Privacy Policy

Last updated: August 13, 2026

This Privacy Policy explains how OpenCommerce Network, Inc., doing business as nekuda ("nekuda," "we," "us," or "our"), processes information in connection with our websites, WebMCP Kit, the WebMCP browser SDK distributed by nekuda, and related documentation and communications (together, the "Services").

For privacy questions or requests, email [email protected].

The short version

• The WebMCP Kit plugin works in your development environment. It does not upload your source code, routes, schemas, or generated tools to nekuda.
• The SDK sends limited usage telemetry by default. It is designed for product measurement, does not use a persistent visitor identifier, and does not include raw tool inputs or results.
• Full tool-call tracking is separate and off by default. A website operator may enable a channel that can include full URLs, tool inputs and results, error text, and persistent pseudonymous identifiers.
• Our websites collect ordinary visit data and information you submit. We also use analytics and advertising technologies as described below.
• We do not sell WebMCP Kit source code or telemetry for money. Some website advertising disclosures may be treated as "sharing" or targeted advertising under certain laws, even when no money changes hands.

1. Scope and roles

This policy applies to nekuda.ai, webmcp.com, the WebMCP Kit documentation website, the WebMCP Kit plugin and local review interface, and the nekuda WebMCP browser SDK, including packages currently or previously published under nekuda or AgentLane names.

OpenCommerce Network, Inc. is generally the controller of information collected through our websites and the SDK's default usage-telemetry channel.

When a website operator enables the SDK's separate authenticated tracking channel, that operator decides why the data is collected and which tools and destinations are configured. The operator is responsible for giving its visitors any required notice and obtaining any required consent. Where those events are sent to nekuda's hosted collection service, nekuda processes them to provide the service to that operator, subject to the applicable customer agreement. If the operator sends events only to its own endpoint or OpenTelemetry exporter, nekuda may not receive them at all.

2. The WebMCP Kit plugin

The plugin examines a developer's repository, proposes tools, writes approved code, and verifies the result through the coding agent running it. This work happens in the developer's environment. The plugin has no hosted source-code scanner and does not send repository contents to nekuda.

During an interactive run, the plugin may create a local .webmcp folder containing a tool plan, generated code copies, status records, comments, feedback, and approvals. Those files remain under the developer's control. They may be committed to a repository or included in a pull request if the developer approves that workflow, in which case the developer's source-control provider and repository access rules apply.

The coding agent that runs the plugin may process repository content under its own agreement and privacy policy. Installing the plugin or SDK, loading the local review interface, or publishing a pull request may also create ordinary request logs with the relevant package registry, code host, content-delivery network, or source-control provider.

3. Website visits, inquiries, and scans

When you visit our websites, our hosting and security providers may process standard request data such as IP address, user-agent information, requested page, referring page, timestamps, and security events. We use this information to deliver and secure the Services, prevent abuse, and diagnose technical problems.

If you contact us, request a demo, subscribe, ask to list a website, or otherwise submit a form, we receive the information you choose to provide, such as your name, business email, company, website, message, and related correspondence. We use it to respond, provide requested reports or support, and manage our business relationship. We may store this information in customer-relationship, communications, and support systems.

If you request a scan or agent-journey test on webmcp.com, we process the submitted URL or domain, business email, any journey prompt you provide, public content and WebMCP interfaces found on the submitted website, scan and tool outputs, diagnostic information, and report-delivery records. Automated browser and model providers may process relevant public website content and instructions to perform the scan, evaluate results, and produce the requested report. Do not submit a website you are not authorized to test or include personal information or secrets in a journey prompt.

4. Website analytics, cookies, and advertising

We use analytics and advertising technologies to understand use of our websites, improve content and conversion flows, measure campaigns, and reach people who may be interested in our Services. Depending on the site, your location, and your choices, these technologies may process:

• pages viewed, navigation, clicks, scroll depth, feature interactions, and conversion events;
• IP address, browser and device information, approximate location, referring page, and campaign parameters;
• cookies, local-storage identifiers, advertising identifiers, and similar technologies; and
• an opaque customer or CRM record identifier after a successful business inquiry, without sending the form's name, email, company, or message as analytics event properties.

Analytics and advertising providers act under their own terms and may combine information from our websites with information they receive elsewhere. Where a consent banner is available, you can use it to accept or decline the technologies it controls. You can also block or clear cookies in your browser and use provider-specific advertising controls. The core websites work without accepting optional cookies, although preferences and measurement may be limited.

5. Default SDK usage telemetry

Unless a website operator turns it off, the SDK sends a small event when it loads, when tools are registered, and when a tool call finishes. The events may include:

• SDK version and installation method;
• whether a WebMCP browser surface is available and how it was provided;
• a random session identifier created in memory for that page load;
• a reduced route pattern, route-segment count, broad referrer category, page visibility, and top-page or iframe context;
• browser name and major version when available, primary language, broad device form factor, and a coarse agent-runtime category;
• tool names and stable keys, versions and purpose categories supplied by the developer, registration outcomes, schema fingerprints, and counts describing schema shape;
• call order, outcome, duration, response size and block count, error class, and a standardized error signature; and
• ordinary network metadata that accompanies an HTTPS request, such as the site's origin, IP address, and user-agent header. An API key may associate an event with a customer account when configured by the website operator.

The default channel is designed for product-level measurement, not visitor profiling. Its event body does not intentionally include source code or repository content; page text or title; full URLs, query strings, or fragments; raw referrer URLs; tool descriptions, parameter names, or full schemas; tool inputs or results; raw error messages; names, email addresses, payment details, or account credentials; a persistent visitor identifier; or identifiers from cookies, localStorage, or sessionStorage.

