Privacy

Claude connector privacy

What data the Intrabase connector for Claude processes, why, where it is stored and for how long.

1. Scope

This policy explains how personal data is processed when you use the Intrabase connector for Claude (the MCP server at https://mcp.intrabase.app/mcp and the one in each intranet). It complements the general Intrabase privacy policy, which still applies to everything not covered here.

2. Data controller

Opengea SCCL is the controller of the data generated by the connector itself (authorizations and activity log). The content of your intranet (emails, documents, contacts, records) belongs to the organization that uses it, which is its controller; Opengea SCCL processes it on that organization's behalf to provide the service.

3. What data the connector processes

  • Authorizations (OAuth). When you connect Claude, an authorization linked to your user is created: the name of the client application (Claude), the permissions you accepted (read, or read and write), the creation date, the date and IP address of last use and, where applicable, the revocation date. Access and refresh tokens are stored only as a cryptographic hash, never in clear text.
  • Activity log. For each call: the user, the tool used, the call parameters (cut to 2,000 characters), the result (success, error or denied), the duration, the IP address, and the date and time. The content returned by the tools is not stored.
  • Technical data. The IP address and the date and time of requests in the web server logs, and the identification details you provide to find your intranet, which are used only at that moment and are not stored.
  • Intranet content. When Claude uses a tool, the connector reads or writes in your intranet, with your permissions, the information you ask for (for example, an email or a document) and returns it to Claude.

The connector does not store your conversations with Claude.

4. Why we use it and legal basis

  • To provide the service you request when connecting Claude to your intranet (performance of a contract, Article 6(1)(b) GDPR).
  • Security: preventing abuse, limiting the number of calls, investigating incidents and letting you see what the connector has done on your behalf (legitimate interest, Article 6(1)(f) GDPR).

We do not use this data for advertising, we do not sell it and we do not use it to train artificial intelligence models.

5. Where it is stored

Authorizations and the activity log are stored in your intranet's database. All the Intrabase infrastructure involved in the connector runs on Opengea servers in Hetzner data centres in the European Union (Germany and Finland).

6. Third parties: Anthropic

The connector exists to give information to Claude, a service of Anthropic. What the tools return (for example, the text of an email or document you ask for) becomes part of your conversation with Claude, and Anthropic processes it according to its privacy policy and the terms of your account or your organization's. Anthropic may process this data outside the European Economic Area. You decide what you ask for and you can disconnect the connector at any time.

We do not share the connector's data with any other third party, except where required by law.

7. How long we keep it

  • Access token: expires after one hour.
  • Refresh token: expires if unused for 60 days; it is renewed on every use.
  • Revoked or expired authorizations: deleted after 90 days.
  • Activity log: 12 months.
  • Web server logs of the universal address: 14 days.

If you disconnect the connector, access stops immediately. If your account or your organization is closed, the periods of the general policy apply.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to oficina@opengea.org. We will answer within one month at most. You can see your recent activity and disconnect the connector in Preferences › Claude in your intranet.

If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

9. Contact

For any question about this policy: oficina@opengea.org. For technical questions about the connector, see the connector documentation.

Last updated: 19 October 2026