Privacy policy.

What Gentkey is. Gentkey (gentkey.com) is an MCP gateway: you connect third-party accounts once, and AI agents you authorize reach them through a single OAuth-protected endpoint. Handling your data carefully is the product, so this policy is short and literal.

What we store.Your account identity (email, sign-in metadata). The credentials of connectors you add — OAuth tokens and API keys — encrypted at rest with AES-256-GCM; they are decrypted server-side only at call time and are never sent to any AI model or agent. Your grants and constraints. An audit log of tool calls made through your gateway: the agent, the tool, the call’s arguments (with secret-shaped values redacted and payloads size-capped), and the allow/deny verdict.

What passes through. When an agent you authorized calls a tool, Gentkey forwards the request to the upstream service and returns the response. Tool responses are relayed to the agent that asked, not retained as content beyond what the audit log records about the call.

What we never do.We do not sell your data. We do not train models on your data. We do not let one user’s agents see another user’s connections. We do not show your credentials to anyone — including you, after you save them, and including the agents acting for you.

Where it lives. Application data is hosted in the United States (Google Cloud and Supabase). The marketing site is served by Vercel. The application sends product analytics to Google Analytics: a pseudonymous user id and categorical fields only (connector, tool name, allow/deny) — never emails, arguments, or credentials.

Your controls.You can revoke a grant, revoke an agent’s tokens, or disconnect a connector — disconnecting deletes its stored credential and grants. To have your account and everything attached to it deleted, or to ask anything about this policy, email hector@instasize.comand we’ll do it promptly.

Changes. If this policy changes materially, the effective date above changes with it, and the diff will be honest.