Enerdatics Leap Service Terms & Privacy Policy

In plain language

Enerdatics Leap is a remote Model Context Protocol (MCP) server. It lets the AI assistant you use (such as ChatGPT, Claude or Microsoft Copilot) look up Enerdatics' renewable-energy data (M&A deals, projects, financings, PPAs, pricing, company profiles, league tables and research) on your behalf. This page has two parts. Part A, the Service Terms, sets out what the connector provides, how it may be used and who is responsible for what. Part B, the Privacy Policy, explains what data the connector handles and your rights over it. Both cover the Leap connector only; other Enerdatics products and our website have their own notices.

Read this page alongside your Enerdatics subscription agreement and our Terms & Conditions.

Service

Enerdatics will provide Client with access to the MCP Service during the applicable subscription term. The MCP Service enables Client's authorised AI applications and compatible systems to query and retrieve data from the Enerdatics datasets included within Client's subscription.

The MCP Service operates as a controlled retrieval interface and does not provide unrestricted access to Enerdatics' underlying databases or systems.

Technical documentation for the MCP Service, including setup instructions and available tools, is available at www.enerdatics.com/leap-connector-documentation.

Fees

MCP access is included within Client's subscription fees unless otherwise stated in writing.

Enerdatics will not charge any separate MCP, API, per-query, per-call, token or other consumption-based fee. Client remains responsible for any charges imposed by its selected AI or large language model provider.

Hosting and security

The MCP Service is hosted primarily on Cloudflare infrastructure and uses industry-standard security controls for access and data transmission.

Access is limited to authorised users and systems through authentication and access controls maintained by Enerdatics. Communications with the MCP Service are transmitted over encrypted HTTPS/TLS connections.

Client must keep its credentials secure and not share them outside its authorised users. Client will promptly report any suspected compromise.

Client access will be limited to the datasets and functionality included within its Enerdatics subscription.

AI environment and data handling

Client selects and controls its own AI or large language model environment. Client's AI provider handles prompts and retrieved data under its own terms. Enerdatics is not responsible for how that provider uses this information.

Client is responsible for all actions its AI tools and agents take using its MCP access. For standard MCP access, Client's AI environment communicates with the MCP Service to retrieve licensed Enerdatics data.

Enerdatics is responsible for the data it provides, not for what Client's AI generates from it. Client should check AI outputs before relying on them.

Enerdatics does not have access to prompts submitted within Client's AI environment. Client-provided data made available through the MCP Service will not be used by Enerdatics to train, develop or improve its artificial intelligence or machine-learning models. Enerdatics may process limited technical information where reasonably necessary for authentication, security, troubleshooting, monitoring and operation of the MCP Service. Any such processing will be carried out as described in Part B below.

Permitted use

All data accessed through the MCP Service remains subject to the licensing, confidentiality, intellectual-property, use and redistribution provisions of the applicable Enerdatics agreement.

Client may use such data for authorised internal business purposes, including as contextual input for searches, analyses and internal AI workflows.

Use of the MCP Service is subject to reasonable fair-use and rate limits. Client may not bulk-extract Enerdatics data or use it to recreate any Enerdatics database.

Unless otherwise agreed in writing, Client may not use Enerdatics datasets to train, develop or materially improve a general-purpose AI or machine-learning model.

Security review, support and term

Enerdatics will reasonably cooperate with Client's technology, information-security, AI-governance or vendor-risk teams and may provide relevant information regarding architecture, hosting, authentication, data flows, encryption and access controls.

Enerdatics will provide reasonable support for implementation, testing and troubleshooting, supplemented by the documentation available at www.enerdatics.com/leap-connector-documentation.

MCP access will apply for the duration of the applicable subscription term and will terminate upon expiration or termination of that subscription unless otherwise agreed in writing.

Data we collect

We collect the minimum needed to sign you in, apply your subscription, operate and secure the service, and keep an audit trail.

Account and sign-in data

• Your name, work email address and a sign-in identifier, received from our identity provider when you sign in with OAuth.
• Your organisation, subscription tier and access settings (which datasets and features you can use).
• Where a service credential is issued to your organisation, we store only a one-way hash of it, never the credential itself.

Tool-call records

Each time your assistant calls a Leap tool, we record:

• which user and organisation made the call, and which tool was called;
• which filters were used and their structured values (for example dataset, country, sector, dates, capacity ranges). Free-text search terms, company and developer names are not stored;
• response size, duration, number of results and success or error status;
• the approximate country and the network data-centre location the request came from, derived from the connection. We do not store your IP address in tool-call records.

