WeatherOptics MCP
Privacy Policy

Effective Date: October 8, 2026

Last Updated: October 8, 2026

​

1. Who we are and what this policy covers

WeatherOptics provides weather-risk intelligence services to businesses. This policy covers the WeatherOptics MCP service — the connection at mcp.weatheroptics.co that lets you use WeatherOptics from an AI assistant such as ChatGPT or Claude. It explains what information we collect through that service, how we use and share it, how long we keep it, and the choices you have.

​

In this policy, "WeatherOptics," "we," "us," and "our" mean WeatherOptics, Inc., a Delaware corporation with its principal place of business at 23 Broadview Road, Westport, Connecticut.

​

2. Scope

This policy applies to the MCP service: the connection and sign-in flow, the permissions you grant, and the requests an AI assistant makes to WeatherOptics on your behalf. Other WeatherOptics products — the web portal, the API, alerts and reports, and our website — are governed by your organization's agreement with WeatherOptics.

​

A note on roles and your agreement. WeatherOptics is a business-to-business service; our customers are organizations. Rights in data submitted to WeatherOptics ("Client Data") are governed by your organization's agreement with WeatherOptics (the End User License Agreement and any Master Service Agreement); if that agreement and this policy conflict, the agreement controls. Where data-protection laws such as the GDPR apply, each party's role with respect to particular data is determined by that agreement and applicable law.

​

This policy does not cover the AI assistant providers themselves (OpenAI, Anthropic) — their own privacy policies govern how they handle your conversations and the data returned to them (see Section 6) — or any third-party platforms from which your organization's data originally came.

​

3. Information we collect through the MCP service​

​

Sign-in and connection data
Where it comes from: Created when you connect an AI assistant
What it includes:

• The login email you sign in with when connecting (your password is checked against a salted hash — we never store or see it in plaintext)

• The user and organization the connection belongs to

• Which permission scopes you granted

• Access and refresh tokens (stored hashed)

• Grant and revocation records

​

Tool requests
Where it comes from: Your AI assistant, acting on your instructions
What it includes: The parameters of each request an assistant makes on your behalf — place names, coordinates, routes, time ranges — plus timestamps, response status, and usage counts

​

Data retrieved on your behalf
Where it comes from: Your WeatherOptics account
What it includes: Weather and risk data, and your organization's saved locations, vehicles, and routes (names, coordinates, identifiers, and metadata) when you grant the saved-assets scope. This data already lives in your WeatherOptics account; the MCP service retrieves it and returns it to your assistant.

​

Technical and monitoring data
Where it comes from: Generated automatically
What it includes: Server logs (IP address, user agent, timestamps), error traces, and request timings used to keep the service reliable and secure

​

Fleet vehicle positions can, depending on your operations, be associated with an individual driver — your organization controls whether such data is stored in WeatherOptics and whether the saved-assets scope is granted.

​

4. How we use information

​

• Answer tool requests — compute and return forecasts, risk indices, severe-weather events, map imagery, route forecasts, and your saved assets, within the scopes you granted.

• Resolve place names to coordinates — place names and addresses in requests are sent to our geocoding providers (HERE and Google Maps) to get coordinates back.

• Authenticate and secure the connection — verify your sign-in, issue and validate tokens, enforce granted scopes, detect abuse.

• Meter usage — count requests for plan limits and rate limiting.

• Keep the service reliable — find and fix errors and performance problems.

• Meet legal obligations — security records and responding to lawful requests.

​

5. How we share information

​

We share information in these situations, and no others:

With service providers (subprocessors). Vendors that run the service may process information only to provide services to us, under contract, and not for their own purposes:

​

Google Cloud Platform
What it does: Hosting, storage, and compute (US regions)
Data involved: Service data

​

Cloudflare
What it does: DNS, proxy, and network protection
Data involved: Request metadata, IP addresses

​

HERE Technologies
What it does: Geocoding / place lookup
Data involved: Place names, addresses, and coordinates submitted for lookup

​

Google Maps Platform
What it does: Geocoding / place lookup
Data involved: Place names, addresses, and coordinates submitted for lookup

​

New Relic
What it does: Error and performance monitoring
Data involved: Error traces and technical request context

​​​

With your AI assistant provider. Responses to tool requests are returned to the assistant you connected (OpenAI's ChatGPT or Anthropic's Claude) — see Section 6.

​

For legal reasons. We may disclose information if required by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud or abuse. Where we are legally permitted to do so, we will notify the affected customer before disclosing their data.

​

In a corporate transaction. If WeatherOptics is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. The recipient would remain bound by commitments at least as protective as those in this policy, and we would notify affected customers.

​​

6. How the AI assistant connection works

​

Connecting and granting permissions

You connect an AI assistant to WeatherOptics using OAuth. During that flow you sign in with your WeatherOptics credentials and choose which permission scopes to grant:

• Weather and risk data (forecasts, impact indices, severe-weather events, map imagery)

• Route planning and route weather forecasts

• Your saved assets (saved locations, vehicles, routes)

• Geocoding / place lookup — included as a dependency, because place names must be resolved to coordinates before any of the above can run

• ​

The assistant receives an access token scoped to your user and organization. It cannot access anything outside the scopes you granted, and it cannot access data your WeatherOptics user account could not access on its own.

