Privacy Policy
Privacy Policy
How Manu Labs, LLC handles personal information when you use Patch MCP, and when an AI assistant using Patch MCP calls you. Effective October 2, 2026.
- 1. Who this covers
- 2. What we collect
- 3. How we use it
- 4. Who we share it with
- 5. Text messages
- 6. If you received a call
- 7. How long we keep it
- 8. Cookies and links
- 9. Security
- 10. Your choices and rights
- 11. Children
- 12. Where data is processed
- 13. Changes
- 14. Contact
1. Who this covers
Two kinds of people are covered. Users verify a phone number with Patch MCP and connect an AI agent to it. People called answer, or are recorded on, a call placed through the Service. Visitors who simply browse www.patchmcp.com are covered too. Manu Labs, LLC is the controller of this information. It does not cover the AI client you connect (Grok, Claude, ChatGPT and so on), which handles your conversation with your agent under its own privacy policy.
2. What we collect
From users
- Phone number. The mobile number you verify. It identifies your account and is the caller ID on every call you place. We also record whether it is verified.
- Name and call defaults. The name used in the call introduction, your default language and region, saved voices by region, and any custom call agent instructions.
- Billing details. If you subscribe, the email address you give Stripe, your Stripe customer and subscription identifiers, your plan, its status and billing period. Card numbers go directly to Stripe; we never see or store them.
- Connected apps. Which MCP clients you have authorized, when, and the tokens that let them act for you (stored hashed).
- Sessions and device data. A session cookie, your browser's user-agent string, and your IP address, which we use for sign-in, security and rate limiting.
- Text messages. Verification request details and status, plus agent updates, service notices and replies when messaging is enabled, including attached pictures and delivery status (section 5).
- Usage records. For every call and message, what your plan was charged for it and what it cost us to carry: connected minutes, message parts, and the tokens and seconds of audio our AI provider billed. They are what your account page's usage figures are made of.
- Support messages. Anything you send to [email protected].
From calls
- Call records. For every call: the destination number and name your agent supplied, the objective and any context, the maximum length, when it was placed, answered and ended, how it ended and why, its duration, whether a machine or a person answered, and any carrier error.
- Audio and transcript. Calls are recorded from the moment they are answered and transcribed in real time. The transcript, a structured result extracted from it (outcome, summary, commitments, follow-ups, key facts) and a link to the recording are attached to the call.
- Do-not-call requests. Numbers that ask for no more calls, whether during a call or on the do-not-call page, together with the reason and the call it came from.
We do not collect information from data brokers. Our first-party acquisition measurement is described in section 8.
3. How we use it
- to place your calls from your number, run the voice assistant during them, and return results to you and your agent;
- to verify that you control your number, sign you in, and keep your account and connected apps secure;
- to screen each objective before dialing, enforce the opt-out list and your plan's allowance, and investigate abuse;
- to text you verification codes, the updates your agents send you and notices about your account, and to pass your replies to the agent they are meant for;
- to meter free calls, free texts and plan usage, take payment, and send receipts;
- to run, monitor, debug and improve the Service, and to keep logs of requests and errors;
- to respond to you, notify you of changes to the Service or these policies, and comply with law, carrier and regulatory requirements.
Personal information is never sold or used by us to train AI models. Phone numbers and call content are never used for advertising. Advertising measurement uses only the limited data described in section 8. We send call content to the AI providers described below to conduct and review your calls.
