> For the complete documentation index, see [llms.txt](https://docs.dapta.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dapta.ai/dforms/developers/mcp-privacy.md). # MCP connector privacy What the dForms MCP connector can read and change, what your AI app receives, what dForms records for each tool call, how sign-in works, how long records are kept and how to disconnect. This page covers the dForms MCP connector at `https://mcp.dforms.ai/mcp`. It adds to the [dForms privacy policy](https://dforms.ai/en/privacy/), which applies to your account and to the data in your workspaces. To connect an app, see [Connect your AI agent (MCP)](/dforms/developers/mcp-connector.md). *** ## What the connector can read and change The connector acts as you, in the workspaces you can open in dForms, with your role in each one. It can reach what you can reach in the dashboard: * **Forms and folders:** questions, logic, scoring, design, drafts, published versions and links. * **Responses:** the answers people gave your forms, including personal data such as names, emails and phone numbers, plus scores, timestamps, campaign parameters and the page a form was answered on. For uploaded files, the connector returns a short-lived link to the file, never the file itself, and the link expires within minutes. * **Workspace settings:** the brand kit, the notification emails, the workspace's public link page, where each form's responses go (webhooks and HubSpot, with signing secrets masked), the delivery history, and which integrations are connected. * **Your account:** your workspaces and your role in each, and your public page. It cannot manage API keys, members, workspaces, your profile or language, or connect and disconnect integrations. What each tool does is listed in [What you can do](/dforms/developers/mcp-connector.md#what-you-can-do). Tools that delete or replace data ask the agent to confirm with you first. *** ## What your AI app receives The connector does not receive your conversation with the AI app. It receives only the tool calls the app makes for you: the tool's name and its arguments. Each result goes back to the AI app that asked for it. When you use dForms through Claude, Anthropic receives those results and processes them under your agreement with Anthropic. Through ChatGPT or Codex, OpenAI receives them under your agreement with OpenAI. Through another app, such as Cursor, OpenClaw or Hermes, its provider receives them under your agreement with that provider. Depending on what you ask, results can include respondents' personal data. *** ## What dForms records for each tool call For every tool call, dForms writes one **audit line** to its server logs: | Field | Detail | | ------------------- | ----------------------------------------------------------------------------------------------------------------------- | | When and which call | Time, a request id and the protocol version | | Who and where | The caller (the person for a sign-in, never the token), the workspace id, the member id and the person id | | What ran | The tool name, the ids of the forms it touched, whether it succeeded, the error code if it failed, and how long it took | | Arguments | Only a hash of their redacted shape: no form content, no names, no dates, no answers | dForms also sends one **usage event** per tool call to its product analytics (PostHog): | Field | Detail | | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | What ran | The tool name, whether it failed and the error type, and how long it took | | From where | The protocol version, and the AI app's name, version and user agent as the app reports them | | How you signed in | The credential type (sign-in or API key) and whether the call was made by Dapta staff | | Who and where | Your email as the person identifier, and the workspace id. A call made before you act in any workspace is sent under your person id without creating a profile | Neither record contains the tool's arguments or its results, an error message, or a form or workspace name. The connector itself keeps no conversation and no session: each call is answered and nothing else is stored. dForms also logs one line when it refuses a sign-in, with the reason only (not linked, no active workspace, or ambiguous), never the token. An unexpected error is logged with its error class and code, never its message. These records are used to run and secure the connector (an audit trail and rate limits), to fix problems and to understand how the connector is used. *** ## Sign-in * **OAuth through Dapta's sign-in.** Your AI app sends you to the Dapta identity provider, where you sign in with your email and a one-time code. dForms never sees or stores a password. * **Tokens are verified on every call.** Each request carries an access token issued for this connector. dForms checks its signature, issuer, audience and expiry on every call, and never logs the token. * **How a sign-in reaches your workspaces.** When you use dForms on the web, dForms records on your member which sign-in identity it belongs to and when you last signed in. A connector sign-in reaches only the workspaces where that record exists and is no older than 30 days, with your live role there. That is why you open dForms on the web before connecting. * **Access follows your membership.** If you are removed from a workspace or your member is deactivated, the connector stops reaching it on the next call. *** ## How long records are kept | Record | Kept for | | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | Audit lines and error lines | Kept as operational server logs. No fixed retention period is set by dForms; they are deleted on request | | Usage events | Kept in product analytics. No fixed retention period is set by dForms; they are deleted on request | | Forms, responses and settings | Your workspace data, kept until you delete it, as described in [Security & Privacy](/dforms/security-and-privacy.md#deleting-data) | To have connector records deleted, write to . *** ## How to disconnect * **Remove the connector in your AI app.** In Claude, remove dForms from your connectors. In ChatGPT, remove the dForms app. In Claude Code, run `claude mcp remove dforms`. In Codex, Cursor, OpenClaw or Hermes, remove the `dforms` server from the app's configuration. Your app then stops calling dForms with your sign-in. * **Access also ends on the dForms side** when you leave a workspace, when your member is deactivated, or when you have not used dForms on the web for 30 days. *** ## Contact Privacy, support and security reports: . --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.dapta.ai/dforms/developers/mcp-privacy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.