Privacy Policy

Scalpels is operated by Artisan Build, Inc. This policy covers the Scalpels website, accounts, and agent connections, including connections from ChatGPT, Claude, and other MCP clients. Questions or privacy requests can be sent to [email protected].

What we collect

• Account and team information. Your name, email address, password hash, authentication settings, team memberships, roles, and invitations.
• Connected infrastructure information. Details of the repositories, hosting accounts, applications, environments, domains, deployments, and connections you ask Scalpels to manage. We store credentials needed for those connections, with provider tokens encrypted at rest.
• Billing information. Stripe customer, checkout, payment, and subscription references, billing contact details, payment status, and purchase history. Payment details are collected through Stripe's hosted checkout. Scalpels does not collect full card numbers through its own forms.
• Support and community content. Reports, suggestions, replies, messages, attachments, and profile or listing information you submit. Public partner and supporter listings contain information intended to appear on the website. Community content is shared with the people who can access the relevant conversation. Do not upload secrets or confidential material to public listings or community attachments.
• Usage and operational information. Page and event analytics when enabled, authentication and security records, request and error information, and records of actions taken through Scalpels. Infrastructure providers also receive connection information such as IP addresses when serving the site and its assets.

Why we use it

We use this information to provide accounts and team access, connect the services you choose, deploy and manage your applications, process payments, deliver email, respond to support requests, moderate public listings, understand site usage, and investigate failures or abuse.

When you request an introduction to a partner, we send your name and email address to that partner so they can respond. When you submit a public listing, its approved name and other public listing fields may appear on the site.

Agent connections and product data

Your installed products run in your own infrastructure. Scalpels stores the account and infrastructure records needed to manage them, rather than hosting their application databases.

If you connect an AI assistant or another MCP client, that client can request the information and actions permitted by your grant and team role. Depending on the permissions you authorize, this can include reading infrastructure details, deploying applications, changing connections, and calling tools in installed products. You can revoke agent access in Scalpels.

When an agent calls a tool in an installed product, its arguments and the product's response pass through Scalpels' memory. This is not end-to-end encryption between the client and the product. Scalpels does not intentionally persist the relayed arguments or response content in its databases, caches, sessions, queues, files, logs, traces, analytics, or error reports. We retain relay audit metadata such as who called which deployment and tool, when, whether it succeeded, and the response size.

This relay handling is different from a support report or community message, which is stored when you submit it. The AI or MCP service you choose receives the responses sent to it and handles them under its own terms and privacy policy. Disconnecting Scalpels does not delete information already received by that service.

Services that receive information

The services below support implemented Scalpels features. Which services receive information depends on the features you use and the deployment configuration.

Our hosting, storage, and operational monitoring services also process information needed to run and protect Scalpels. The code supports optional monitoring and alternative email providers. Their presence in the code does not mean every provider is enabled.

We may also disclose information when required by law, to protect users or the service from abuse, or as part of a transfer of the business subject to applicable law.

Cookies, analytics, and videos

Scalpels uses cookies and related browser storage for sign-in, session security, and interface preferences. Disabling essential cookies may prevent you from signing in. Fathom's policy explains its own analytics processing.

Product pages use films served from our own bucket. Other editorial content may contain an embedded external video. When it does, the video provider receives browser requests. Following an external link, including a link to our YouTube channel, takes you to a service with its own privacy policy.

Retention and deletion

We keep account, infrastructure, support, billing, and audit records for the operation of the service and applicable legal, accounting, and security needs. There is no single deletion period that applies to every category in this initial policy. Contact us about the records relevant to your request.

You can delete your login account in account settings after transferring ownership of any teams you own. Deleting your login does not delete a team's shared records, subscriptions, customer-owned infrastructure, or every support and audit record. Disconnecting a provider removes the Scalpels connection but does not necessarily revoke access at the provider or delete resources there. You may need to revoke credentials or remove resources in the provider's own controls.

Security and your choices

We use access controls and encrypted storage for provider credentials. No service can guarantee that information will never be accessed, lost, or disclosed without authorization.

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the use of your personal information, object to certain processing, or complain to a data protection authority. Contact [email protected] to make a request. We may need to verify your identity and account for other people's rights and legal recordkeeping requirements.

Service providers may process information outside your country. Applicable rights and transfer requirements depend on your location and the services involved.

Changes to this policy

We will publish revisions on this page and record them in the changelog below. Where applicable law requires additional notice, we will provide it.