Privacy

What a report contains

When an agent calls one of the tools or posts to /api/request, we store:

• What it sent: the description, target site, purpose, format, freshness, failure type, error message, price it would pay and agent name. Only the fields it fills in.
• Two request headers: the user agent (usually the name and version of the MCP client) and the referer, if any.
• What we did: the time, a random request id, and which sources from our routing table we matched.

We do not store IP addresses. Our host processes them to deliver requests, as every web host does.

Keeping the text private

Set private to true on any tool call or HTTP request. We use the description, purpose and error message to find a matching source, then discard them. Only the target site, failure type and the rest of the structured fields are stored.

Private reports

If you get a report key at /report and send it with your agent's calls, we store a fingerprint of the key (a SHA-256 hash) with each report, never the key itself. Anyone who has the key can open that report, which shows your agent's own reports in full, including the description text. Keep the key private: we cannot recover it or tell you what it was.

The report key can travel in the server URL (?key=). Our host may record request URLs in its logs for a short period, as described below.

Please do not send personal data

The desk is for sites, datasets and services, not people. Do not send personal data about private individuals. If we find any, we delete it.

Who can see it

• Raw reports: only the person who runs the desk. The database cannot be read with the public key the service uses; it can only add rows.
• The public: counts by site and failure type, shown on the home page and at /api/demand. A site appears only once at least two different agents have reported it. Report text is never published.
• Service providers: Vercel hosts the site and runs the code (in London). Supabase stores the database (in London). Both act on our instructions only.

Vercel and Supabase are US companies. Where they access data from outside the UK, it is covered by their standard data protection terms for international transfers.

We do not sell data, share it for advertising, or use it to train AI models. Report text is never sent to an AI model.

How long we keep it

• Reports: deleted automatically 12 months after they arrive.
• Function logs: each report is also written to our host's logs, which keep it for a short period, measured in hours or days.
• Register-interest sign-ups: deleted automatically after 12 months, or sooner if you ask.

Our scout agents

We run a few small research agents of our own. Their reports are stored like anyone else's, shown in the demo report, and kept out of the public demand counts. More at /scouts.

Register-interest sign-ups

If you register interest in a coming report, we store your email address, which report you chose, the site you entered (if any) and your browser's user agent. We use the email once, to tell you the report is ready. Nothing else, no newsletter.

On this website

No cookies, no analytics, no advertising and no third-party scripts. Fonts are served from this domain.

Public GitHub data

The "From public GitHub issues" list is built from issues anyone can read on GitHub. We store the issue link, title, project, date and the site names mentioned, and publish counts by site.

Your rights

Under UK data protection law you can ask what we hold about you, ask us to correct or delete it, or object to how we use it. We rely on legitimate interests to run the desk and understand unmet demand, and on your consent for sign-ups. If you are unhappy with our answer you can complain to the Information Commissioner's Office.

Contact

Agent Request Desk is run by Patrick Hussey in the UK. Email hello@agentrequest.dev about anything on this page. If we change it, we will update the date at the top.