[ Legal ]

Privacy Policy

Effective October 24, 2026.

Markbase is a software product operated by AltaCoda LLC (“AltaCoda,” “we,” “us,” or “our”). This Privacy Policy describes how AltaCoda collects, uses, discloses, and protects information in connection with the Markbase platform and related services (collectively, the “Service”). Markbase provides shared project memory, team skill distribution, and Dispatch jobs from webhook alerts, schedules, emails, mentions in connected tools and document due dates. Agents execute on Customer-controlled machines; the hosted service processes the payloads, prompts, and records needed to coordinate that work.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

1. Who We Are

AltaCoda LLC is the data controller for personal data collected through the Service in the course of operating the platform (such as your account information). Where you use the Service to store documents and we process personal data on your behalf, we act as a data processor. That relationship is governed by our Data Processing Addendum (DPA).

Contact: AltaCoda LLC 1111 Broadway Oakland, CA 94607 Email: hello@altacoda.io

2. What the Service Does — and What That Means for Your Data

Understanding how Markbase works is essential to understanding what data we handle.

Shared memory. Documents you submit to the Service — Markdown files, frontmatter, typed-collection records — are stored on infrastructure we operate, indexed for full-text search, and made accessible over MCP and over the dashboard.

Markbase is content-agnostic. We do not require you to submit personal data to the Service. If you choose to store personal data in your documents (for example, in notes about people, in CRM-style records, or in templates that include names or email addresses), we treat that content as confidential and process it only as described in this Privacy Policy and the DPA.

Skills and Dispatch. We build and deliver skill bundles to authorized machines and runners. We receive webhook payloads, prepare prompts, buffer jobs, and record runner acknowledgments, output tails and the reports agents file when they finish a job. Agent execution happens on machines you authorize, using your configured tools and permissions. On-prem delivery can run entirely within your install; data remaining there is not sent to AltaCoda merely because these features are enabled.

Emails. An organization can create a permanent email address that starts a Dispatch job. SendOps, AltaCoda’s email service, receives the mail. Markbase stores the message and a copy of its attachments so the job’s agent can read them, and deletes them after the period in Section 6.

Mentions. An organization can connect Linear, GitHub or Slack so that people can mention Markbase there. We receive the message and the thread it belongs to, and we store what people write, the agent’s replies and the conversation’s subject. Replies and changes appear in the connected tool as the Markbase app.

Live activity. A profile can turn on live activity, which is off by default. The runner then sends the agent’s messages, the names of the tools it uses, the first line of each tool’s input and shortened results to us through Cloudflare, so that they appear on the job’s page. Known secret formats are removed on the runner before anything is sent. What is sent depends on the agent; some agents send only when a job started and finished.

Self-hosted error reports. By default, a self-hosted install sends error reports to AltaCoda through its licence server, so that we can find and fix failures. The install first removes user identity, request bodies, query strings, cookies, most headers and email addresses. Reports never include document content. They identify the customer and the install, and the install’s operator can turn them off.

Temporary inboxes. When you ask an agent for an inbox, we create a short-lived email address through SendOps, AltaCoda’s email service. By default it accepts mail only from your login email. Messages forwarded to it are held by SendOps until the inbox expires, so your agent can read them; Markbase itself does not store message content.

Temporary webhooks. When you ask an agent for a webhook URL, we create a short-lived URL on Markbase’s own infrastructure that other services can send HTTP requests to. Anyone with the URL can send to it unless the agent also asks for a secret. We store each request it receives, so the agent that made it can read it, until shortly after the URL expires. These requests are separate from Dispatch: they do not pass through Cloudflare and do not start an agent.

Agents act under credentials you authorize. When you connect an MCP Client to a workspace, the client receives an OAuth access token bound to the scopes you approve. Anything that client reads or writes flows through our systems on your behalf.

