Privacy Policy

Last updated 26 August 2026

This Privacy Policy explains how GGStudios SDN. BHD. (“GGStudios”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information when you use MCP Server List (the “Site”). It should be read together with our Terms of Service.

1. Who we are

The controller of personal information processed through the Site is:

GGStudios SDN. BHD.
Level 9, Vertical Corporate Tower B, Avenue 10, Bangsar South, No.8, Jalan Kerinchi, 59200 Kuala Lumpur, Malaysia
Email: [email protected]
Phone: +603 3948754311

2. Scope

This Policy covers personal information processed when you browse the Site, create an account, sign in with OAuth, submit a server, purchase advertising, leave a review, open a support ticket, or otherwise interact with us online. It does not cover third-party websites, MCP servers, clients, or repositories linked from listings—those have their own policies. Not affiliated with any of the products, brands, servers, clients, or third-party services listed on this website.

3. Information we collect

3.1 Information you provide

  • Account data — name or display name, email address, password (stored as a one-way hash), and profile details you choose to add.
  • OAuth identifiers — when you sign in with Google, GitHub, Discord, or similar providers, we receive identifiers and basic profile data those providers share with us (typically ID, email, and name/avatar, depending on your consent with that provider).
  • Submissions & ads — server metadata, URLs, descriptions, creatives, targeting preferences, and billing/contact details needed to fulfill orders.
  • Reviews & ratings — star ratings, review text, and associated account identifiers.
  • Support — ticket subjects, messages, and contact details you include.
  • Correspondence — emails or other messages you send us.

3.2 Information collected automatically

  • Usage & log data — IP address, approximate location derived from IP, browser and device type, pages viewed, referring/exit URLs, timestamps, and request metadata needed for security and operations.
  • Cookies & local storage — session and security tokens (for example login/session and CSRF protection). See Section 8.
  • Bot protection — signals from security providers such as Cloudflare Turnstile when enabled on forms (login, submit, and similar).

3.3 Information we do not intentionally collect

We do not ask for government ID numbers, full payment card PANs, or special-category data as part of ordinary Site use. Please do not submit sensitive personal data in reviews or tickets unless necessary for support.

4. How we use information

We use personal information to:

  • Provide, operate, secure, and improve the directory and Site features;
  • Create and manage accounts and authenticate users (including OAuth);
  • Process submissions, reviews, advertising orders, and related communications;
  • Process payments and maintain billing/accounting records;
  • Respond to support tickets and service-related notices;
  • Detect, investigate, and prevent fraud, abuse, scraping, and Terms violations;
  • Comply with law, enforce agreements, and protect our rights and users;
  • Analyze aggregate usage to improve performance and content (in de-identified or aggregated form where practical).

We do not sell your personal information for money. We do not use your personal information for third-party cross-context behavioral advertising as a core part of the Site. If that changes, we will update this Policy and provide choices required by law.

Where Malaysian PDPA or similar laws apply, we process personal information as needed to provide the Site and fulfill contracts, for legitimate interests (security, fraud prevention, improving the directory), with consent where required (for example certain cookies or marketing), and to comply with legal obligations.

If you are in the EEA/UK (or a similar regime), our typical bases are: contract performance (accounts, paid ads), legitimate interests (security, logs, product improvement—balanced against your rights), consent (where we ask for it), and legal obligation (tax/records).

6. How we share information

We may share personal information with:

  • Service providers acting on our instructions — hosting, databases, email delivery, CDN/security (for example Cloudflare), bot protection, and payment processing (for example PayPal).
  • Authentication providers — Google, GitHub, Discord, or others you choose when signing in; their processing is also governed by their policies.
  • Public Site content — information you intend to publish (server names, descriptions, links, review text, display names) may be visible to anyone on the internet.
  • Legal & safety — regulators, courts, or other parties when required by law or to protect rights, safety, or the Site.
  • Business transfers — in connection with a merger, acquisition, financing, or sale of assets, with appropriate safeguards.

We do not sell personal information to data brokers. Providers are only authorized to process data as needed to perform services for us.

7. Payments

Card and wallet details are handled by our payment processors. We typically receive confirmation and limited billing metadata (amount, currency, status, transaction IDs, and payer email) needed for fulfillment, support, fraud checks, and accounting. We do not store full payment card numbers on our servers.

8. Cookies & similar technologies

We use:

  • Essential cookies / storage — authentication/session, CSRF protection, and core preferences required for the Site to work.
  • Security / abuse prevention — technologies that help distinguish humans from bots on sensitive forms.

You can control cookies in your browser. Blocking essential cookies may break login, checkout, submissions, or other features. Third-party embeds (for example YouTube videos on some pages) may set their own cookies when you play or interact with them; those are governed by the third party’s policy.

9. Retention

We keep personal information only as long as needed for the purposes above, including:

  • Account data — while your account is active and for a reasonable period afterward for security and dispute resolution;
  • Published listings and reviews — while published or as needed for the directory’s integrity and legal claims;
  • Advertising and payment records — for the subscription/billing period and longer where tax, accounting, or anti-fraud rules require;
  • Support tickets — for ongoing support quality and legal retention needs;
  • Server logs — typically for shorter operational windows unless needed for security investigations.

You may request account deletion (see Section 12). We may retain limited records where law requires or where deletion would impair legitimate interests such as fraud prevention or resolving disputes.

10. Security

We use reasonable administrative and technical measures appropriate to the nature of the data—such as hashed passwords, HTTPS where configured, access controls, and abuse monitoring. No online service is 100% secure. Use a strong unique password, protect your OAuth accounts, and contact us immediately if you suspect unauthorized access.

11. International transfers

We operate primarily from Malaysia. If you access the Site from another country, your information may be processed in Malaysia and in other countries where our service providers operate (for example payment or CDN providers). Where required, we rely on appropriate transfer mechanisms and contractual protections with providers.

12. Your rights

Depending on your location, you may have rights to:

  • Access a copy of personal information we hold about you;
  • Correct inaccurate information;
  • Request deletion or restriction of processing;
  • Object to certain processing based on legitimate interests;
  • Withdraw consent where processing is consent-based (without affecting prior lawful processing);
  • Data portability, where applicable;
  • Lodge a complaint with a supervisory authority in your country.

To exercise these rights, email [email protected]. We may need to verify your identity and may decline requests that are unlawful, excessive, or would compromise others’ privacy or security. We aim to respond within a reasonable period (and within any deadlines required by applicable law).

If you are a California resident, you may have additional rights under the CCPA/CPRA (including to know, delete, and correct, and to not be discriminated against for exercising rights). We do not “sell” or “share” personal information as those terms are commonly defined for cross-context behavioral advertising in the ordinary operation of this Site. You may send consumer requests to the same email above.

13. Children

The Site is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

14. Third-party links & embeds

Listings, ads, and embeds may lead to or load content from third parties (GitHub, documentation sites, video platforms, MCP vendors, and others). Their collection and use of data are governed by their own policies. We are not responsible for their practices.

15. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be surfaced on the Site or by email when appropriate. Continued use of the Site after an update means you acknowledge the revised Policy.

16. Contact

For privacy questions or requests:
GGStudios SDN. BHD.
Level 9, Vertical Corporate Tower B, Avenue 10, Bangsar South, No.8, Jalan Kerinchi, 59200 Kuala Lumpur, Malaysia
Phone: +603 3948754311
Email: [email protected]