Scan.now MCP Privacy Policy

Effective and last updated: 4 October 2026

This is the complete privacy policy for the Scan.now tools provided through the Model Context Protocol (MCP). Scan.now is operated by Targa Limited, which is the controller of the information described below. The separate Scan.now website privacy policy covers use of the public website.

Categories of data processed

• Tool input: the public HTTP or HTTPS website or link submitted to a Scan.now tool and the requested scan scope.
• Public target data: response headers, certificates, public DNS and RDAP records, page content, redirects, scripts, and other publicly observable signals needed for the selected passive check.
• Tool output: derived grades, risk scores, findings, destination information, and diagnostic errors returned to the connected MCP client.
• Connection and security data: request time, source IP address, client type, request path, response status, and temporary rate-limit state.

These data come from the user through the connected MCP client, from the submitted public target, and from the public lookup services identified below. Scan.now does not receive unrelated conversation history, private files, account passwords, API keys, payment information, or other ChatGPT account data. Private, loopback, link-local, and reserved network targets are rejected.

Purposes of processing

Tool input, public target data, and tool output are processed only to perform the check requested by the user and return its result. Connection and security data are processed to deliver the service, enforce rate limits, prevent abuse, diagnose failures, and maintain reliability and security. Targa Limited does not sell personal data, use MCP requests for advertising or behavioral profiling, or use MCP inputs or outputs to train machine-learning models.

Recipients and disclosures

• The connected client: OpenAI or another MCP client receives the tool result so it can answer the user's request.
• The submitted target: its operator and network providers receive the ordinary passive HTTP, HTTPS, TLS, and DNS requests necessary for the selected check.
• Infrastructure providers: hosting, network, security, and DNS providers process the minimum traffic needed to operate Scan.now.
• Public lookup providers: certificate and RDAP services may receive the queried hostname. Google Safe Browsing may receive a submitted phishing URL only when that service is configured.
• Authorities: information may be disclosed where Targa Limited is legally required to do so.

Targa Limited does not disclose MCP data to data brokers or advertisers.

Retention timelines

• Submitted targets, public target data, and findings: processed in memory for the duration of the tool call and discarded after the response is returned. MCP calls do not create the 30-day saved reports offered by the Scan.now website.
• Rate-limit state: expires automatically within one hour.
• Connection and security logs: source IP addresses are truncated after 24 hours. Non-identifying aggregate service statistics may be retained after the source IP has been removed.

User choices, controls, and legal rights

Users control which public target they submit and can stop using or disconnect the plugin at any time. A user may also ask OpenAI to remove the plugin connection. To request access, correction, deletion, restriction, or objection where applicable, contact Targa Limited at [email protected] or through the Scan.now contact page. Because MCP inputs and findings are not saved as reports, Targa Limited may have no retained tool-call record to identify or delete after a response is returned.

Security and acceptable use

Transport is encrypted with HTTPS. Scanner inputs are protected against server-side request forgery. Website scans require confirmation that the user owns the target or has explicit permission to assess it. The tools are passive and do not exploit findings, submit forms, guess credentials, or bypass access controls.

Children and changes

The MCP tools are not directed to children and are not designed to collect information about children. Material changes to this policy will be dated at the top of this page.

Operator and contact

Targa Limited
Email: [email protected]
Support: https://scan.now/contact
Terms: https://scan.now/terms