Connector privacy policy

Who we are

Soumow (soumow.com) is a workspace for freelancers. This policy covers the Soumow MCP connector — the server at https://soumow.com/mcp that AI apps such as Claude use to access your Soumow account. It complements the Soumow privacy policy, which covers the rest of the service.

What the connector accesses

Only the data of the Soumow account that signed in and approved the connection: clients, projects and tasks, proposals, invoices and payments, appointments, and income and expense records. It reads this data only when a tool is called, which happens when you ask your AI app a question or give it a task. With the “Read and create drafts” permission it can also create or update the records described in the documentation.

What we store about the connection

• App registration: the name and redirect address the AI app gives when it registers (for example “Claude” and claude.ai).
• Your approval: which app you connected, the permission you chose, when it was created and last used, and a count of requests.
• Tokens: only one-way hashes of access and refresh tokens, never the tokens themselves.
• Activity log: your last 30 requests — time, tool name and whether it succeeded — shown to you in Soumow. We do not log tool inputs, outputs or conversation text.
• Abuse protection: short-lived counters keyed by a hashed IP address, deleted automatically within an hour.
• Records you ask the connector to create (drafts, tasks, clients, expenses, appointments) are saved in your workspace like any record you create yourself.

What we do not do

• We do not receive, read or store your conversations, chat history, memory or files from Claude or any other AI app.
• We do not sell your data or use it for advertising.
• We do not use your data to train AI models.
• We do not access other Soumow accounts or data beyond what you approved.

Sharing

Data returned by a tool goes to the AI app you connected, which processes it under its own privacy policy — for example Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini), Perplexity or xAI (Grok). We use hosting and network providers to run the service, who process data on our behalf. If you enable invoice reminders and approve one, the reminder email is sent to your client from Soumow. We do not share connector data with anyone else, except where required by law.

Retention

• Access tokens: 1 hour. Refresh tokens: 60 days, replaced on every use.
• Your approval: until you revoke it, or until your account is deleted.
• Activity log: the last 30 entries; older entries are overwritten.
• App registrations: kept while in use; unused registrations are removed over time.
• Workspace data: as described in the Soumow privacy policy, until you delete it or your account.

Your controls

• Revoke any connected app in Settings → Security → AI connection; access stops immediately.
• Choose “Read only” to prevent any changes; keep invoice reminders off to prevent any email to clients.
• Export your data or delete your account from Soumow settings at any time.

Security

All traffic uses HTTPS. Connections use OAuth with PKCE, tokens are short-lived and stored only as hashes, and each request runs with your account’s permissions and plan limits.

Changes

We will update this page when the connector’s data practices change, and change the date below.

Support and security

We answer connector questions in Arabic and English, usually within one business day.

• Contact form: soumow.com/contact/
• Security reports: use the same channel with the subject “Security”. We acknowledge reports within 2 business days, investigate them, and tell you the outcome. Please do not test against accounts you do not own.