4. Who we share it with
The Service runs on the following providers, each of which receives only what its role requires and is bound by its own terms and privacy policy:
| Provider | Role | What it receives |
|---|---|---|
| Telnyx | Telephony and messaging: places calls, streams audio, records calls, carries text and picture messages to and from your number (and hosts the pictures you send for 30 days), holds your number as a verified caller ID | Your number, the destination number, call audio and recordings, answering-machine detection results, the text and picture messages exchanged with your number |
| xAI (Grok) | Objective screening, conversation checks and extraction of the structured result; also real-time voice when the Grok voice engine is used | The objective, context and names supplied for the call, the transcript, and live call audio when the Grok voice engine is used |
| ElevenLabs | Real-time voice conversations when the ElevenLabs voice engine is used, including speech processing and the agent's configured language model | Call instructions, objective, context, names, selected language and voice, and live call audio and conversation content |
| Stripe | Payments, subscriptions, receipts and the billing portal | Your email, plan, payment method and billing history |
| Railway | Hosting: the application, its database and cache | Everything stored by the Service |
| Google Ads | Advertising measurement | Ad click IDs, random event IDs, milestone timestamps and paid-subscription value and currency; no phone numbers or call content |
| Google Fonts | Web fonts on www.patchmcp.com | Your IP address and browser details when a page loads |
We also share information with your connected AI clients (account call history, statuses, transcripts, results and call links), with the people you call (your name as given in the call introduction and your phone number as the caller ID), and when required with carriers, regulators, law enforcement or courts, or to protect the rights and safety of users, people called, or Manu Labs, LLC. If Manu Labs, LLC is acquired or the Service is transferred, this information may move with it under the same commitments.
5. Text messages
Agent texting and picture messages are coming soon. Verification codes are available now; the agent messaging features below apply when texting is enabled.
Your number is texted for two reasons: the one-time codes that prove you control it, and the updates a connected agent sends you — how a call turned out, an answer it was waiting for — along with our own notices about your account. Agent updates and notices come from Patch MCP's toll-free number, (833) 680-0780, and go to the verified number on your account and nowhere else; the Service cannot text anybody but you. Texts you send back to that number are passed to your connected agent, which is what they are for.
For agent messages and replies, we store the direction, the number it went to or came from, its body, the links to any pictures attached, its status (queued, sent, delivered, or failed with the carrier's error) and the times it was created, sent, delivered or received. A picture your agent sends you is fetched by Telnyx from the public link your agent supplied; a picture you send is hosted by Telnyx for 30 days and passed to your agent as a link. Telnyx carries every message and sees the same details. Your connected AI client sees the messages it sent and the replies you texted back, under its own privacy policy.
No mobile information will be sold or shared with third parties for promotional or marketing purposes. Your number and your messages are used only to run the Service as described in section 3. They are never sold or rented, never used for advertising, never used to train AI models, and never shared outside the providers listed in section 4, each of which handles them only so that a message can be delivered.
Reply STOP to any message to stop agent updates and service notices; the opt-out is recorded on your account and kept until you text START. Verification codes continue either way, because they are how you prove the number is yours. Messages are kept with your account and deleted with it (section 7).
6. If you received a call
A call from an AI assistant using Patch MCP was requested by one of our users. The default opening identifies who the assistant is calling for and why, and its instructions require a recording disclosure before the first business question. The default instructions also require it to confirm that it is an AI if asked. Everything said on the call is recorded and transcribed, and the recording, transcript and a summary go to the user who requested the call. The number on your caller ID is that user's own mobile number, which you can use to reach them.
You can:
- tell the assistant you would rather not continue, and it will end the call;
- ask the assistant for no more calls, or enter your number on the do-not-call page, after which no user of the Service can reach it;
- email [email protected] to ask what we hold about a call to your number, or to ask us to delete the recording and transcript. We will need to confirm you control the number.
7. How long we keep it
- Account, settings and call records (including transcripts and results) are kept for as long as your account exists so you and your agents can review your history, and deleted within 30 days of a verified deletion request.
- Recordings are stored by Telnyx and streamed through private links that expire after about an hour, or through token-free links while you have made the call public; each is deleted with the call record it belongs to, or earlier on request.
- Do-not-call numbers stay on the list for good; a block we forgot would be no block at all.
- Text messages to and from your number are kept with your account, deleted within 30 days of a verified deletion request, and a recorded STOP is kept for good so the opt-out is not lost. Pictures attached to them are hosted by Telnyx for 30 days.
- Sessions expire after 30 days; connected-app tokens are removed after they expire or when you disconnect the app; verification codes expire within 10 minutes.
- Server logs (request metadata, errors, call identifiers; never call audio) are kept for a limited period for security and debugging.
- Billing and usage records are kept as long as tax and accounting law requires.
