> For the complete documentation index, see [llms.txt](https://trust.impact.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://trust.impact.com/privacy-and-your-data.md).

# Privacy & Your Data

This Trust Center covers in-platform AI (features inside impact.com) and external AI integrations via Impact MCP (connecting your own AI client to your account), and where those paths differ.

{% hint style="success" %}

### Our data commitments

* **Used only to serve your request.** When you use an AI feature, your data is used only to generate a response for you or return tool results, never repurposed for unrelated ends.
* **Your data is never mixed.** Both in-platform AI and MCP respect the same strict, user-based authorization that governs the entire platform. You can only query the data you're already entitled to see, and your data is never commingled with, or accessible to, other customers.
* **You're in control.** In-platform AI features are opt-out. MCP stays off until your account enables it, and each user explicitly approves every AI client. In both cases, you only access data your role already allows, and you can decline use of your data to train our models.
  {% endhint %}

## Provider handling

**In-platform AI:** Our AI provider processes your data only to deliver the feature, under [**strict security and privacy requirements**](/impact.com-data-security-and-privacy-trust-center/security-features.md), and is contractually prohibited from using it to train their models.

**Impact MCP:** impact.com does not forward MCP tool data to LLM providers. If your AI client or model provider retains or processes prompts and tool results, that is governed by your agreement with them.

## Data flow

### Platform AI features

Here's what happens when you use an AI feature:

{% stepper %}
{% step %}
**You make a request**

Your request travels over an encrypted connection (TLS 1.2+).
{% endstep %}

{% step %}
**We gather context**

We securely retrieve only the data needed to answer, from your account (for analytics) or our knowledge base.
{% endstep %}

{% step %}
**Secure AI processing**

The request and context are sent to our AI provider on secure cloud infrastructure and used only for this request. Your data stays within impact.com's cloud environment.
{% endstep %}

{% step %}
**You get a response**

A response is generated and returned to you.
{% endstep %}

{% step %}
**Nothing lingers with the provider**

The provider does not retain your request data for its own purposes and does not use it to train its models.
{% endstep %}
{% endstepper %}

### Impact MCP

Here's what happens when you connect an AI client to mcp.impact.com:

{% stepper %}
{% step %}
**You authorize your AI client**

You sign in with your existing impact.com credentials and approve the client over an encrypted connection (TLS 1.2+). The client receives a scoped token limited to MCP access.
{% endstep %}

{% step %}
**Your client calls a tool**

Your AI client (for example, Claude, Cursor, or VS Code) sends an authenticated tool request to the mcp.impact.com gateway. The trust boundary sits at this gateway: everything on your side is your environment, and everything on ours is impact.com production infrastructure.
{% endstep %}

{% step %}
**We validate and return results**

The gateway checks your authorization, enforces your existing impact.com permissions, and runs the requested capability against our backend services. Tool results are returned to your AI client, not to a model provider.
{% endstep %}

{% step %}
**Generative processing stays on your side**

Your AI client may send prompts and tool results to your chosen model provider. That processing is governed by your relationship with that client and model provider. impact.com does not forward MCP tool data to LLM providers on your behalf.
{% endstep %}

{% step %}
**We log for security**

We log MCP call metadata needed for security and operations, such as who called, which capability was used, when, and the outcome, and retain those logs for at least 90 days. We do not log full tool request or response payloads in production.
{% endstep %}
{% endstepper %}

***

For how we secure this data, see [Security](/security.md). For how we explain what the AI is doing, see [Transparency](/transparency.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://trust.impact.com/privacy-and-your-data.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.