As of: 22 October 2026
This page explains what happens to data when an AI agent, assistant or app calls the Bankrolled.ai MCP server (https://bankrolled.ai/mcp) or its related endpoints (/llms.txt, /.well-known/*, /mcp/health).
What the service does
- It is read-only. It returns sourced personal-finance facts (limits, deposit-protection schemes) with an as-of date and a source link.
- It never moves money, never opens or connects accounts, and gives no financial advice.
- It needs no sign-in, account or API key. All tools are currently free.
What we receive
Like any website, each request reaches us with standard technical details: your IP address, user agent (the app or bot name), the URL requested, the time, and the request body (for MCP calls, the tool name and the arguments such as a country or topic). Please don’t put personal information in tool arguments; the tools don’t need any.
What we keep, and where
- Usage counters (Cloudflare Workers KV). We count calls per day, per tool and per caller type, stored under keys like
m:v0:{day}:calls:{tool}:{type}. Caller type is one of: our own tests, a self-declared AI/agent bot, a monitor or empty user agent, or unknown. We also count a few events per day (for example “not in catalogue” answers). - Distinct-caller counts (Cloudflare Workers KV). To count how many different callers we have per day and per week, we store a shortened one-way hash (16 hex characters of SHA-256) of the IP address plus user agent, with the caller type and date. We do not store the raw IP address, the user agent text, or the request or response body in KV. A hash like this is pseudonymous rather than anonymous, so we treat it as personal data. Each list is capped at 2,000 entries per day or week.
- Platform logs. Our hosting provider, Cloudflare, processes requests and may keep its own request and error logs. Our Worker writes only error messages to its logs, not request contents.
- Lookups passed to our website. To answer a fact or scheme lookup, the server asks the bankrolled.ai website API, identified as “Bankrolled.ai MCP Worker”, passing on the lookup terms. That web server may keep standard access logs.
- Rate limiting. To keep the service available we apply a short rate limit keyed on IP address (30 requests per 10 seconds). This is handled in memory by Cloudflare and isn’t stored by us.
We don’t sell data, use it for advertising profiles, or track you across sites. Links in answers to bankrolled.com may carry ?via=mcp so we can count visits that came from agents; that tag contains no personal data.
How long we keep it
- Distinct-caller hashes in KV: retained for no more than 90 days, after which they are deleted automatically.
- Daily usage counters in KV contain no personal data and are kept as aggregate statistics.
- Cloudflare platform logs: kept by Cloudflare under its own retention policy. Our Worker logs only error messages.
- bankrolled.ai web server access logs: kept under our hosting provider’s standard log settings.
Note, 22 October 2026: the automatic 90-day deletion, and a weekly rotating salt for the caller hash, are scheduled to go live on 26 October 2026. Hashes collected since 3 October 2026 will be covered by the 90-day limit when it takes effect, so none will be kept longer than 90 days.
Why we process it (lawful basis)
Legitimate interests: running, securing and improving a free public service, and understanding overall usage. We store only a shortened hash rather than IP addresses, which keeps the impact on you low.
Who is responsible
The data controller is CLYFAR LTD (trading as Bankrolled.com), registered in England and Wales, Companies House no. 08922294, registered with the UK Information Commissioner’s Office (ICO) under ZC259271.
Your rights and contact
You can ask about, access, or ask us to delete data about you, or object to processing, by emailing [email protected]. Because we store only hashes, we may need the IP address and user agent you used to find any matching record. You can also complain to the ICO at ico.org.uk.
For the main bankrolled.com website, see the bankrolled.com privacy policy.