Last updated: October 29, 2026

Privacy

This policy covers Andes Protocol (www.andesprotocol.com and the MCP server at mcp.andesprotocol.com) and AndesPass (pass.andesprotocol.com), the service that identifies AI agents and the people who authorize them. Both are directed by Patricio, in Santiago, Chile. Questions and requests: contact@andesprotocol.com.

What we collect

When you sign in to authorize an agent (AndesPass)

You sign in with Google or Microsoft. We never see your password. From your provider we receive and keep: an account identifier, your name, your email address and whether the provider has verified it. We also keep what you authorized: which application, for which service, with which permissions, and when it was created, used or revoked.

When an agent registers for a key (AndesPass)

The agent's name, description and homepage, and, if given, the operator's name and contact email. We store only a hash of the key, never the key itself. The contact email is never shown to anyone.

When an agent uses the tools (Andes Protocol)

For each request we log which credential called (a key fingerprint, an agent identifier or an authorization identifier), its access level, which tools were called, the result status and the response time. We do not log the questions or company details sent to the tools, and we do not log IP addresses. To limit abuse, a shortened hash of the IP address is held in memory to count requests within a window of up to one day; it is never written to disk.

What we do not collect

No cookies for tracking or advertising. The sign-in flow uses one short-lived cookie to make sure each step happens in the same browser; it expires within ten minutes.

Why we use it

• To know that a real person stands behind an agent, and which person, if it misbehaves.
• To give each agent only the permissions its person approved, and to let that person revoke them.
• To keep a record of who accessed what (security and auditability).
• To measure usage of the tools and to limit abuse.

We do not sell personal data, we do not use it for advertising and we do not use it to train AI models. The access tokens that agents carry contain no name or email.

Information from Google

AndesPass requests only the basic sign-in permissions (openid, email, profile) and uses them only to identify the person who authorizes an agent. AndesPass's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where it is stored

In cloud infrastructure providers in the United States (database) and Brazil (servers), and an email provider for messages sent to our address. They process data only to run the service. Access is restricted to the operator of Andes Protocol.

How long we keep it

• Sign-in steps and authorization codes: expire within ten minutes and are deleted periodically.
• Access tokens: valid for 15 minutes; renewal tokens for 30 days, unless revoked earlier.
• Your account and authorizations: while you use the service, or until you ask us to delete them.
• Agent keys: valid for one year; deleted on request.
• Usage logs: for a limited time, for security and usage metrics.

Your choices and rights

• Revoke an agent's access at any time from your Google account (myaccount.google.com/connections) or your Microsoft account, or by writing to us.
• Ask for a copy of your data, its correction or its deletion by writing to contact@andesprotocol.com. We answer within 30 days, as applicable law requires, including Chile's personal data protection law.

Changes

If this policy changes, we update this page and its date. Material changes will be announced on the site before they apply.