@@ -199,7 +199,7 @@ For example:
 - `from WZIAtMx4LLhzit02`
 
 > [!IMPORTANT]
-> This is a best-effort action, and if some of the probes are no longer online, they will be missing from the new results. Additionally, as measurements expire (lifetime depends on user type), you should not hard-code measurement IDs, as new tests will break after a measurement expires.
+> This is a best-effort action, and if some probes are no longer online, they will be missing from the new results. Additionally, as measurements expire after up to six months, you should not hard-code measurement IDs, as new tests will break after a measurement expires.
 
 You can obtain the measurement ID through the "share" functionality. For example, use `--share` in the CLI, find the "Share URL" section at the bottom of the web results or receive it by calling the API directly.
 
@@ -330,6 +330,8 @@ Here are some tips:
 
 ### Things to keep in mind
 
+Measurement parameters and results are public, may be accessed by anyone with the measurement ID, and may be published or made discoverable. Do not include credentials or other confidential information in measurement targets, options, or headers, and avoid including unnecessary personal data. Measurements are typically available for up to six months.
+
 #### Probes share no UUIDs
 Our probes don't expose unique IDs that you can use to target them explicitly. Instead, we recommend fine-tuning the probe selection by using and combining filters or specifying IDs from previous measurements, as described in the best practice section above.
 
 
@@ -6,3 +6,6 @@
 | <img src="https://github.com/user-attachments/assets/070ce124-0c5f-4c30-a251-bcd20aec336d" alt="DeluxHOST Logo" width="150" title="DeluxHOST" /> | [DeluxHOST Website](https://deluxhost.net/) |
 | <img src="https://github.com/user-attachments/assets/f9d6c1ce-46e5-44a6-a471-aa2226665e67" alt="ServerAstra logo" width="150" title="ServerAstra" /> | [ServerAstra Website](https://serverastra.com/) |
 | <img src="https://github.com/user-attachments/assets/009af8c1-e8b3-4aad-b6f1-78b448c3bd28" alt="KernelHost logo" width="150" title="KernelHost" /> | [KernelHost Website](https://www.kernelhost.com/) |
+| <img src="https://github.com/user-attachments/assets/7320a3a5-5655-41c8-9474-4d1f406dc01b" alt="Nevacloud logo" width="150" title="Nevacloud" /> | [Nevacloud Website](https://nevacloud.com/) |
+| <img src="https://github.com/user-attachments/assets/d058eeda-ad8b-4ec9-b7f8-ca5595eba7a4" alt="UP-Network logo" width="150" title="UP-Network" /> | [UP-Network Website](https://up-network.ch/) |
+| <img src="https://github.com/user-attachments/assets/2bc02092-7775-4096-aeb8-59190c82a0d0" alt="TheHost logo" width="150" title="TheHost" /> | [TheHost Website](https://thehost.com.ua/) |
@@ -1,8 +1,8 @@
 # Privacy Policy
 
-*Effective date: November 16, 2024*
+*Effective date: September 16, 2026*
 
-Volentio JSD Limited ("us", "we", or "our"), a company registered in England and Wales, operates the global.io ("Website") and the Globalping Service (collectively, the Services).
+Volentio JSD Limited ("us", "we", or "our"), a company registered in England and Wales, operates the Globalping service under the globalping.io domain and the hosted Globalping Model Context Protocol (MCP) service at mcp.globalping.dev (collectively, the "Services"). This policy applies whether you access the Services directly or through ChatGPT, Codex, Claude, or another MCP client or integration.
 
 When we collect, use and process personal data we are subject to the provisions of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are also subject to the EU General Data Protection Regulation (EU GDPR) in relation to personal data we collect, use and process in the European Economic Area (EEA).
 
@@ -20,23 +20,21 @@ Our Service may contain links to other sites that are not operated by us. If you
 
 3. **we, us and our:** refers to Volentio JSD Limited and its directors;
 
-4. **you and your:** refers to the person who is accessing our Website or Globalping and whose data is processed;
+4. **you and your:** refers to the person who is accessing our Services and whose data is processed;
 
 ## 2. Information Collection
 
-1. We collect the following types of information depending on which one of our Services you use or access:
+1. We collect the following types of information depending on which Services you use or access:
 
-   1. 2.1.1	Usage Data Globalping
+   1. **Service Usage Data:** We may collect information about how the Services are accessed and used. This may include your IP address, browser or client type and version, referrer domain, URLs visited on globalping.io, timestamps, unique device or request identifiers, and other diagnostic, security, and network data.
 
-      1. We may collect information how the Service is accessed and used ("Usage Data").
+   2. **Account and Contact Data:** When you create an account, we collect information such as your username, email address, and authentication credentials. We may also collect your email address and other information you provide when you contact us.
 
