QIE Wallet MCP Server: Privacy Policy

Last updated: 3 November 2026

1. Who we are and what this policy covers

This policy covers the QIE Wallet MCP server at https://mcp.qie.digital/mcp (the "MCP server"). It is a read-only service that lets AI assistants, such as ChatGPT and Claude, read public QIE blockchain data. ChatGPT and Claude are products of other companies. We name them only to describe where the MCP server can be used. Naming them does not imply that their providers endorse or operate this service.

The MCP server is provided by QIE Wallet (Pty) Ltd, 473 Lynnwood, Sussex Office Park, Pretoria 0081, South Africa ("QIE Wallet", "we", "us"). QIE Wallet (Pty) Ltd is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). Registration number: 2024/310890/07.

Email: info@qie.digital.

This policy is specific to the MCP server. It does not replace the privacy policies for the QIE Wallet app or for qie.digital and qiewallet.me.

2. What the MCP server does and does not do

It answers six read-only requests: native QIE and token balances for an address, the address for a QIE ID, the QIE ID for an address, the status of a transaction, a list of tokens, and network facts for QIE mainnet (chain ID 1990) and testnet (chain ID 1983).
It never receives, asks for or stores private keys, seed phrases or passwords. It has no tool that accepts them.
It does not sign anything and does not send or prepare transactions. The only blockchain calls it can make are a fixed list of read-only queries.
It has no accounts and no sign-in. The code does not set cookies and contains no analytics or advertising tools.
Please never type a private key, seed phrase or password into your AI assistant. The MCP server does not ask for them and cannot use them.

3. What we receive

When your AI assistant uses the MCP server, we receive the following.

Tool inputs: a public wallet address, a transaction hash, a QIE ID name such as yourname.qie, the network (mainnet or testnet), and for the token list an optional search word and a limit. The server rejects any other input fields. Public wallet addresses and names can identify a person when they are linked to that person.
Standard request metadata: the IP address of the connecting client, the time of the request, the request method and path, and the user agent. Depending on how your AI assistant connects, the IP address we see may belong to the assistant provider rather than to you.
Error information: when a request fails, an error code and a short status.

We do not store the contents of your AI conversations. We only receive the tool call that your assistant sends to us, never the rest of the conversation.

4. What our own logs record

For each tool call the MCP server writes one log line with: the time, the tool name, the network, how long the request took, the result status, an error code if there was one, and a short hash of the client IP address instead of the IP address itself. The log line does not contain wallet addresses, transaction hashes or QIE ID names. We treat the hashed IP address as personal information.

The MCP server keeps a short count of recent requests per hashed IP address in the memory of the running server, to apply a rate limit. This count is not written to a database and is lost when the server instance stops. The MCP server has no database or file storage of its own.

We do not use analytics or log drains that record request contents.

5. Logs kept by our hosting provider

The MCP server runs on Vercel, our hosting provider, in its Washington, D.C., USA region. The following describes the hosting provider's logs, not ours. Vercel's documentation says its runtime logs show, for each request: the method and path, the time (UTC), the HTTP status, the host name, a request ID, the user agent, the region, and anything our code writes to its log (the line described in section 4). The documentation does not list the body of a request. Vercel may also process some service data as a controller under its own privacy notice.

6. Data sent onward to QIE network services

To answer a request, the MCP server queries QIE network infrastructure operated for us and, when enabled, the QIE ID API service run by the QIE ID provider. It does not use any other service. It sends only what is needed for the query and does not pass on your IP address or request headers.

QIE RPC nodes. Mainnet: rpc1mainnet.qie.digital to rpc5mainnet.qie.digital, tried in order. Testnet: rpc2testnet.qie.digital. These receive read-only blockchain queries that can contain the address or transaction hash you asked about.
QIE block explorers: mainnet.qie.digital and testnet.qie.digital. These receive requests for token lists, token balances for an address, transaction details and contract details.
A QIE ID name you enter, such as yourname.qie, is sent to the mainnet RPC nodes in a read-only query to the QIE ID contracts. It is not sent to the explorer.
An address you enter for a reverse lookup (address to QIE ID) is also sent to the mainnet RPC nodes as a read-only query to the QIE ID contracts.
When the QIE ID API is enabled, QIE ID names and addresses you enter for a QIE ID lookup are also sent to the QIE ID API service run by the QIE ID provider (sdk-live.qie.digital), as read-only requests. A name is sent to get its other-chain records; an address is sent to get the QIE ID names it holds. The server checks every answer on chain before showing it.

QIE network nodes and explorers are operated by the QIE network, and the QIE ID API service by the QIE ID provider; their retention is outside this service's control.

We do not sell personal information. We do not use it for advertising.

7. Why we use this information, and our lawful basis

We use the information to: answer the request your assistant made; keep the service running and fix errors; limit abuse and apply rate limits; and meet legal obligations. Our lawful bases under POPIA are performance of the agreement between you and us (the Terms of Use) and our legitimate interest in running and protecting the service. We do not intentionally process special personal information, and the service is not directed at children.

8. Operators and transfers outside South Africa

Our hosting provider, Vercel, acts as an operator for us. Its servers are outside South Africa, mainly in the United States. We rely on the provider's published terms and security commitments.

9. How long logs are kept

We do not keep request data in a database. Log lines are held by our hosting provider for a limited time that depends on the hosting plan.

If you write to us, we keep your message and contact details for as long as needed to deal with it.

Request logs are kept as set by our hosting provider (Vercel). Support emails are kept for up to 24 months.

10. How we protect information

In general terms: connections to the MCP server use HTTPS; the MCP server can only send a fixed list of read-only blockchain queries and cannot be told which RPC or chain to use; request size and request rate are limited; and the server holds no wallet keys, seed phrases or passwords. Its only credential is an optional key for the QIE ID API, kept as a server setting and never sent to you. No system can offer complete protection, and we cannot control public networks or third-party services.

11. Your rights

Under POPIA you may ask us to: give you access to the personal information we hold about you; correct it; delete it; and stop processing it (object). Write to our Information Officer at info@qie.digital. We may ask you to confirm who you are. Because we hold only hashed IP addresses and time stamps, tell us roughly when you used the service so that we can look for it.

Public blockchain data is permanent. Wallet addresses, transactions and similar records on QIE and other blockchains are public and cannot be erased by us or by anyone else.

If you are not satisfied with how we handle your request, you may complain to the Information Regulator (South Africa): https://inforegulator.org.za, enquiries@inforegulator.org.za.

If you are in the European Union or the United Kingdom, you also have the rights set out in the GDPR or UK GDPR: access, correction, deletion, restriction, portability and objection, and the right to complain to your local data protection authority. We do not make automated decisions that have a legal effect on you or similarly affect you.

12. Changes to this policy

We may update this policy by changing this page and its date. Please check it from time to time.

13. Contact

QIE Wallet (Pty) Ltd, 473 Lynnwood, Sussex Office Park, Pretoria 0081, South Africa. Information Officer: Johann Kritzinger. Email: info@qie.digital.

QIE Wallet (Pty) Ltd · 473 Lynnwood, Sussex Office Park, Pretoria 0081, South Africa · Registration number: 2024/310890/07