The SDK reduces paths to route patterns and removes common variable values from error signatures. A site-controlled slug or unusual error message can still contain information those rules do not recognize. Website operators should not put personal information or secrets in URL paths or error messages and should disable telemetry where that cannot be assured.

Turning default telemetry off

For a guaranteed page-wide opt-out, set globalThis.__WEBMCP_TELEMETRY__ = false before the SDK loads. A registration can opt its own tools and calls out with registerTools(tools, { telemetry: false }). Because the SDK-load event is scheduled when the module is imported, use the page-wide flag when registration happens later in the page lifecycle. The SDK also stays silent when the browser sends Global Privacy Control and in server-rendering environments without a document.

6. Optional tool-call tracking

The separate tracking option is off unless a website operator configures an API key or enables OpenTelemetry. When enabled, it can process:

• a random visitor identifier stored in localStorage until browser storage is cleared;
• a random session identifier stored in sessionStorage and refreshed after 30 minutes of inactivity;
• event time, site origin, full page URL and path, referrer, and page title;
• tool name, stable key, version, call identifier, and duration;
• raw tool input and normalized result; and
• raw error text when a tool call fails.

Tool inputs, results, URLs, and error text are controlled by the website and may contain personal or sensitive information. Website operators that enable tracking must choose an appropriate lawful basis, provide their own notice, configure consent where required, limit the data their tools return, and avoid sending information they do not need.

Authenticated events may be sent to nekuda's collection service, a custom endpoint selected by the website operator, the operator's OpenTelemetry pipeline, or a combination of those destinations. The operator's privacy policy should identify the destinations it uses. Setting tracking: { disabled: true } stops this optional channel; it does not stop the separate default telemetry channel.

7. How we use information

We use information covered by this policy to:

• provide, maintain, secure, and troubleshoot the Services;
• respond to inquiries and deliver requested scans, reports, support, and communications;
• understand SDK adoption, browser compatibility, registration success, tool reliability, website use, and performance;
• improve our products, websites, documentation, and developer experience;
• measure and market our Services;
• prevent abuse and enforce applicable agreements; and
• comply with law and protect the rights, safety, and security of users, nekuda, and others.

We do not use WebMCP Kit telemetry to make decisions that produce legal or similarly significant effects about individual visitors.

8. Legal bases

Where applicable law requires a legal basis, we rely on legitimate interests in operating, securing, measuring, improving, and marketing the Services; contract when processing is necessary to provide a requested service; consent where required or chosen; and legal obligations or protection of rights where processing is necessary to comply with law or establish, exercise, or defend legal claims.

Website operators are responsible for deciding whether SDK telemetry is appropriate for their users and jurisdiction. If consent or a different notice is required, they should keep telemetry disabled unless and until those requirements are met.

9. How we disclose information

We may disclose information:

• to hosting, infrastructure, browser automation, model, analytics, advertising, security, communications, customer-relationship, support, and data-processing providers that help us operate the Services;
• to the relevant website operator or customer for authenticated tracking configured for that operator;
• to destinations selected by a website operator, such as a custom endpoint or OpenTelemetry provider;
• to professional advisers and authorities when reasonably necessary to comply with law or protect rights and safety; and
• as part of a merger, financing, acquisition, reorganization, bankruptcy, or transfer of all or part of our business, subject to appropriate protections.

We do not sell WebMCP Kit source code or telemetry for money. Some analytics and advertising disclosures on our websites may be considered a sale, sharing, or targeted advertising under certain privacy laws even when no money changes hands.

10. Retention

We retain information only for as long as reasonably necessary for the purposes described above, including service delivery, security, product and website analysis, customer commitments, dispute resolution, and legal compliance. The period depends on the information's nature and sensitivity, the feature that produced it, customer configuration and agreements, risk of harm, and applicable legal requirements.

We delete or de-identify information when it is no longer needed. Aggregated or de-identified statistics that no longer identify a person may be retained for longer. Local plugin files remain under the developer's control and follow the retention rules of the developer's device and repository.

11. International processing

nekuda and its providers may process information in the United States, Israel, and other countries where they operate. Those countries may have different data-protection laws from your country. Where required, we use recognized safeguards for international transfers, such as adequacy decisions, contractual protections, or another lawful transfer mechanism.

12. Security

We use reasonable technical and organizational measures designed to protect information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

13. Your choices and rights

Depending on where you live and the context, you may have rights to access, correct, delete, restrict, or receive a copy of personal information; object to certain processing; opt out of sale, sharing, or targeted advertising; withdraw consent; or appeal a decision about a request. You may also have the right to complain to your local data-protection authority. We will not discriminate against you for exercising applicable privacy rights.

Email [email protected] to make a request. We may need to verify your identity and authority. Because default SDK telemetry does not use a persistent visitor identifier, we may be unable to connect an event to you without details such as the website, approximate time, and page-load session identifier. If your request concerns tracking on a website that installed the SDK, contact that website operator first; we will assist the operator where required.

You can also use the SDK controls in Section 5, clear browser storage used by optional tracking, enable Global Privacy Control in a supported browser, use a website consent control where offered, or manage cookies and advertising preferences through your browser and the relevant provider.

14. Children

The Services are business and developer tools and are not directed to children under 16. We do not knowingly collect personal information from children through the Services. Operators of child-directed websites should keep SDK telemetry and tracking disabled unless they have established an appropriate legal basis and provided all required notices and controls.

15. Changes to this policy

We may update this policy as the Services or legal requirements change. We will post the revised policy here, change the "Last updated" date, and provide additional notice when required by law.

16. Contact

For privacy questions, rights requests, or complaints, contact:

OpenCommerce Network, Inc. (nekuda)
[email protected]
https://nekuda.ai