Privacy Policy

Effective date: 9 April 2026 — Last updated: 9 April 2026

1. Who we are

This Privacy Policy is issued by Datastroom IT (Pty) Ltd ("Datastroom", "we", "us"), a company registered in the Republic of South Africa, contactable at support@zmcp.app. Datastroom is the publisher of ZMCP, a software product that exposes SAP system capabilities as MCP (Model Context Protocol) tools.

This policy explains what personal data we collect, why, how we use it, who we share it with, and what rights you have. It applies to:

• Visitors to https://www.zmcp.app (the "Website")
• Customers who purchase a ZMCP licence (the "Service")
• Anyone who contacts us via support@zmcp.app

2. What this policy does NOT cover

ZMCP is software that you install on your own SAP system. Once installed, you decide which third-party AI providers (Anthropic, Google, OpenAI, DeepSeek, etc.) it connects to. When you send prompts and tool results from your SAP system to those providers, the data flows directly from your network to theirs — it does not pass through Datastroom infrastructure, and we have no visibility into it.

Datastroom is not the data controller for that traffic. The AI providers are. Their privacy policies, data retention rules, and training-data usage terms apply, not ours. You are responsible for evaluating each provider's terms before pointing ZMCP at it. We strongly recommend reviewing the data masking configuration in your installation before enabling untrusted providers.

3. What we collect — and why

3.1 Website visitors

Nothing. The Website is a static set of HTML files served by a CDN. We do not run analytics, we do not set cookies, we do not embed tracking pixels, we do not log IP addresses on our side. Your hosting provider's edge (Cloudflare) may keep short-term operational logs for abuse prevention; those are governed by Cloudflare's privacy policy and we do not access or retain them.

3.2 When you purchase a ZMCP licence

To issue you a cryptographically signed licence file, we need to know who is buying and which SAP system the licence is for. The four data points are:

• Customer name (individual or organisation) — appears on your invoice and in the signed licence payload
• Email address — for licence delivery, renewal reminders, and support correspondence
• SAP Installation Number (10 digits, from SLICENSE on your system) — embedded in the licence so it can only be activated on the system it was issued for
• SAP System ID (SID) (3 characters) — same purpose as installation number

These four values are collected by Paystack at the checkout stage and forwarded to us in the order notification email. We use them only to generate and email you the licence file, log the transaction in our internal records (for renewal management and audit), and respond to support requests about the order.

3.3 Payment data

Payments for ZMCP are processed by Paystack (Stripe group) as our payment processor. They handle the card details, billing address, and the payment itself. We never see your card number, CVV, billing address, or full payment information — we only receive a confirmation that the order completed and the four data points listed in 3.2.

Paystack's privacy policy is at https://paystack.com/privacy. For all questions about payment data handling, refer to them.

3.4 Support correspondence

If you email us at support@zmcp.app, we keep the conversation in our email system for as long as needed to provide support, resolve the issue, and meet any legal record-keeping obligations. We may also keep anonymised notes about recurring issues or feature requests to improve the product. We do not share support correspondence with anyone outside Datastroom.

3.5 What ZMCP collects from you (the answer is "nothing")

This is worth stating loudly because it differentiates ZMCP from most modern SaaS products. Once installed:

• ZMCP does not "phone home". There is no telemetry, no usage analytics, no error reporting to Datastroom, no automatic updates check.
• The licence verification happens entirely offline using SAP's standard SSF_KRN_VERIFY against a certificate in your own SAP PSE. No internet connectivity is required.
• Audit logging of every tool call, prompt, and response is written to a table (ZMCP_AUDIT_LOG) on your own SAP system. We do not have access to it. It exists for your team's security review, not ours.
• The data masking framework that redacts sensitive fields before they reach AI providers runs on your SAP system. No masking rules, masked output, or unmasked data ever leaves your system.
• If you discover a code path that contradicts any of the above, please report it as a security issue to support@zmcp.app. We treat unsolicited outbound traffic from ZMCP as a defect.

