Privacy Policy: MAASAI Labs plugins

Last updated: 30 October 2026

This policy covers the ten MAASAI Labs plugins and the hosted MCP servers behind them (the "Services"):

The source code for every server is public under the MIT licence at https://github.com/MAASAI-Labs. You can read exactly what each one does.

1. Who we are

The Services are operated by Maasai Technologies Limited, a private company limited by shares registered in Nigeria with the Corporate Affairs Commission under RC 6868686, whose registered office is at 10 Abdulkareem Adisa Close, Guzape, Abuja Municipal Area Council, Federal Capital Territory, Nigeria. We publish the plugins under the name MAASAI Labs ("we", "us").

Contact for privacy questions and data requests: colepresley000@gmail.com.

2. The short version

• No account with us is needed and we do not ask for your name or email.
• Seven of the ten plugins store nothing about you. They answer each request and forget it.
• Three plugins (WhatsApp Community Manager, Call Anyone, X Marketplace Seller) keep the working records you create, such as scheduled posts, call plans and sales listings, so the tools can work across requests.
• API keys and tokens you supply are used for that request only. They are never written to storage.
• We do not sell your data, use it for advertising, or use it to train AI models.

3. Information processed by all plugins

Requests you send. When your AI assistant (for example Cursor) calls a tool, it sends the tool name and the inputs it chose to our server over HTTPS. The server uses them to produce the answer and returns it.

Hosting logs. The servers run on Vercel. Vercel, as our hosting provider, records standard request information such as IP address, time, URL path and response status, under its own retention settings. Our code also writes error messages to these logs when something fails; an error message can include part of the request. Hosting logs are kept for a limited period set by Vercel.

Short-term caches. To be polite to public data sources, several servers keep copies of public responses in memory for minutes to hours (for example launch schedules, CVE records or price lists). These caches live only in the running server instance and disappear when it restarts. They hold public data, keyed by the address that was fetched, which can include the term you looked up (for example a domain name or CVE id).

We do not use cookies or analytics on the MCP servers.

4. What each plugin does with your data

SAFE & Cap Table Calculator

All calculations run on our server with no outside calls. Nothing is stored. "Scenario tokens" are your inputs compressed into the token text itself and returned to you; we keep no copy.

Space Launch & Starlink Tracker

Fetches public data from The Space Devs Launch Library 2, the Spaceflight News API and CelesTrak. If you ask for satellite passes, the latitude and longitude you give are used on our server to compute the passes. They are not sent to those sources and are not stored.

Orbital Watch

Fetches public data from CelesTrak (including SOCRATES close-approach reports) and NOAA's Space Weather Prediction Center. Nothing about you is stored.

Breach Radar

• Breach catalogue and company lookups: sent to Have I Been Pwned (HIBP).
• Password checks: your password is hashed (SHA-1) on our server and only the first 5 characters of the hash are sent to the Pwned Passwords service (k-anonymity). The password itself never leaves our server and is not stored.
• Email breach checks: only work if we, as operator, have set an HIBP API key. If so, the email address you ask about is sent to HIBP. Without a key, no request is made.
• CVE and exploited-vulnerability lookups: sent to the NIST National Vulnerability Database and read from CISA's Known Exploited Vulnerabilities list.
• Domain reports: for a domain you name, the server makes one HTTPS request to that domain's home page, reads its TLS certificate, queries public DNS through Cloudflare DNS over HTTPS, and queries certificate-transparency logs (crt.sh, and SSLMate Cert Spotter as a fallback). It does not scan or probe. The target site will see a request from our server. Nothing is stored beyond the short-term cache.

Chip Intel

Fetches public vendor pages (NVIDIA, AMD, Google Cloud, AWS, Intel, TSMC, Samsung), SEC EDGAR data, news RSS feeds, and the US Consolidated Screening List file from trade.gov. Names you screen are matched against the downloaded list on our server; they are not sent to trade.gov. Nothing about you is stored.

