Privacy Policy | Centipid

This Privacy Policy explains how Centipid Technologies ("we," "our," or "the Company") handles customer data within our ISP billing system. We are committed to protecting your privacy and maintaining the security of your personal information.

Data Collection and Purpose

Centipid Technologies collects specific information necessary for the operation of our ISP billing services. The information we collect includes customer identification details, service usage data, and payment information. This data is essential for processing payments, maintaining service quality, and ensuring system functionality. We maintain records of service usage for billing accuracy, technical maintenance, and the workspace reporting and diagnostic features described in this policy.

Staff Access Protocol

Our staff access protocol limits technical support access to authorized personnel for system debugging and support resolution. This is separate from access by authorized workspace operators and the connected services described below. Each debugging session is thoroughly documented, including the reason for access, duration, and actions taken. This ensures complete transparency and maintains the integrity of our privacy commitment.

No Contact Policy

Centipid Technologies maintains a strict no-contact policy regarding customer communications. We do not initiate contact with your clients for marketing, promotional, or sales purposes. Our communication is limited to:

Automated billing notifications
System maintenance alerts
Direct responses to customer-initiated support requests
Legal or service-affecting notifications

Data Protection Measures

We implement comprehensive security measures to protect your information. All data is encrypted using industry-standard protocols during transmission and storage. Our security infrastructure includes:

Multi-layer firewall protection
Regular security audits and updates
Strict access control protocols
Continuous system monitoring
Secure data backup systems

Centipid does not sell customer data or share it with advertising or marketing agencies. We share information only with the service providers needed to run the features you use: the payment processors described below, the hosting and database providers that store the billing system on our behalf, and the connected AI services described in the next section.

Connected AI Services (MCP)

An ISP workspace can connect an external AI service, such as ChatGPT, Claude or Codex, to its billing system through our Model Context Protocol (MCP) server at https://mcp.centipidbilling.com/mcp. The AI service can then call tools that read the workspace's billing data or request actions. This section explains what that connection collects, why, who receives it, how long it is kept and how to control it.

What we collect

Connection records. When an operator connects a service, we record which service it is (for example "ChatGPT"), the workspace, the operator who approved it, when it was connected and when it expires. If the operator uses an API key instead, we record the key's name, when it was created and when it was last used. Keys and tokens are stored hashed or signed, never in plain text.
Tool inputs. These are the values the AI service sends with each tool call, such as a subscriber's name, phone number or account number to look up, a date range, a router, or an IP address.
Tool outputs. These are the results we send back. Depending on the tool and the operator's permissions, they can include subscriber names and contact details, account, package and expiry information, payment amounts and references, invoices, data usage and session history, support tickets, voucher stock, and router status, logs and configuration. Router passwords and other credentials are removed before any router output is returned.
Request logs. Our web servers log each request's IP address, user agent, time, path and response status. They do not log request or response bodies.

Why we use it

To answer the request the operator made through the AI service, and nothing else.
To authenticate the connection and apply the operator's existing permissions, so a tool never returns data the operator could not see in the billing app.
To hold requested actions (reconnecting or disconnecting a subscriber, creating or changing a subscriber, blocking or unblocking an IP address, applying a router fix) until an authorized operator confirms them. The AI service cannot carry out these actions by itself.
To keep the service secure: rate limiting, detecting abuse and troubleshooting failures.

We do not use tool inputs or outputs to train AI models, for advertising, or to build profiles of subscribers.

Who receives it

The AI service the operator connected receives the tool outputs and handles them under its own terms and privacy policy, for example OpenAI's for ChatGPT.
ipinfo.io receives an IP address, and nothing else, when the IP lookup tool is used, so it can return that address's network owner and location.
An AI provider (Anthropic or OpenRouter) receives router diagnostic data when the MikroTik diagnosis tool asks for a written explanation of its findings.
Our hosting and database providers store connection records and saved requests on our behalf, under contracts that require them to protect the data.

No other party receives MCP data.