​

What the AI assistant can retrieve

Acting on your behalf and only within the scopes you granted, the assistant can retrieve:

• Weather forecasts and WeatherOptics impact/risk forecasts for locations you ask about

• Severe weather events near a location

• Map tile images

• Route weather forecasts for routes you specify

• Your saved locations, vehicles, and routes — including their names, coordinates, external identifiers, and associated metadata

That information is returned to the AI assistant, which uses it to answer you. Once data is returned to the assistant, it is handled under the AI provider's own privacy policy and terms — OpenAI's or Anthropic's, depending on which assistant you use, including how they retain conversation history and whether they use it for model training. Please review your AI provider's policy and your own settings there. WeatherOptics has no control over that handling.

​

What WeatherOptics receives — and does not

• We receive only the specific tool requests the assistant makes: for example, a coordinate pair, a place name, a route, or a time range, plus the token identifying your user and organization.

• We do not receive, read, or store your AI conversation content. We have no visibility into your prompts, the assistant's replies, or anything else in your chat beyond the parameters of the tool calls themselves.

• We log tool requests for usage metering, rate limiting, security, and debugging. Those logs contain the request parameters (which may include place names or coordinates you asked about), not conversation text.

• Geocoding parameters — the place names or addresses in a request — are sent to our geocoding providers (HERE, Google Maps) to resolve coordinates.

​

Your control

• You can disconnect at any time. Disconnecting or removing the WeatherOptics connection in your AI assistant's settings invalidates the tokens and immediately ends the assistant's access. You can also ask us or your organization's administrator to revoke a grant for you.

• Your organization's administrator can disable MCP access for the organization, which revokes all existing grants for all users.

• Narrowing scopes at connection time limits what the assistant can ever retrieve. If you do not want an assistant to be able to read your saved locations, vehicles, or routes, do not grant the saved-assets scope.

​

7. How long we keep information

​

We keep information for as long as needed to provide the service, and afterwards only as long as we need it for the purposes described in this policy or as required by law.

​

OAuth grants and tokens
Until revoked by you or your administrator, or until they expire; revocation records are retained for security purposes

​

Tool request logs / usage metering
Request logs are kept for a limited period for security, debugging, and reliability; aggregated metering records are kept as part of billing history

​

Error/performance monitoring
Retained for a limited period to support troubleshooting

​

Saved locations, vehicles, routes
Maintained in your WeatherOptics account under your organization's agreement — the MCP service retrieves them but does not keep separate copies

Backups
Deleted data persists in encrypted backups until they cycle out on a rolling schedule

​

Where a customer agreement specifies different retention or deletion terms, that agreement governs.

8. Security

​

• Encryption in transit (TLS) for all connections to the MCP service, and encryption at rest for data stored in Google Cloud Platform

• Passwords stored only as salted hashes; OAuth tokens stored hashed

• Scoped, revocable OAuth tokens — each grant carries only the permissions its user selected

• Internal access to production data limited to personnel who need it for operations and support

• Error and performance monitoring to detect anomalies

​

No system is perfectly secure, and we cannot guarantee absolute security. Tell us promptly if you suspect unauthorized access to your account or an unrecognized connected assistant.

​

9. Your rights and choices

​

• Disconnect an assistant at any time (Section 6), or ask your organization's administrator to revoke grants or disable MCP access entirely.

• Access, correct, or delete the underlying account data through your organization's WeatherOptics administrator, or by contacting us.

​

If you are in the EEA, UK, or Switzerland, and to the extent GDPR/UK GDPR applies, you may have the right to access your personal data; to correct inaccurate data; to erasure; to restrict or object to processing; to data portability; to withdraw consent where processing is based on consent; and to lodge a complaint with your local supervisory authority.

​

If you are a resident of California or another US state with a comprehensive privacy law, you may have the right to know what personal information we collect and how we use and disclose it; to access, correct, and delete it; to data portability; to opt out of sale, sharing for cross-context behavioral advertising, and certain profiling; and not to be discriminated against for exercising these rights. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is no "Do Not Sell or Share" mechanism to offer.

​

How to exercise your rights. Contact us through the channel in Section 12. We will verify your request — usually by confirming control of the account email or by working with your organization's administrator — and respond within the time the applicable law requires. If your data is in a customer's account, we will refer your request to that customer and support them in responding, consistent with our customer agreement.

​

10. International data transfers

​

Our infrastructure runs in United States regions of Google Cloud Platform, and several of our subprocessors are US-based. If you access WeatherOptics from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country. Where required for transfers of personal data out of the EEA, UK, or Switzerland, we use appropriate safeguards, together with technical measures such as encryption in transit and at rest.

​

11. Children's privacy

​

WeatherOptics is a business service intended for use by organizations and their personnel. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

​

12. Changes and contact

​

We may update this policy as the service and our practices change. When we do, we will revise the "Last updated" date at the top and post the new version at the same location. For material changes, we will give notice before the change takes effect.

​

Questions, requests, or concerns about privacy:

• Contact form: https://www.weatheroptics.co/contact-the-team

• Mailing address: 23 Broadview Road, Westport, Connecticut

​

If you are an individual user at a WeatherOptics customer organization, your organization's administrator can often resolve requests fastest — but you are welcome to come to us directly and we will help.

​​​​​​​​