Privacy Policy

Last updated: 2026-07-30

1. Introduction

This Privacy Policy explains how Mount Si Labs LLC ("Mount Si Labs," "we," "us," or "our") collects, uses, and protects information when you use CardSavvy (the "Service"). We respect your privacy and are committed to protecting your personal data, and this policy describes your privacy rights and how the law protects you.

2. Data We Collect

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together follows:

  • Identity Data includes username or similar identifier.
  • Contact Data includes email address.
  • Financial Data includes details about your credit cards and spending habits (which you input for optimization purposes). We do NOT store your actual credit card numbers or bank login credentials. If you use the CSV spending import, the file is parsed in your browser: raw transaction rows are never transmitted to or stored on our servers, and only the annual category totals you approve are saved (and only if you are logged in).
  • Usage Data includes information about how you use our website and services.
  • Technical Data includes a salted, one-way hash of your IP address, used to apply rate limits and detect abuse. We store the hash, not the address, and the salt is not published.

3. How We Use Your Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

  • To provide the credit card optimization services you have requested.
  • To manage our relationship with you.
  • To improve our website, products/services, marketing or customer relationships.

4. The CardSavvy API and MCP Server

CardSavvy offers an API, including a Model Context Protocol (MCP) server, that lets an AI assistant call our reward calculations directly. If you connect one, requests reach us from the client you chose (for example Claude Desktop or ChatGPT) rather than from this website.

What travels in a request. Depending on the tool being called, a request may include the names of cards you hold, your spending by category, and a purchase amount. It does not include card numbers, account credentials, or transaction-level records.

What we record. We record the name of the tool that ran, a one-way hash of its inputs, whether the response came from cache, and how long it took. We do not log the arguments themselves. The hash lets us measure repeat traffic and cache effectiveness without retaining a wallet or a spending profile. For requests without an API token, we also record the salted IP hash described above so rate limits can be applied.

API tokens. If you create a token, we store a hash of it along with the label you gave it, when it was created, when it was last used, and that you accepted the API terms. The token itself is shown once and is not recoverable. You can revoke a token at any time from your profile, and revocation takes effect immediately.

Your AI provider. Your assistant sends your conversation to whichever model provider you use. That exchange is between you and them, under their privacy policy. CardSavvy never receives, stores, or proxies your AI provider credentials.

5. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.

6. Business Transfers

If Mount Si Labs is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of its assets, your personal data (including identity, contact, and usage data) may be transferred to the successor or acquirer as part of that transaction. We will notify you by email and/or a prominent notice on the Service of any such change and of any choices you may have regarding your personal data.

7. Contact Us

If you have any questions about this privacy policy or our privacy practices, please contact us at: support@card-savvy.com.