8. Cookies and links
www.patchmcp.com uses a session cookie to keep you signed in for up to 30 days. First-party analytics runs automatically on public pages and the phone-verification flow. We count page views and visits using random browser identifiers, group visits after 30 minutes of inactivity, and record the page path and source (such as direct, search, social, campaign or referring hostname). We do not collect full referrer URLs, search queries, private account or call-page URLs, or use fingerprinting. Browser traffic data is retained for up to 90 days. We honor Global Privacy Control by preventing capture, removing saved attribution and stopping pending reporting when we receive that signal. A separate, opaque cookie links Google ad click identifiers (GCLID, GBRAID or WBRAID), campaign tags or website source information to your account after you verify access. Attribution expires after 90 days. Direct, social, referral and organic source information stays in our first-party measurement and is not sent as a Google Ads click conversion. For advertising measurement, we send Google only click identifiers, milestone timestamps, random event IDs and, for a successful paid subscription payment, value and currency. Milestones are successful client tool discovery or use, the first completed call whose result says the objective was achieved, and the first successful subscription payment. We do not send phone numbers, names, call objectives, transcripts or recordings. Data already sent to Google is governed by Google’s privacy policy. Minimal milestone records remain with the account until deletion; source information, click identifiers and reporting payloads are removed when attribution expires.
Private links your agent gives you to your account, a live call or checkout carry a signed, expiring token. Public call links have no token or expiration and remain accessible while the call is public.
9. Security
Traffic to the Service is encrypted in transit. We store access tokens only as hashes, private share links to recordings and live calls carry a signature and an expiry, events our providers send us are checked against their signatures, and calls are private by default, visible to you or someone holding a valid private link. If you choose to make a call public, anyone with its permanent link can view the call details, transcript and result, and hear its recording or live audio. You can make it private again at any time to disable access without a token; existing private links remain valid until they expire. No system is perfectly secure; if we learn of a breach affecting your information we will notify you as the law requires.
10. Your choices and rights
From your account page you can change your name and call defaults, disconnect apps, and manage or cancel your subscription. By emailing [email protected] you can ask for a copy of the information we hold about you, ask us to correct it, ask us to delete your account and calls, or object to a use of it. We will verify the request, usually with a code texted to the number concerned, and respond within 30 days. The law where you live (California, Canada and the European Economic Area, for example) may give you some of these rights, along with the right to complain to a supervisory authority; we extend them to everyone regardless, and exercising them never changes how we treat you.
11. Children
The Service is for adults. We do not knowingly create accounts for anyone under 18, and users may not direct calls at children. If you believe a child has an account or has been called improperly, contact [email protected] and we will act on it.
12. Where data is processed
Manu Labs, LLC is based in the United States and the Service is hosted there. Calling coverage includes the Åland Islands, Albania, Andorra, Argentina, Austria, Belgium, Belize, Bolivia, Bosnia & Herzegovina, Brazil, Bulgaria, Canada, Chile, Colombia, Costa Rica, Croatia, Cyprus, Czechia, Denmark, Ecuador, El Salvador, Estonia, Falkland Islands, Faroe Islands, Finland, France, French Guiana, Germany, Gibraltar, Greece, Greenland, Guatemala, Guernsey, Guyana, Honduras, Hungary, Iceland, Ireland, Isle of Man, Italy, Jersey, Kosovo, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Mexico, Monaco, Montenegro, Netherlands, Nicaragua, North Macedonia, Norway, Panama, Paraguay, Peru, Poland, Portugal, Romania, Russia, San Marino, Serbia, Slovakia, Slovenia, Spain, St. Pierre & Miquelon, Suriname, Svalbard & Jan Mayen, Sweden, Switzerland, Ukraine, United Kingdom, United States, Uruguay, Vatican City, and Venezuela, subject to carrier and route availability. If you use the Service from elsewhere, your information is transferred to and processed in the United States, where privacy law may differ from your country's.
13. Changes
We may update this policy. The effective date at the top shows the current version. For material changes we will give notice on www.patchmcp.com, by text message to your account number, or by email if we have one, before the change takes effect.
14. Contact
Manu Labs, LLC · [email protected]. Please include the phone number concerned so we can find the right records.