-      2. (ii)	This Usage Data may include information such as your computer's Internet Protocol address (e.g. IP address), browser type, browser version, referrer data (limited to domain), the URLs of our Service that you visit (limited to the globalping.io domain), the time and date of your visit, unique device identifiers and other diagnostic data. We never associate any gathered data with specific users or try to track their usage at any point and in any way.
+   3. **Measurement Data:** We collect the parameters submitted for a measurement and the results generated by it. These may include targets, requested locations, measurement options, custom HTTP headers, probe information, network paths, DNS responses, and other measurement output. Measurement Data is public by design, may be accessed by anyone with the measurement ID, and may be published or made discoverable. Do not include credentials or confidential information in Measurement Data, and avoid including unnecessary personal data.
 
-   2. Usage Data Website
+   4. **MCP Usage Data:** When you use our hosted MCP service, we may record tool names, information submitted to and returned by MCP tools (including Measurement Data), timestamps, duration, errors, MCP client name and version, User-Agent, request and network metadata, an internal session identifier, a generic authentication category, and the OAuth client ID where applicable. Request metadata may include IP, country, request, or session-related identifiers supplied by your client or our infrastructure. If you use the `get_more_tools` tool, we may also collect the missing-capability description submitted to that tool.
 
-      1. Registration information: We collect information such as your name and contact data, including username and email address, and credentials such as your password, during account creation.
-
-      2. Contact data: we may collect your email address when you contact us in relation to your use of the Services.
+2. We exclude the authentication credentials provided in the transport-level MCP `Authorization` header from MCP Usage Data. We do not generally detect or remove secrets included in ordinary tool inputs, measurement targets, query values, custom headers, or results. You must not submit credentials or other confidential values in those fields.
 
 ## 3. Use of Data
 
@@ -48,15 +46,21 @@ Our Service may contain links to other sites that are not operated by us. If you
    4. monitor the usage of our Services,
    5. detect, prevent, and address technical issues.
 
-2. Please note that our Services is not intended for use by children, and we do not knowingly collect or use personal information relating to children. If you are a parent or guardian and you are aware that your children have provided us with personal data, please contact us. If we become aware that we have collected personal data from children without verification of parental consent, we take steps to remove that information from our servers.
+2. We use MCP Usage Data to understand which MCP tools and clients are used, diagnose failed or slow calls, improve tool descriptions, behavior, and reliability, understand requested capabilities, and protect and operate the Services. We do not use MCP Usage Data for advertising or sell it.
+
+3. Please note that our Services are not intended for use by children, and we do not knowingly collect or use personal information relating to children. If you are a parent or guardian and you are aware that your children have provided us with personal data, please contact us. If we become aware that we have collected personal data from children without verification of parental consent, we take steps to remove that information from our servers.
 
 ## 4. Retention of Data
 
 1. We will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy.
 
 2. We will retain and use your personal data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.
 
-3. We will also retain non-aggregated Usage Data for internal analysis purposes, for example, to detect abuse of our Services. Non-aggregated Usage Data is retained for a shorter period of time until it is analyzed and deleted, except when this data is used to strengthen the security or to improve the functionality of our Service, or we are legally obligated to retain this data for longer time periods.
+3. Measurement Data is public. We retain it to provide results and to operate and protect the Services. The current standard period for which measurements are available is stated in our [API documentation](https://globalping.io/docs/api.globalping.io). We may retain data longer where necessary to investigate abuse, resolve disputes, or comply with legal obligations. Anyone who accesses public Measurement Data may store a copy independently, potentially indefinitely; we cannot control or delete those copies. We may retain measurement-derived operational or aggregated statistics for longer; these do not contain MCP client or session details.
+
+4. We retain MCP Usage Data for up to 60 days, unless a longer period is needed for a specific security investigation or legal obligation.
+
+5. We retain other non-aggregated Usage Data only for as long as needed for operational analysis, abuse prevention, security, and service improvement, unless we are legally required to keep it longer.
 
 ## 5. Transfer of Data
 
@@ -89,15 +93,15 @@ For further information on cookies, when we will request your consent before pla
    5. To request the deletion of personal data held about you;
    6. You have the right to data portability for the information you provide to us. You can request to obtain a copy of your personal data in a commonly used electronic format so that you can manage and move it.
 
-3. Please note that we may ask you to verify your identity before responding to such requests.
+3. We may ask you to verify your identity and provide information that helps us locate the relevant personal data before responding to a request.
 
 ## 9. Sharing your data with others
 
-1. We may employ third party companies and individuals to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services or to assist us in analysing how our Service is used.
+1. We may employ third party companies and individuals, including hosting, content delivery, analytics, and observability providers, to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services or to assist us in analysing how our Service is used.
 
 2. These third parties have access to your personal data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.
 
-3. Content Delivery: We use third-party Service Providers to serve all of our traffic under the domain globalping.io. This means all of these providers have access to your IP address and other information sent by your web browser. This information is used for analytics and security purposes. Neither we nor our providers track any individual user.
+3. **Content Delivery:** We use third-party Service Providers to serve traffic under the globalping.io domain. These providers have access to your IP address and other information sent by your browser or client. This information is used for service delivery, analytics, and security purposes.
 
 ## 10. CCPA