Privacy
Last updated 29 September 2026
This page describes what prodready.si collects, why, and what you can do about it. It describes the site as it actually behaves — the intake form, the analytics, and the MCP connection — rather than as a generic template.
Who is responsible
Innovate d.o.o., a company registered in Slovenia, is the data controller. ProdReady is a service operated by Innovate. Write to [email protected] about anything on this page, including any request described under Your rights.
What we collect
The intake form
When you send us your product through the form on the home page, we receive exactly the fields you filled in:
- What the product is, what it does, what it was built with, and a link to it
- Its stage, how you scored its readiness, and roughly how many people use it
- Which days and what time of day suit you, and your timezone
- Your name, email address, company, and any notes you add
We use this to understand what you have and to reply with an assessment and a price. The lawful basis is Article 6(1)(b) — steps taken at your request before entering into a contract. The form is delivered to us by email and lives in our mailbox; we do not keep a separate database of enquiries. A hidden anti-spam field is discarded and never read.
Connecting the MCP server
If you connect mcp.prodready.si to Claude, an editor, or any other MCP client, we ask for your email address and send you a sign-in link. We keep that address and the access token issued to your client, so the connection keeps working and so we can send you the report and the offer your client asked for. The lawful basis is again Article 6(1)(b), and Article 6(1)(f) — our legitimate interest in knowing who is using the tool and in following up on an assessment we produced. Connecting is optional; the site works without it, and you can disconnect at any time.
What your client sends for assessment
To score a project, your MCP client sends us evidence it has gathered locally — file paths, configuration shapes, the results of read-only checks. We process that evidence in memory to produce the report and do not store it, log it, or use it for anything else. Nothing is written to disk on our side and nothing is retained after the response is returned. We never ask for, and the tool never collects, credentials, tokens, or secret values.
The one thing that can be kept is the report page: when your client asks for a link, the finished report — the score, the rule names, the counts and file paths it quotes — is stored at an unlisted address on mcp.prodready.si for seven days, then deleted. It never contains the evidence it was scored from, and your client can ask for the report inline instead of a link.
Analytics and advertising
The site uses Google Analytics 4 (property G-B39FXHC0BS) to count visits and to record when an enquiry is submitted, and the Reddit advertising pixel to tell us whether an advertisement led to an enquiry. Both set cookies or similar identifiers in your browser and both send data to their operators. Neither is switched on until you say yes on the banner that appears on your first visit — the lawful basis is your consent.
Saying no costs you nothing: the site behaves identically, the Reddit pixel is never loaded, and Google Analytics runs in its cookieless mode, which counts the visit without identifying you. To change your mind later, clear this site's data in your browser and the banner will ask again.
Server logs
Our host records the usual request data — IP address, time, path, user agent — for security and to keep the service running. The lawful basis is Article 6(1)(f).
Who else processes your data
| Who | What for | Where |
|---|---|---|
| Cloudflare | Hosting the site, serving the MCP endpoint, storing connection tokens | Global edge network |
| Resend | Delivering the intake email and the sign-in link | United States |
| Analytics | United States | |
| Advertising measurement | United States |
Each acts as a processor or, for the analytics and advertising services, under their own terms. Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses and the safeguards those providers publish.
About the code you send us. Work we perform on your project during an engagement is carried out on infrastructure in the European Union, and we sign an NDA and a data processing agreement under Article 28 before you send anything. That commitment is about your project — the analytics and advertising services listed above involve transfers to the United States, as stated in the table.
How long we keep it
- Intake enquiries — for as long as the enquiry is live, and afterwards as business correspondence, unless you ask us to delete it.
- MCP sign-in address and tokens — until you disconnect or ask us to delete them.
- Assessment evidence — not kept at all.
- Analytics — according to the retention set on the analytics property.
Your rights
Under the GDPR you may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent, you may withdraw it at any time without affecting what we did before. Ask by writing to [email protected] — one email is enough and we do not require a particular form of words.
If you think we have handled your data wrongly, you can complain to the Slovenian Information Commissioner (Informacijski pooblaščenec), or to the supervisory authority where you live.
Automated decisions
The readiness score the MCP tool produces is generated automatically from the evidence your client sends. It is an assessment to inform a conversation, not a decision that produces legal effects for you, and a person reviews anything that leads to an actual engagement.
Changes
If we change what we collect, we change this page and the date at the top. The site is public and versioned, so the history of this page is visible.