Voidpay compatibility connector privacy

This notice covers the one public, read-only MCP tool at https://voidpay-compat.voidly.ai/mcp. Voidly, operated by Ai Analytics LLC, provides it. No account, wallet, API key, checkout, or payment data is required. This notice describes data handling for this connector; other Voidly products have their own notices.

Request data processed

The adapter transiently reads an MCP JSON-RPC request body, capped at 16 KiB. Its permitted tool arguments are a required exact package version and optional caller-declared Node version, supported transport list, and short host label. Protocol and client metadata may also be received to handle the MCP call. The tool does not inspect the caller's computer or collect an account, marketplace, checkout, or payment record. Use a nonsecret host label; do not enter credentials or private content in an argument.

Cloudflare IP and rate limits

Cloudflare supplies the connecting IP address. The adapter validates and canonicalizes it as a key for a Cloudflare per-IP rate-limit binding, then checks a fixed aggregate key. The configured limits are 30 calls per 60 seconds for an IP key and 600 per 60 seconds for the aggregate key. Counters are per Cloudflare serving location and may be shared by users behind one client platform's outgoing IP. Cloudflare manages counter state; this notice does not assert its exact retention period. Missing or invalid IP identity, limiter failure, or disabled reads make the connector unavailable.

Fixed public npm read

For a valid tool call admitted by the rate limits, the adapter makes one GET to https://registry.npmjs.org/@voidly%2Fpay-mcp with Accept: application/json. The requested version selects a record from the returned metadata; it is not inserted into a caller-controlled URL. The optional host label, Node version, transport list, incoming request body, caller IP, cookies, authorization header, and client metadata are not forwarded to npm by the adapter. It returns selected release, engine, publication-time, hash, and transport-evidence fields, not npm's raw packument or README. npm operates the public registry and may process the Worker's outbound request under its own policies.

Storage and other infrastructure

The adapter source has no application database or console logging. The publisher's Worker configuration disables persisted Workers Logs, traces, and Logpush; MCP responses use Cache-Control: no-store. This HTML contains no scripts or externally loaded resources and does not set a cookie.

Cloudflare can separately process edge security events, IP addresses, user agents, aggregate traffic analytics, and rate counters. npm and the user's MCP client may keep their own records. Their retention and access settings do not follow from the adapter code. Voidly does not claim universal no-logging or a single retention period across these systems.

What the result establishes

The result includes an npm source URL and retrieval time. Those are not proof of the caller's installed runtime, connector launch, account access, marketplace state, checkout, or payment readiness. A requirements match uses caller-declared facts and reports declared_inputs_verified:false. Package metadata can change; unknown and source-error results remain uncertainty, not a successful host check. Public metadata access is not a blanket license to redistribute third-party data or code.

Contact

For privacy questions: privacy@voidly.ai. For security issues: security@voidly.ai. For connector help: Voidly support or support@voidly.ai. Do not send credentials or private content in a support message. See the connector documentation.