How long we keep it

Tool inputs and outputs for read tools are used to answer the request and are not stored by Centipid afterwards.
Access tokens expire after 1 hour. Connections and refresh tokens expire after 30 days unless they are disconnected sooner. Unfinished connection attempts are deleted one day after they expire.
Requested actions are saved, with their inputs and whether they were confirmed, in the workspace's AI Chat under "MCP session". Diagnosis audits and findings and any AI explanation are saved in the workspace too. Both are kept while the workspace account is active and are deleted with it, as described in Data Retention and Management.
Web server request logs are kept for 14 days.
Information already sent to an AI service is kept according to that service's policy. Disconnecting stops future access; it does not delete what the service already received.

Your controls

Only operators whose role includes the AI Chat permission can connect a service, and a workspace administrator can remove that permission from any role.
An operator can see and disconnect their connected services at any time at /mcp/oauth/connections on their billing domain. Disconnecting takes effect immediately.
API keys can be deleted in the billing app under Settings → Developer. A deleted key stops working immediately.
Every requested action waits for an operator to confirm or reject it in AI Chat.
Use the AI service's own settings to delete conversations or data it holds.
Workspaces can use the rights listed under Customer Rights, including a report or export of their stored data and deletion on termination.

Subscribers of an ISP should contact that ISP about their data. The ISP decides whether to connect an AI service and which operators may use it.

Diagnostic features

Some diagnostic features, inside the billing app and through MCP, send diagnostic context to a configured AI provider to generate explanations. Centipid saves diagnostic audits and findings, and may save the associated AI interaction. A diagnostic request does not change router configuration.

Data Retention and Management

We retain customer data only for the duration necessary to provide services and comply with legal requirements. Upon service termination, non-essential data is securely deleted from our systems. Financial records are maintained according to applicable laws and regulations, with strict security protocols governing their storage.

Customer Rights

As a Centipid Technologies customer, you maintain control over your personal information. You have the right to:

Request a comprehensive report of your stored data
Correct any inaccurate information
Export your data in a standard format
Request deletion of your information upon service termination
Receive notification of any security incidents affecting your data

Compliance and Updates

This privacy policy complies with current data protection regulations and industry standards. We regularly review and update our privacy practices to ensure continued compliance and optimal data protection.

Payment Data Protection

We implement additional security measures specifically for payment-related data:

Payment card information is encrypted using PCI DSS compliant protocols
Bank account details are stored with enhanced encryption standards
Payment processing logs are maintained with restricted access
Automated monitoring systems detect unusual payment patterns
Regular PCI compliance audits are conducted

Financial Data Retention

Our financial data retention policies include:

Transaction records are maintained for 7 years as per regulatory requirements
Payment method details are securely stored only until account closure
Audit logs of financial transactions are preserved for compliance purposes
Automated data purging occurs after retention periods expire

Automated Billing Data Processing

Our billing system employs automated processing to ensure accuracy and efficiency:

Usage data is automatically collected and processed for billing purposes
Automated notifications are sent for payment due dates, successful payments, and failed transactions
System algorithms analyze usage patterns for billing accuracy and the reporting and diagnostic features described above
Automated data validation checks ensure billing information integrity
All automated processes are regularly audited for compliance and accuracy

Third-Party Payment Processors

When using third-party payment processors:

We select only PCI-compliant payment processors with strong security records
Minimal necessary information is shared with payment processors to complete transactions
We maintain contractual agreements requiring processors to protect your data
Payment processor interactions are logged and monitored
We regularly review and assess the security practices of our payment partners

Data Breach Response Protocol

In the unlikely event of a data breach affecting billing information:

We will notify affected customers within 72 hours of breach confirmation
Detailed information about the breach scope and affected data will be provided
We will cooperate fully with law enforcement and regulatory authorities
Remediation steps will be implemented immediately to prevent further exposure
Credit monitoring services may be provided for affected customers when appropriate

Billing System Access Logs

Our billing system maintains detailed access logs:

All administrator access to billing data is logged with timestamps and action details
Customer account access is recorded for security monitoring
Failed login attempts are monitored and flagged for security review
Access logs are retained for as long as your account is active
Regular access pattern analysis is conducted to detect potential security issues

Contact Information

For privacy questions or requests, including anything about connected AI services, email sales@centipidtechnologies.com. Do not send passwords, OTPs, API secrets, payment PINs, or unnecessary customer records by email or chat.