Privacy Policy

Home

Last updated: 24 June 2026

This Policy explains how Max Health Inc. ("we") processes personal data when you use Legal MCP. We are the data controller. For EU/EEA users, this Policy reflects the GDPR.

1. Data we process

• Account data — your email address (and name, if provided) from your chosen sign-in provider (Google or Max Health), plus the jurisdictions and plan on your account.
• Usage data — metering counts of your queries (to enforce allowances) and the request parameters needed to serve them. We aim to minimize retention of query content.
• Billing data — handled by Stripe. We receive subscription status and a customer identifier; we do not store your full card details.
• Technical data — standard request logs (IP, timestamps, user agent) for security and reliability.

2. Why, and our legal bases

• To provide the Service, your account, and billing — performance of a contract.
• To secure, operate, and improve the Service and prevent abuse — legitimate interests.
• To meet legal and tax obligations — legal obligation.

3. Processors & sharing

We share data only with service providers acting on our behalf: Stripe (payments), Cloudflare (hosting, and Workers AI for query enrichment), and your sign-in provider (Google or Max Health) for authentication. We do not sell personal data.

4. International transfers

Max Health Inc. is based in the United States, so data may be processed in the US and other countries. Where required, transfers rely on appropriate safeguards (such as the EU Standard Contractual Clauses).

5. Retention

We keep account and billing records for as long as your account is active and as needed for legal, tax, and accounting purposes, then delete or anonymize them. Logs are kept for a limited period for security.

6. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing, and withdraw consent where processing is based on it. EU/EEA users may also lodge a complaint with their local data-protection supervisory authority. To exercise any right, contact us at [email protected].

7. Cookies & sessions

Cookie	Purpose	Lifetime	Readable by
sid	Keeps you signed in to your dashboard.	7 days	Us only
oidc_state	Secures the sign-in flow against cross-site request forgery.	10 minutes	Us only
oidc_verifier	Holds the PKCE verifier that proves the sign-in was started by this browser.	10 minutes	Us only
oidc_next	Remembers the page to return you to after sign-in.	10 minutes	Us only

Every cookie above is strictly necessary to run the sign-in you asked for, which is why we ask for no cookie consent and show no cookie banner. We set no advertising, profiling, or cross-site tracking cookies, and we load no third-party scripts, tags, or fonts that could set their own. Card payments happen on Stripe's own checkout pages, under Stripe's policy. If you block or delete these cookies you can still read the site; you will not be able to stay signed in.

8. Children

The Service is not directed to children under 18 and we do not knowingly collect their data.

9. Changes

We may update this Policy; we will post the new version here with a revised date.

Contact

Max Health Inc. — [email protected]. Legal MCP is operated at legal.maxhealth.tech.