WhatsApp Community Manager

• Your credentials: to use group features you supply your own Green API instance ID and token (or your own WhatsApp Cloud API token and phone number ID). They are sent with each request, used to call Green API (or Meta's WhatsApp Cloud API) on your behalf, and never stored.
• Messages: when you read or summarise a group, messages are fetched from your Green API instance and processed in memory to produce the answer. We do not store them.
• Scheduled posts: if you schedule a post, we store the chat ID, message text, send time, provider and status (and the message ID or error after sending) in a private Vercel Blob store.
• Third parties: Green API is an independent service that connects to WhatsApp; it is not operated by WhatsApp or Meta. Your use of it is governed by Green API's own terms and privacy policy, and by WhatsApp's terms.

Call Anyone in Any Language

• Your credentials: you supply your own Bland AI or Twilio account details. They are sent with each request, used to call those providers, and never stored.
• What we store: call plans you prepare (the phone number, its country and type, language, goal, caller name, who the call is on behalf of, context, key points and questions) and records of placed calls (provider call ID, number, language, goal, time, status and cost estimate), in a private Vercel Blob store.
• What the providers receive: to place a call, the number and call script are sent to Bland AI or Twilio. The call audio, recording and transcript are created and held by that provider under your account and their policies. When you ask for a transcript or summary we fetch it from the provider and return it; we do not store it.
• The person you call is told at the start that they are speaking with an AI. Emergency and premium-rate numbers are refused.
• You are responsible for having a lawful basis to call the person and for any consent needed to record or transcribe the call where you and they are located.

Prediction Market Odds

Fetches public market data from Polymarket and Kalshi. Nothing about you is stored.

X Marketplace Seller

• What we store: listings you create (title, description, condition, prices including your private floor and ceiling, quantity, photo names, location and handoff options), buyer conversation threads you paste in (buyer handle, message text and offers), and deals (buyer, price, status, dates), in a private Vercel Blob store.
• Your X token: only needed to post a listing or send a DM. It is sent with each request, used to call the X API, and never stored. Posts and DMs happen only after you confirm.
• Third party: X (api.x.com), under X's terms and privacy policy and your own developer account.

Domain Hunter

Availability and registration lookups go to domain registries through RDAP (found via IANA's public bootstrap files) and to WHOIS servers; DNS lookups go through Cloudflare DNS over HTTPS; certificate checks connect to the domain you name; prices come from Porkbun's public pricing API. The domain names you check are therefore sent to those services. Purchase links point to Porkbun, Namecheap or Cloudflare Registrar search pages, and aftermarket links to Afternic, Sedo, GoDaddy and ExpiredDomains.net. The links carry no affiliate or referral codes and we earn nothing from them. We never buy or reserve domains. Nothing about you is stored.

5. How stored records are kept separate

For the three plugins that store records, each request is assigned to a private space ("tenant"). The tenant is a one-way SHA-256 hash of the credentials you send, or of an x-user-key header if you send one. We cannot reverse the hash to get your key, and one tenant cannot read another's records.

If you send no credentials and no x-user-key, your requests share a single public demo space that anyone else in the same situation can also see. Do not put real or personal data there.

6. How long we keep data

• Request handling and in-memory caches: only while the server instance is running.
• Hosting logs: for the limited period set by our hosting provider, Vercel.
• Stored records (WhatsApp scheduled posts, call plans and records, seller listings and deals): until you ask us to delete them, or 12 months after your last use, whichever is sooner. The plugins do not currently include a delete tool, so email us with the plugin name and, if possible, your x-user-key, and we will delete your tenant's records.

7. Who we share data with

Only the service providers needed to run the Services: Vercel (hosting and Blob storage) and the third-party sources listed in section 4, each of which receives only what that tool needs. We do not sell or rent personal data and do not share it for advertising. We may disclose data if required by law.

8. International transfers

Our servers and storage run on Vercel's infrastructure, and the third-party services above are located in various countries, including the United States. Our hosting provider, Vercel, may process data in the United States. Data may therefore be processed outside your country.

9. Your rights

Depending on where you live (for example under the Nigeria Data Protection Act 2023, the EU or UK GDPR, or US state laws), you may have the right to access, correct, delete or restrict the use of your data, and to complain to your data protection authority. Email colepresley000@gmail.com and we will respond within 30 days.

10. Security

Requests use HTTPS. Stored records are kept in private Vercel Blob storage. Credentials are not stored. No system is perfectly secure; if we learn of a security incident affecting your data we will notify you where required by law.

11. Children

The Services are not directed at anyone under 18, and you must be 18 or older to use them.

12. Changes

We will post any changes on this page and update the date above.