Privacy Policy
ForInvest MCP Server — effective date: 2025-01-01 · last updated: 2025-05-09
This Privacy Policy explains how ForInvest Yazılım ve Teknoloji Hizmetleri A.Ş. ("ForInvest", "we", "us") collects, uses, shares, and retains information when you connect to the ForInvest MCP Server through ChatGPT or any other MCP-compatible AI client.
By using the ForInvest MCP integration you agree to the practices described here. If you do not agree, please disconnect the integration from your AI client settings.
1. Data We Collect
1.1 Authentication Data
To access the MCP server you authenticate with your Foreks account credentials (username and password) through an OAuth 2.0 + PKCE flow. We receive and process:
- Your Foreks username (typically an e-mail address)
- A short-lived OAuth authorization code (single-use, expires in 10 minutes)
- A Foreks bearer access token (expires in 1 hour)
Passwords are transmitted directly to the Foreks Pass authentication service and are never stored by the MCP server.
1.2 Tool Input Data
When you or your AI assistant invokes an MCP tool, the server receives the parameters you supply. All 60 tools are read-only; they accept only the minimum inputs needed to query financial data:
| Input type | Examples | Why collected |
|---|---|---|
| Symbol codes | GARAN, THYAO, AAPL | Identify the financial instrument to query |
| Date / time ranges | startDate, endDate, resolution | Scope the historical data window |
| Numeric parameters | last N candles, page size | Limit result set size |
| Filter criteria | P/E range, sector, index name | Screen or filter instruments |
| Search keywords | Company name or ticker fragment | Full-text symbol search |
| Broker codes | FNY, ATA | Look up brokerage firm records |
We do not collect names, addresses, national IDs, payment card data, health information, precise location, or any other personal identifiers through tool inputs.
1.3 Session Metadata
Each MCP session generates a random UUID session identifier stored in server memory for up to 30 minutes. This identifier is used solely to route subsequent requests within the same session and is discarded when the session expires or is closed.
1.4 Server Logs
Our server logs record:
- Timestamp of each request
- Tool name invoked
- HTTP status code returned
- Response time in milliseconds
Logs do not contain tool input parameters, bearer tokens, or any user-identifiable content beyond what is described above.
2. Purposes of Processing
| Purpose | Legal basis |
|---|---|
| Authenticate your identity and authorize access to financial data | Contract performance |
| Execute tool requests and return financial market data | Contract performance |
| Maintain session state for the duration of a conversation | Contract performance |
| Monitor service health, diagnose errors, and improve reliability | Legitimate interest |
| Comply with applicable laws and regulatory obligations | Legal obligation |
We do not use your data for advertising, profiling, or sale to third parties.
3. Data Recipients
Your data is shared only as strictly necessary to deliver the service:
| Recipient | What is shared | Why |
|---|---|---|
| OpenAI / ChatGPT | Financial data returned by tool calls (market prices, financial statements, news, etc.) | Tool responses are returned to the ChatGPT session that invoked the tool, so the AI can present results to you |
| Foreks Pass (authentication service) | Username, password (during login only) | Validate credentials and issue access token |
| Foreks Cloud APIs | Bearer token, symbol codes, date ranges | Retrieve market data, financials, news |
| Foreks PubSub WebSocket | Bearer token, symbol codes | Real-time snapshots and definitions |
| AWS Bedrock (eu-central-1) | Query text for NLU agent tools only | Natural language understanding for agent-based tools |
All recipients are bound by data processing agreements. No data is sold or shared with advertising networks, data brokers, or unrelated third parties.
Note on ChatGPT: When you use this integration through ChatGPT, the tool inputs (e.g., symbol codes, date ranges) are sent from OpenAI's servers to our MCP endpoint, and the financial data we return is sent back to OpenAI. OpenAI processes this data according to their own Privacy Policy and Terms of Use.
4. Data Retention
| Data type | Retention period |
|---|---|
| OAuth authorization codes | 10 minutes (single-use, deleted on exchange) |
| Bearer access tokens (in-memory) | 1 hour or until session ends |
| MCP session identifiers | 30 minutes of inactivity, then auto-deleted |
| Server logs | 30 days, then automatically purged |
| Tool input parameters | Not persisted — processed in memory only |
5. Your Rights and Controls
Depending on your jurisdiction you may have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — request deletion of your data where no legal obligation requires retention
- Restriction — ask us to limit processing in certain circumstances
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — disconnect the MCP integration at any time from your AI client settings; this immediately terminates all active sessions
Turkish residents also have rights under KVKK (Law No. 6698) — see our KVKK Aydınlatma Metni for details.
To exercise any right, contact us at privacy@forinvest.com. We will respond within 30 days.
6. Security
We implement the following technical and organizational measures:
- All data in transit is encrypted with TLS 1.2 or higher
- OAuth 2.0 with PKCE (S256) — authorization codes cannot be intercepted and replayed
- Bearer tokens are never logged or persisted to disk
- Session identifiers are random UUIDs with no predictable pattern
- The server runs as a non-root user inside a Docker container
- HTTP security headers enforced via Helmet.js
If you discover a security vulnerability, please report it to security@forinvest.com.
7. Contact
- Data Controller: ForInvest Yazılım ve Teknoloji Hizmetleri A.Ş.
- Privacy inquiries: privacy@forinvest.com
- General contact: info@forinvest.com
- Website: www.forinvest.com
- Support: www.forinvest.com/destek
We may update this policy from time to time. Material changes will be announced on this page with an updated effective date.