Connection set-up and tool-listing requests are not recorded.

Feedback

If you use the optional submit_feedback tool, we store the feedback text, the tool it relates to and any context you include, together with your user and organisation identifiers, and forward it to the Enerdatics team's internal messaging channel.

Business contact information in Enerdatics records

Leap's results come from Enerdatics' market-intelligence records, which can include business contact information about people at companies in the energy sector — for example an executive's name, job title and work email address, or the name of an adviser or signatory on a transaction. This information is collected by Enerdatics from public and professional sources to describe companies and transactions, not from you. Leap returns it only when it is part of the record you asked for. We do not include personal email addresses. To ask for your own business contact details to be corrected or removed, email privacy@enerdatics.com.

Operational data

• Rate-limit counters linked to your sign-in.
• Anonymous daily activity counts, using an identifier that changes every day and cannot be linked back to you.
• Standard application logs, with credentials, tokens, passwords and other secrets removed.

What we do not collect

• Your prompts, conversation history, AI memory or uploaded files. Your AI assistant processes your question; only its structured requests reach Leap.
• Payment-card data.
• Copies of files you export. Export links are generated on demand and expire; the file is not stored.

How we use data & lawful basis

We use data to authenticate you and apply your subscription (your organisation is always identified from your sign-in, never from what a tool call contains). We also use it to run and protect the service, investigate errors, support you, and improve Leap using feedback and aggregate usage.

We do not sell personal data, and we do not use your data to train AI models.

Storage & security

• Leap runs on established cloud infrastructure. Account, audit and feedback data are held in managed databases with access limited to authorised Enerdatics staff.
• Every data tool is read-only; no tool can change or delete Enerdatics data or yours.
• Each customer's access is isolated and scoped to its subscription, enforced on the server for every request. Transport encryption and access controls are described in A3.
• Secrets are held in a managed secret store and are never stored in source code.

Customers and prospective customers can request more security detail at privacy@enerdatics.com.

Sharing & sub-processors

We share personal data only with service providers that help us run Leap, under contracts that restrict their use of it. We do not share it with anyone else except where required by law.

A list of our named sub-processors is available to customers on request and is included in our data processing agreement (DPA). We will update it before adding a new sub-processor that handles your personal data.

Your AI assistant is not our sub-processor. You or your organisation choose and control the AI client you connect to Leap (for example, ChatGPT by OpenAI, Claude by Anthropic or Microsoft Copilot). Leap's results pass through that client, and the client provider's own terms and privacy policy govern how it handles your prompts and the results it receives.

International data transfers

Enerdatics is based in India, and our service providers process data in the United States and other countries. Where we transfer personal data from the EU or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), or on the EU-US Data Privacy Framework where the recipient is certified, supported by a transfer impact assessment. You can ask us for a copy of the relevant safeguards at privacy@enerdatics.com.

Data retention

We keep each type of data only as long as needed for its purpose, then delete or anonymise it.

Your rights & choices

Depending on where you are, you have rights under the EU/UK GDPR and/or India's Digital Personal Data Protection Act, 2023 (DPDP). To exercise any of them, email privacy@enerdatics.com.

Under the GDPR

• Access, rectification, erasure, restriction, portability and objection.
• Withdraw consent at any time where processing relies on consent (this does not affect earlier processing).
• Complain to your data-protection supervisory authority.

We aim to respond within one month, extendable for complex requests as the GDPR permits.

Under the DPDP Act

• Access a summary of your personal data and its processing.
• Correction and erasure.
• Grievance redressal, and nominating another person to exercise your rights.
• Withdraw consent, and complain to the Data Protection Board of India.

Grievances are addressed within 90 days.

Controls for your organisation

• Stop Leap immediately by removing the connector from your AI client.
• Your organisation's administrator can ask us to add or remove users, revoke credentials, provide a usage report, or delete your organisation's data.

Automated & AI processing

Leap does not run or call any AI model, and makes no automated decisions about you. Answers you see are written by the AI assistant you connected, using records Leap returns. AI output can be inaccurate or incomplete, so check figures against the source links Leap provides before relying on them.

Security incidents & age

If a personal-data breach occurs, we will notify the relevant authorities and affected customers and individuals where and as the law requires, including within the GDPR's timelines and to the Data Protection Board of India under the DPDP Act.

Leap is a business-to-business service for work-email users. It is not directed to anyone under 18, and we do not knowingly collect children's personal data.

Changes to these terms and this policy

We may update Part A or Part B as Leap evolves. We will change the "Last updated" date above and tell customers directly about material changes before they take effect.

Contact