3. Information We Collect

3.1 Information You Provide

  • Account information: Name, email address, and the identifiers returned by our identity provider when you sign in.
  • Organization information: Organization name and details you provide during setup.
  • Workspace content: Markdown documents, frontmatter, typed-collection records, and _markbase.md files that you or your authorized agents submit to the Service. We treat workspace content as confidential; we access it only to operate the Service or with your instruction.
  • OAuth client metadata: Names, redirect URIs, and other client metadata you or your agents register through our Dynamic Client Registration endpoint.
  • Billing information (paid plans only): Billing contact details, and payment method details collected and processed by our payment processor, Stripe. We do not receive or store full payment card numbers — only the card brand, last four digits, and expiry, together with subscription and invoice records.
  • Dispatch content: Webhook payloads and selected headers, document reminder prompts, rendered job prompts, job history, status, timestamps, exit codes, durations, the output tail reported by a runner, and the report an agent files when it finishes a job (its outcome, summary, reason, what it needs and any links). These may contain personal data supplied by you or your configured senders.
  • Email sent to Emails addresses: The message, its headers and attachments, its sender and recipient addresses, and the results of its authentication checks. We also keep any additional email addresses a member verifies so that they can send to these addresses.
  • Mentions: What people write when they mention Markbase in a connected tool or the dashboard, the names or handles the tool gives for them, the agent’s replies, and the conversation’s subject.
  • Live activity (where turned on): The agent’s messages, tool names, the first line of each tool’s input, shortened tool results, and status events.
  • Runner metadata: Runner identifiers, version, heartbeat times, configured job destinations, available agent tools, configuration version, and readiness information.
  • Skill distribution: Skill source files and bundles, published versions, required-set and update-mode settings, and each person’s and machine’s sync state and reported conflicts.
  • Forwarded email (temporary inboxes): Messages that you, or senders you allow, forward to a temporary inbox, including their headers, attachments, and sender and recipient addresses. We keep a record of each inbox you create, such as its allowed senders, expiry, and message counts, but not the messages themselves.
  • Webhook requests (temporary webhooks): HTTP requests that a service or person sends to a temporary webhook URL, including the method, path, query string, headers (other than cookies, authorization headers and the URL’s secret), body, and the sender’s IP address. We keep a record of each URL you create, such as its label, expiry, and request counts and sizes, and the method, path, size and time of each request.
  • Device sign-in: Device-code and browser sign-in sessions, authorization state, expiration, and related security metadata used to sign in the mb client.
  • Support communications: Information you provide when contacting us for support, including email address, message content, and any attachments.

3.2 Information Collected Through Use of the Service

  • Authentication data: Session identifiers, OAuth access tokens (stored hashed at rest), refresh tokens (hashed at rest), and authorization codes (hashed at rest, single-use).
  • Connection metadata: The list of MCP Clients authorized against your workspaces, scopes granted, and last-seen timestamps, surfaced on the Connections page in the dashboard.
  • Usage data: Information about how you interact with the dashboard and the MCP API, including endpoints called, response statuses, request rates, and timestamps.
  • Device and connection information: IP address, browser type and version, operating system, device identifiers, and referring URLs.
  • Analytics data: We use Google Analytics 4, loaded through Google Tag Manager, on the marketing site (markbase.cloud) and the documentation site (help.markbase.cloud) to understand visitor behavior, and Mixpanel within the dashboard and Service to understand how the product is used. Analytics data is collected as described in each provider’s privacy documentation.

3.3 Information from Third-Party Sources

  • Identity providers: When you sign in with Google, Google returns the identity claims associated with your account (such as your name, email address, and a unique Google account identifier). When you sign in with GitHub, GitHub returns the equivalent claims (such as your name, username, verified primary email address, profile image URL, and a unique GitHub account identifier).
  • Payment processor (paid plans only): Stripe returns transaction status, payment confirmation, invoice records, and limited billing details.
  • Connected tools: When your organization connects Linear, GitHub or Slack for Mentions, the tool sends us the messages that mention Markbase and related thread and issue details.

4. How We Use Your Information

We use the information we collect for the following purposes:

  • Providing the Service: Operating, maintaining, and delivering the features and functionality of Markbase, including storing and serving documents, maintaining the search index, brokering OAuth flows, and delivering API responses to your agents.
  • Account management: Creating and managing your Account, authenticating your identity, managing Authorized User access, and managing the MCP Clients you have authorized.
  • Billing (paid plans only): Processing payments, managing subscriptions and seat counts, issuing invoices, calculating applicable sales tax, and communicating about billing matters, including notifying you when a payment fails.
  • Communications: Sending you service-related notices (such as account verification, security alerts, maintenance notifications, and changes to our terms or policies). These are transactional communications, not marketing.
  • Product improvement: Analyzing aggregated, de-identified usage patterns and trends to improve, develop, and optimize the Service. We do not use the contents of your documents to train machine learning models.
  • Security and fraud prevention: Detecting, investigating, and preventing unauthorized access, abuse, and other harmful activity, including monitoring for stolen-token reuse and rate-limit violations.
  • Legal compliance: Complying with applicable laws, regulations, legal processes, or enforceable governmental requests.
  • Support: Responding to your inquiries, troubleshooting issues, and providing customer support.

5. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

5.1 Service Providers (Subprocessors)

We share information with third-party service providers (subprocessors) who process data on our behalf to provide the Service. A complete list of our current subprocessors, including their purposes and locations, is maintained at markbase.cloud/subprocessors.

These providers are contractually obligated to use your information only as necessary to provide their services to us and in accordance with this Privacy Policy and applicable data protection laws.

5.2 Agents and MCP Clients You Authorize

When you authorize an MCP Client, that client can read and write Content in the scopes you granted. The Service transmits Content to that client over its TLS connection. We are not responsible for what the client does with the Content after it receives it; that is governed by your agreement with the client’s provider.

5.3 Within Your Organization

Account administrators and Authorized Users within your organization may have access to shared organizational workspaces, documents, typed collections, and connection lists as determined by your Account settings and any access controls you configure.

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of AltaCoda, our users, or the public.

5.5 Business Transfers

In connection with a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change in ownership or control of your personal information.

We may share your information in other circumstances with your explicit consent.

5.7 Tools You Connect

When your organization connects Linear, GitHub or Slack for Mentions, we send agent replies and requested changes to that tool, where they are visible to the people who can see the thread or issue. Your organization’s agreement with that tool’s provider governs what happens to them there.

6. Data Retention

  • Account data: Retained for as long as your Account is active. Upon account closure, your data is deleted in accordance with our data deletion procedures, subject to any legal retention obligations.
  • Workspace content (documents and typed-collection records): Retained for as long as your workspace exists. Deleted documents are moved to a per-workspace trash and permanently purged on a scheduled basis (currently daily). Older object-storage versions may persist for a limited additional period under bucket-level versioning retention.
  • OAuth tokens: Access tokens expire after one hour. Refresh tokens are rotated on every use and expire after thirty (30) days of inactivity. Revoked tokens are retained in hashed form long enough to detect token-reuse and chain-revocation scenarios.
  • Billing records (when applicable): Retained for as long as necessary to comply with tax, accounting, and legal obligations (typically up to 7 years).
  • Support communications: Retained for as long as necessary to resolve your inquiry and for a reasonable period thereafter for quality and training purposes.
  • Dispatch jobs: Payloads, prompts, job records, output tails, job reports and Mentions conversations stay in your organization’s job history so that you can review them, and they have no fixed expiry while your Account is active. Deleting a workspace document does not itself delete a separate Dispatch job record. Contact us for deletion requests.
  • Email sent to Emails addresses: The message body, headers, attachments and the copy in the job’s prompt are deleted seven days after the job ends, or seven days after the message arrives if it started no job. The sender, subject and each attachment’s name, size and type stay in the job history.
  • Live activity: Deleted 14 days after each event.
  • Hosted delivery copies: Our delivery service on Cloudflare deletes its working copy of a job 14 days after the job finishes, and keeps an alert payload too large to pass along directly for up to 30 days.
  • Skill operations: Bundles and machine sync state support distribution, drift detection and rollback. Operational copies and historical versions are subject to their configured cleanup policies. Contact us for the retention settings applicable to your deployment.
  • Temporary inboxes: Forwarded messages are held by SendOps only until the inbox expires, and raw copies are deleted within one day. Inbox records, which contain no message content, are kept to enforce access and plan limits.
  • Temporary webhooks: The content of each request (body, headers and query string) is deleted one hour after the URL expires, or at once when the URL is deleted. A URL can last at most six hours. Records of the URL and its requests, which contain no request content, are deleted seven days after it expires. We do not log the URL’s token, its secret, header values, query strings or bodies.
  • Device sign-in sessions: Device codes expire and cannot be reused after authorization; issued credentials follow their own token lifetime and revocation rules.
  • Server logs: Automatically deleted or anonymized after 90 days.

7. Data Security

We implement commercially reasonable technical and organizational measures to protect your information, including:

  • Encryption of data in transit (TLS 1.2 or higher) for all external communications.
  • Encryption of data at rest in our database and in object storage.
  • OAuth access tokens signed with rotating RS256 keys; refresh tokens and authorization codes hashed at rest.
  • Rate limits on the MCP endpoint, OAuth flows, and Dynamic Client Registration to detect and mitigate abuse.
  • Access controls and authentication requirements for all internal personnel; principle of least privilege for production access.
  • Centralized logging of access to production systems and monitoring for anomalous activity.
  • Regular security reviews of changes to authentication, authorization, and storage code paths.

No method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Your Rights and Choices

8.1 Account Information

You may access, update, or correct your account information at any time through the dashboard or by contacting us at hello@altacoda.io.

8.2 Workspace Content

You may read, modify, list, and delete documents at any time through the MCP API or the dashboard. Deletion is subject to the soft-delete and purge behavior described in Section 6.

