Codey MCP Connector — Privacy Policy / 隱私權政策

Effective date / 生效日：2026-07-15  |  Last updated / 最後更新：2026-07-15

English

1. Who we are

The Codey MCP Connector ("the Connector") is operated by 依智科技股份有限公司 ("Codey", "we", "us"). Codey is a law-firm practice-management platform. The Connector lets a lawyer operate their own firm's Codey workspace from an MCP client such as Claude.

Contact: [email protected]

2. Scope

This policy covers data processed by the MCP Connector service only (https://mcp.thecodey.com). Your firm's Codey backend, web app, and client portal are covered by your existing Codey service agreement and privacy terms; the Connector does not change them.

3. What the Connector accesses

When you connect Claude to Codey and issue a request, the Connector accesses — on your behalf and scoped to your authenticated law-firm account — the following categories of data through your firm's Codey backend:

• Cases — case details, status, categories, timelines.
• Clients — client/contact records (name, tax ID, contact details).
• Tasks — task assignments, due dates, status.
• Calendar — hearing and meeting events.
• Documents — case document metadata and download links (the Connector does not upload or read file contents).
• Portal messages — messages exchanged between the lawyer and the client portal.
• Notifications — your in-app notifications.

This data is law-firm information and may include personal data of your clients. The Connector accesses it only to fulfil the specific request you make in your MCP client.

4. What we store — and what we do not

The Connector is a stateless router. It does not persist your cases, clients, tasks, documents, calendar events, or messages. Those always remain in your firm's own Codey backend.

The only data the Connector stores is authentication state, held in a Redis cache:

We do not sell your data, use it for advertising, or use it to train any AI model.

5. How a request flows

1. You authenticate once via OAuth 2.1 (Authorization Code + PKCE). The Connector verifies your credentials against your firm's Codey backend and issues a session token to your MCP client.
2. For each request, your MCP client sends the token to the Connector over HTTPS.
3. The Connector identifies your firm (via an internal identity registry that maps your email to your firm and its backend address) and forwards the request to your firm's backend only.
4. The result is returned to your MCP client and is not retained by the Connector.

Tenant isolation: your session token is bound to your firm. The Connector cannot route your requests to, or return data from, any other firm.

6. Third parties

• Anthropic — your MCP client (e.g. Claude). Your prompts and the data returned by the Connector are processed by Anthropic under Anthropic's own terms and privacy policy.
• Your Codey backend — hosts and processes your firm's data.
• Google Calendar — calendar events may sync via your firm's Codey backend if your firm has enabled that integration; this sync is performed by the Codey backend, not by the Connector.

We do not share Connector data with any other third party except as required by law.

7. Security

• All transport is encrypted with HTTPS/TLS.
• Authentication uses OAuth 2.1 with PKCE (S256); implicit flow is not supported.
• Session and refresh tokens are short-lived and expire automatically.
• High-risk actions (e.g. sending a message to a client, deleting a calendar event) require explicit user confirmation in the MCP client before execution.
• Per-token rate limiting protects against runaway automated loops.

8. Your rights / data deletion

Because the Connector does not store your firm's content, requests to access, correct, or delete that content are handled through your firm's Codey account. To revoke the Connector's access, disconnect it in your MCP client and/or contact us at [email protected]; cached session tokens expire automatically within 7 days of disconnection.

9. Changes

We may update this policy. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by notice within the Codey product.

10. Contact

依智科技股份有限公司 — [email protected]

繁體中文

1. 我們是誰

Codey MCP 連接器（下稱「本連接器」）由依智科技股份有限公司（下稱「Codey」「我們」）營運。Codey 是律師事務所管理平台。本連接器讓律師可透過 Claude 等 MCP 用戶端，操作自己事務所的 Codey 工作區。

聯絡方式：[email protected]

2. 適用範圍

本政策僅涵蓋 MCP 連接器服務本身（https://mcp.thecodey.com）所處理的資料。貴所的 Codey 後端、網頁應用程式與客戶 Portal，仍適用你既有的 Codey 服務合約與隱私條款，本連接器不改變之。

3. 本連接器會存取的資料

當你將 Claude 連接到 Codey 並發出指令時，本連接器會以你的身份、且僅限於你已驗證的事務所帳號範圍內，透過貴所 Codey 後端存取以下類別資料：

• 案件：案件詳情、狀態、分類、期程。
• 客戶：客戶／聯絡人資料（姓名、統編、聯絡方式）。
• 任務：任務指派、期限、狀態。
• 行事曆：開庭與會議行程。
• 文件：案件文件的中繼資料與下載連結（本連接器不會上傳或讀取檔案內容）。
• Portal 訊息：律師與客戶 Portal 之間的往來訊息。
• 通知：你的站內通知。

上述屬於事務所資料，可能包含貴所客戶的個人資料。本連接器僅為完成你在 MCP 用戶端發出的特定指令而存取之。

4. 我們儲存什麼、不儲存什麼

本連接器是無狀態的轉發層，不會保存你的案件、客戶、任務、文件、行程或訊息——這些資料始終留在貴所自己的 Codey 後端。

本連接器唯一儲存的是認證狀態，存放於 Redis 快取：

我們不會販售你的資料、不用於廣告，也不用於訓練任何 AI 模型。

5. 一次請求的流程

1. 你透過 OAuth 2.1（Authorization Code + PKCE）登入一次。本連接器向貴所 Codey 後端驗證帳密，並發給你的 MCP 用戶端一組 session token。
2. 每次請求時，MCP 用戶端以 HTTPS 帶上該 token。
3. 本連接器辨識你所屬事務所（透過內部身份註冊表，將你的 email 對應到事務所及其後端位址），並僅將請求轉發至貴所後端。
4. 結果回傳給 MCP 用戶端，本連接器不予保留。

租戶隔離：你的 session token 綁定你的事務所，本連接器無法將請求路由至其他事務所，也無法回傳其他事務所的資料。

6. 第三方

• Anthropic：你的 MCP 用戶端（如 Claude）。你的指令與本連接器回傳的資料，依 Anthropic 自身條款與隱私政策處理。
• 貴所 Codey 後端：負責存放與處理貴所資料。
• Google 行事曆：若貴所啟用該整合，行程可能透過貴所 Codey 後端同步；此同步由 Codey 後端執行，非由本連接器執行。

除法律要求外，我們不會將本連接器資料分享給其他第三方。

7. 安全

• 全程以 HTTPS/TLS 加密傳輸。
• 認證採用 OAuth 2.1 + PKCE（S256），不支援 Implicit Flow。
• session 與 refresh token 為短效，會自動過期。
• 高風險動作（如傳訊息給客戶、刪除行事曆活動）執行前，需在 MCP 用戶端明確確認。
• 以 per-token 流量限制防止自動化無限迴圈。

8. 你的權利／資料刪除

由於本連接器不儲存貴所內容，存取、更正或刪除該等內容的請求，請透過貴所 Codey 帳號處理。若要撤銷本連接器的存取權，請在 MCP 用戶端中斷連線，或聯絡 [email protected]；快取的 session token 會在中斷後 7 天內自動過期。

9. 政策變更

我們可能更新本政策。重大變更將以更新上方「最後更新」日期方式呈現，必要時並於 Codey 產品內通知。

10. 聯絡

依智科技股份有限公司 — [email protected]