Privacy Policy

Last updated 24 August 2026 · Index World

Index World operates the Index World MCP Bridge, a hosted service at mcp.indexworld.net that connects a business system you already use — Odoo or QuickBooks Online — to an AI assistant of your choosing, using the Model Context Protocol (MCP). This policy explains what the service stores, what it does not store, and what happens to your data.

What we store

• Your account: the email address you sign up with, and a salted hash of your password. We never store your password itself.
• Each connection you create: a name you choose; which provider it is; for Odoo, the instance URL, database name and login, together with the password or API key encrypted at rest; for QuickBooks Online, the company (realm) ID and the OAuth access and refresh tokens, also encrypted at rest.
• The permissions you grant: which records the assistant may read, create, update or delete, and whether arbitrary method calls are allowed.
• A connection token — the secret part of the URL you paste into your AI assistant.

What we do not store

We do not keep a copy of your business records. Invoices, customers, bills, reports, leads and every other record stay in your Odoo or QuickBooks account. When your assistant asks for something, the request is passed through to your system and the answer is returned in the same exchange — it is not cached, archived or written to our database.

How your data is used

Your data is used for one purpose only: to serve the requests your own AI assistant makes over your own connection. In particular:

• We do not use your data, or any data obtained from Intuit's platform, to train or develop artificial intelligence or machine learning models.
• We do not sell your data, and we do not share it with advertisers.
• We do not access your business data ourselves except where you ask us to, in support.

Who else sees it

The AI assistant you connect receives whatever it asks for and is permitted to see. That assistant is operated by a third party you have chosen, under their own terms and privacy policy. Choosing which assistant to connect, and what to permit it, is your decision.

Permissions and control

Every connection starts read-only. Nothing can be created, changed or deleted until you grant that explicitly, per record type, on the connection's Permissions page. You can narrow or widen those permissions at any time, and the change takes effect immediately.

Security

• All traffic is served over HTTPS.
• Credentials and OAuth tokens are encrypted at rest.
• Every connection has its own secret URL, which you can rotate at any time — the previous URL stops working the moment you do.
• Each account can only see and manage its own connections.

Deleting your data

Deleting a connection removes its stored credentials and tokens and its URL immediately stops working. Disconnecting the app from inside QuickBooks revokes our access on Intuit's side as well. To have your whole account removed, contact us at the address below.

Where the service runs, and who can reach it

The service is hosted on servers located in the United Kingdom. Index World is registered in the State of Delaware, United States of America, and the team that operates and supports the service works from Pakistan.

This means that if you ask us for support, or if we need to investigate a fault, staff in Pakistan may access your account and, where it is necessary to resolve the problem, data returned through your connection. We do this only to run and support the service, and only to the extent needed. Your credentials themselves are encrypted and are not readable by us in ordinary use.

Contact

Questions about this policy, or requests about your data: info@indexworld.net

Index World, 896-S State St, Unit #417, Dover, DE 19901, United States