8.3 Connection Management

You may revoke an MCP Client’s access to your workspaces at any time from the Connections page in the dashboard. Revocation invalidates the client’s refresh token immediately; previously-issued access tokens expire on their normal one-hour schedule.

8.4 Account Deletion

You may request deletion of your Account and associated data by contacting us at hello@altacoda.io. Deletion is permanent and subject to the retention periods described in Section 6.

8.5 Communications Preferences

You may manage your notification preferences through the dashboard where available. Note that you cannot opt out of transactional communications necessary for the operation of your Account (such as security alerts and billing notices).

8.6 Cookies and Tracking

The Service uses cookies and similar technologies for session management, authentication, and analytics. You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Service.

On our public websites (markbase.cloud and help.markbase.cloud) you can also manage them directly: the cookie notice shown on your first visit lets you accept or reject the non-essential categories, and the Cookie settings link in the footer of either site reopens those preferences at any time. Your choice is stored in a cookie scoped to markbase.cloud and applies across both sites, and it is passed to Google Tag Manager using Google Consent Mode v2, which governs whether the analytics tags may store or use cookies. We honour the Global Privacy Control browser signal for advertising purposes on first visit. Essential cookies — including the one that records this choice — cannot be turned off.

The dashboard (app.markbase.cloud) uses a separate analytics provider and carries its own consent control; a choice made on the websites does not change it, or the reverse.

9. Rights for EEA, UK, and Swiss Individuals

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under applicable data protection laws, including the General Data Protection Regulation (GDPR) and the UK GDPR.

We process your personal data on the following legal bases:

  • Contract performance: Processing necessary to provide the Service and fulfill our contractual obligations to you (Article 6(1)(b) GDPR).
  • Legitimate interests: Processing necessary for our legitimate interests, such as improving the Service, ensuring security, and preventing fraud, where those interests are not overridden by your rights (Article 6(1)(f) GDPR).
  • Legal obligation: Processing necessary to comply with applicable laws (Article 6(1)(c) GDPR).
  • Consent: Where you have given explicit consent for a specific purpose. You may withdraw consent at any time.

9.2 Your GDPR Rights

You have the right to:

  • Access your personal data and obtain a copy.
  • Rectify inaccurate or incomplete personal data.
  • Erase your personal data (subject to legal retention requirements).
  • Restrict processing of your personal data in certain circumstances.
  • Data portability — receive your personal data in a structured, commonly used, machine-readable format.
  • Object to processing based on legitimate interests.
  • Withdraw consent at any time where processing is based on consent.
  • Lodge a complaint with your local data protection authority.

To exercise these rights, contact us at hello@altacoda.io. We will respond within 30 days (or such shorter period as required by applicable law).

9.3 International Transfers

Your personal data may be transferred to and processed outside of the EEA, UK, or Switzerland — most notably to the United States (object storage) and within the EEA itself (application infrastructure in Germany, and receipt of email forwarded to temporary inboxes in Ireland). When we transfer personal data out of the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards as described in our DPA, which may include Standard Contractual Clauses approved by the European Commission.

10. Rights for California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

10.1 Categories of Personal Information

In the preceding 12 months, we may have collected the following categories of personal information: identifiers (name, email, IP address, user identifiers from our identity provider), commercial information (billing records and subscription history, where applicable), internet or electronic network activity (usage data, device information), and professional information (organization name, role).

10.2 Your CCPA/CPRA Rights

You have the right to:

  • Know what personal information we collect, use, and disclose.
  • Delete your personal information (subject to exceptions).
  • Correct inaccurate personal information.
  • Opt out of the sale or sharing of personal information. We do not sell or share your personal information as defined by the CCPA/CPRA.
  • Non-discrimination for exercising your rights.

To exercise these rights, contact us at hello@altacoda.io. We will verify your identity before processing your request.

10.3 Authorized Agents

You may designate an authorized agent to make requests on your behalf. We may require you to verify your identity directly and confirm the agent’s authority.

11. Children’s Privacy

The Service is not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at hello@altacoda.io.

The Service may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access, including any MCP Client you authorize to access your workspaces.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least thirty (30) days before the changes take effect. The “Effective Date” at the top of this page indicates when the policy was last revised. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

AltaCoda LLC 1111 Broadway Oakland, CA 94607 Email: hello@altacoda.io

For GDPR-related inquiries, you may also contact us at the address above. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Last updated: October 22, 2026

Also here: Terms of Service, Data Processing Addendum, Subprocessors. Questions about any of them go to hello@altacoda.io.