Privacy notice
Last updated 1 November 2026.
Who is responsible for your data
Roadmap Consulting Ltd, trading as Ponta, is the controller of the personal data described here. We are registered in England and Wales, company number 16726574, at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, and we have paid the data protection fee to the Information Commissioner's Office. For anything about your data, email support@ponta.ai with "Privacy" in the subject.
The short version
- We collect the least we need to run Ponta: your sign-in email, your PCs, a log of what Ponta did, and your plan.
- Requests and results pass through Ponta to reach your PCs. We do not keep their content, apart from a long-running result held for up to 24 hours.
- We do not sell your data, show adverts, or use your files, mail or requests to train AI.
- This website, ponta.ai, sets no cookies and runs no analytics.
What we collect, why, and our legal basis
| Data | Why | Legal basis |
|---|---|---|
| Your Google account's email address and account ID, from Google sign-in | To create and secure your account and to contact you about it | Contract |
| Each PC you pair: the name you give it, the computer and Windows user name the agent reports, the agent's version, when it was paired and when it was last online | To connect Claude to the right PC and show you your PCs | Contract |
| While a pairing code is open: the PC's details above, plus the IP address and approximate town and country it came from | To show you on the confirm page where the request came from, so you can refuse a code someone else sent | Legitimate interests (keeping your account safe) |
| The call log: for each action, the tool, the PC, the time, how long it took, whether it worked and the size of the answer, with short excerpts (up to 200 characters) of a few details such as a file path, web address or command. Other details are recorded only as a length. | To show you what was done, to find faults and to spot misuse | Contract and legitimate interests (security) |
| Requests and results in transit, and long-running results waiting to be collected | To deliver each request to your PC and its answer back to your AI app | Contract |
| Approval requests: what the AI app asked to do and your answer | To ask for your yes and act on it | Contract |
| Monthly counts of actions per tool group | To apply your plan's limits and show your use | Contract |
| Your plan, and from Paddle your customer and subscription IDs, status and renewal dates. We never receive your card details. | To give you the plan you paid for | Contract |
| Emails you send us | To answer you | Legitimate interests (helping customers) |
| Technical data such as IP addresses and request details, handled by our hosting provider | To deliver Ponta and protect it from attacks | Legitimate interests (security) |
We need the data marked "Contract" to provide Ponta. Without it we cannot run your account.
What we do not collect
We do not keep copies of your files, mail, web pages or screen. They are read on your PC and passed to the AI app you use, which handles them under its own maker's terms and privacy policy. We have no control over what the AI app does with them. For Claude, that is Anthropic.
Cookies
ponta.ai sets no cookies. When you sign in at mcp.ponta.ai, we use cookies whose names begin __Host-ponta. They are strictly necessary: they keep you signed in for up to an hour and protect sign-in and forms from forgery. They are not used for tracking. When you open Paddle's checkout or billing page, Paddle may set its own cookies, as its privacy notice explains.
Who receives your data
- Cloudflare, Inc. hosts Ponta and stores the data above, as our processor.
- Google confirms your identity when you sign in. Google learns that you signed in to Ponta.
- Paddle (Paddle.com Market Ltd and its group companies), our reseller and Merchant of Record, receives what it needs to sell you a plan and controls your payment data under its own privacy notice.
- Google Workspace carries the email you send to support@ponta.ai.
- Telegram, only if you choose to link it for approvals, receives the approval messages sent to you.
- Our professional advisers, such as our accountants, where needed, and the police, courts or regulators where the law requires it.
International transfers
Some of these providers process data outside the UK, including in the United States. Where a country does not have UK adequacy regulations, we rely on the UK Extension to the EU-US Data Privacy Framework for certified companies, or on the UK International Data Transfer Agreement or Addendum, which require the recipient to protect your data to UK standards.
How long we keep it
| Data | Kept for |
|---|---|
| Pairing details, IP address and location | Up to 10 minutes, until the code is used, refused or expires |
| Requests and results in transit | Until delivered |
| Long-running results waiting to be collected | 24 hours |
| Details of an approval request | Until you answer or it expires after 12 hours. The record of the request and your answer, 90 days |
| Call log | 90 days |
| Monthly action counts | About 13 months |
| Website sign-in session | 1 hour |
| Your PCs | Until you remove them or close your account |
| Your account and plan | Until you close your account, then deleted within 30 days. Records we must keep for tax, six years |
| Support emails | Up to two years after our last exchange |
Your rights
Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, limit how we use it, or send it to you in a portable form, and you can object to our use of it based on legitimate interests. To use any of these rights, email us. We will reply within one month, and we do not charge for this. If you are not happy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.
Security
All connections to Ponta are encrypted. Each PC has its own key, and we keep only a fingerprint of it. Each customer's data is kept apart from every other customer's. Our security page has the details.
Children
Ponta is not for anyone under 18, and we do not knowingly collect children's data.
Changes to this notice
If we change this notice in a way that matters, we will email you before the change applies. The date at the top shows when it last changed.