4. How we use your information

We use the information collected under section 3.2 to:

• Generate and deliver your signed licence file
• Issue renewal reminders 30 days before expiry
• Process licence re-issues for system copies, refreshes, or hardware migrations
• Respond to support requests and maintain a record of resolved issues
• Comply with legal record-keeping obligations (tax, accounting)

We do not use your information for marketing campaigns, behavioural profiling, advertising, or sale to third parties. We do not have a marketing list. If you receive an email from us, it relates to your purchase or your support request.

5. Who we share your information with

The only third parties that ever see your purchase data are:

• Paystack (Stripe group) — our payment processor. They process payments and forward order details to us. Privacy policy.
• Cloudflare, Inc. — our DNS provider, domain registrar, and the CDN that serves www.zmcp.app. They have no access to customer purchase data; their role is limited to website hosting infrastructure. Privacy policy.
• Email provider — we use a standard email service to send and receive correspondence at support@zmcp.app. They process email metadata and content as a data processor on our behalf.
• Tax authorities — we may disclose information when required by law or to comply with valid legal process from a competent authority.

That is the complete list. We do not share, sell, rent, or trade your information with anyone else.

6. International data transfers

Datastroom is based in the Republic of South Africa. Paystack is part of the Stripe group and operates from Nigeria and the United States. Cloudflare is based in the United States with a global network. By purchasing ZMCP, you understand that the four data points in section 3.2 may be transferred to and stored in those jurisdictions for the purposes described in this policy.

We rely on the standard contractual safeguards published by these providers (Paystack/Stripe and Cloudflare both publish standard contractual clauses for international transfers under GDPR Article 46). If you require a Data Processing Addendum, contact us.

7. Data retention

• Active licences: retained for the duration of the subscription plus 7 years thereafter for tax/accounting compliance under South African law
• Expired or cancelled licences: name, email, installation number, and SID retained for 7 years after the last transaction
• Support correspondence: retained for 3 years after the last interaction, then deleted
• Payment records: handled by Paystack under their retention policy

You can request earlier deletion of your record under section 8, subject to our legal record-keeping obligations.

8. Your rights

Depending on your jurisdiction, you may have the following rights regarding personal data we hold about you. We honour these rights regardless of which jurisdiction you are in — we are not going to argue about whether GDPR or POPIA technically applies.

• Right to access — ask us what personal data we hold about you and receive a copy
• Right to correction — ask us to correct inaccurate or incomplete data (e.g., a misspelt name on your licence)
• Right to deletion — ask us to delete your personal data, subject to legal record-keeping obligations
• Right to portability — ask us to provide your data in a machine-readable format
• Right to object — object to processing, where applicable
• Right to lodge a complaint — with the South African Information Regulator (POPIA) or your local data protection authority

To exercise any of these rights, email support@zmcp.app with the request and the email address used at purchase. We respond within 30 days.

9. Cookies and tracking

This website does not use cookies. It does not use analytics. It does not embed third-party tracking scripts. It does not run client-side fingerprinting. It is a static set of HTML, CSS, and SVG files served from a CDN.

If we ever change this (for example, to add privacy-respecting analytics like Cloudflare Web Analytics, which is cookieless), we will update this policy and clearly state what is being collected and why.

10. Children

ZMCP is a B2B product targeted at SAP system administrators and ABAP developers. The Service is not directed at children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us and we will delete it.

11. Security

We take reasonable technical and organisational measures to protect your personal data:

• The licence-signing private key is stored offline on hardware controlled by Datastroom and is never transmitted
• Customer records are stored on a small number of devices with full-disk encryption
• Email is accessed via authenticated TLS connections only
• The Website is served exclusively over HTTPS via Cloudflare's edge

No system is perfectly secure. In the unlikely event of a personal data breach affecting your information, we will notify you and the relevant supervisory authority within 72 hours of becoming aware, in accordance with applicable law.

12. Changes to this policy

We may update this policy to reflect changes in our practices, legal requirements, or services. Material changes will be communicated by email to active subscribers and posted on this page with an updated "Last updated" date. The latest version of the policy is always available at https://www.zmcp.app/privacy.html.

13. Contact

For any privacy-related question, request, or complaint, contact us at:

Datastroom IT (Pty) Ltd
Republic of South Africa
Email: support@zmcp.app