomcp.com, the documentation, the account dashboard, and the MCP server at api.stockphotomcp.com (together, the “Service”).

It does not cover the stock-photo vendors' websites (where you license and buy images), the AI client you connect from (for example Claude), or the affiliate networks that route purchase links. Each of those is a separate company with its own privacy policy. When you leave the Service through a link, that third party's practices apply, not ours.

Information we collect

• Account information. Sign-in is through Google only. When you sign in we request the standard openid, email, and profile scopes and receive your name, email address, profile picture, and Google account identifier. We never receive or store a password.
• API keys. When you create an API key we show it once and store only a one-way hash of it — never the key itself — along with a label you choose, a short non-secret prefix so you can tell keys apart, and timestamps for when it was last used and whether it has been revoked.
• Search and usage data. When you or your agent search, we process the search terms, the assets selected, and clicks on the affiliate purchase links attached to results, so we can operate the Service and attribute affiliate referrals. Your search terms are also sent, in real time, to the stock-photo vendors whose libraries you search — that is how a live search works.
• Technical and log data. Our infrastructure providers automatically record standard request information such as IP address, browser or client type, and timestamps, which we use to run, secure, and debug the Service.
• Cookies. The site uses two: a session cookie that keeps you signed in, and a preference cookie that remembers your light or dark theme. We do not use advertising cookies, and we do not run third-party analytics or tracking on the site.

How we use your information

We use the information above to:

• provide, maintain, and improve the Service;
• authenticate you and validate your API keys;
• attribute affiliate referrals and calculate commissions;
• secure and monitor the Service, debug problems, and prevent abuse;
• meet our legal and accounting obligations; and
• contact you about the Service where necessary.

We do not sell your personal information, and we do not use it for advertising.

Consent

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), we rely on your consent to collect, use, and disclose your personal information for the purposes above. By creating an account or using the Service, you consent to those purposes. You can withdraw consent at any time by deleting your API keys, closing your account, or contacting us — though some functions of the Service will then no longer be available to you.

Who we share it with

We share personal information only with the service providers that run the Service on our behalf, and only as needed:

• Cloudflare — hosts the MCP server, the token store, and derivative-image handling.
• Vercel — hosts the website, documentation, and dashboard.
• Neon — the managed database that stores your account record and API-key hashes.
• Google — provides sign-in and, when you authorize it, shares your basic profile with us.
• Stock-photo vendors (for example Shutterstock and Adobe Stock) — receive your search terms live so results can be returned.
• Affiliate networks (for example Impact and Partnerize) — receive referral and click information so purchases can be attributed.

These providers are permitted to use the information only to provide their service to us. We may also disclose information if required by law, or to protect the rights, safety, or property of The Adpharm, our users, or the public.

Where your information is processed

The Adpharm operates from Canada, but our service providers process and store data in the United States and other countries. Your personal information may therefore be processed outside your province or country, where it may be accessible to courts, law enforcement, and regulatory authorities under local law. By using the Service you consent to this transfer.

How long we keep it

• Account record — kept while your account is open, and deleted or de-identified on request after you close it, unless we must retain it to meet a legal or accounting obligation.
• API-key hashes — retained, including after a key is revoked, so the key history and last-used record stay available for security and audit; removed when your account is deleted.
• Search, click, and log data — kept for as long as needed to operate the Service, support affiliate attribution, and maintain our business records, then deleted or de-identified.

Your rights

Under PIPEDA you have the right to:

• access the personal information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• withdraw your consent, as described under “Consent” above; and
• ask questions about how we handle your information.

To exercise any of these, email us at stockphotomcp@theadpharm.com. We'll respond within a reasonable time, usually 30 days. If you're not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Security

We protect your information with measures appropriate to its sensitivity: API keys are stored only as one-way hashes, sessions are carried in signed cookies, traffic is encrypted in transit (HTTPS), and we rely on reputable infrastructure providers. No method of storage or transmission is perfectly secure, so we cannot guarantee absolute security.

Children

The Service is a developer tool intended for businesses and professionals. It is not directed to children, and we do not knowingly collect personal information from anyone under the age of majority in their jurisdiction. If you believe a minor has provided us information, contact us and we'll delete it.

Changes to this policy

We may update this policy as the Service evolves. We'll change the effective date at the top and, for material changes, take reasonable steps to notify you. Continuing to use the Service after an update means you accept the revised policy.

Contact

Questions, requests, or complaints about privacy? Email stockphotomcp@theadpharm.com. The Adpharm is the organization accountable for the personal information under its control. See also our Terms of Service.