Data controller
The publisher of Claude Market, see the legal notice. For any question about your data: the contact form.
Data collected
- Account: name, email address and GitHub profile (sign-in with GitHub). The GitHub access token is used to sign you in, to read your public repositories when you build a skill from one of them, and, if you claim a listing, to check with GitHub that the repository is yours; it is never shown or passed to a third party. If you install the Claude Market GitHub app, it only reads the repositories you share with it (read-only), to build your skill’s .zip; you can remove it at any time from GitHub.
- Purchases: products bought, amounts, invoices. Card data is processed by Stripe, never by Claude Market.
- Creators: display name, description, website, seller status (individual or professional), country, legal name and registration number, Stripe account and sales. The information required by the DAC7 directive (identity, address, tax number) is collected by Stripe or by Claude Market and reported each year to the tax authorities.
- Use of paid connectors: number of calls per day and per product, for access and billing. The gateway does not keep the content of your conversations. The connector’s creator receives a pseudonym specific to their product, never your name or email.
- Contact and reports: what you write in the forms.
- Security: IP address, used for a few minutes to limit abusive requests, then forgotten, and, when forms are sent (sign-in, contact, reports, claims, reviews, community, creator space), by Cloudflare Turnstile (anti-bot check without advertising cookies).
- Audience measurement: only if you accept it (see “Cookies”).
Purposes and legal bases
- Providing the service and carrying out purchases: contract.
- Invoices, accounting obligations and DAC7 reporting: legal obligation.
- Emails about your account, purchases and products: contract.
- New version emails: legitimate interest; a link in each email turns them off.
- Security, fraud prevention and moderation: legitimate interest.
- Audience measurement: consent.
Retention periods
- Account: until it is deleted, then erased.
- Invoices: 10 years (accounting obligation).
- A creator’s sales (amount, commission, date, seller name and Stripe account): 10 years (accounting obligations and DAC7 reporting), even after their account is deleted.
- Usage counters: as long as the account exists; erased with it.
- Contact messages: 3 years after the last exchange.
- Date and version of the accepted terms: as long as the account exists (proof of agreement).
- Cookie choice: 6 months. Language choice: 1 year.
Recipients and processors
- Cloudflare (hosting, database, storage, anti-bot protection, sending emails).
- GitHub (sign-in, checking claimed repositories, reading the repositories you publish from, including private repositories shared with the Claude Market app).
- Stripe (payment, invoicing, payouts to creators).
- Google (audience measurement, only with your consent).
- Creators receive the information needed for the service (a subscriber pseudonym for connectors; for a sale, the information Stripe passes to them as the seller), never your card data.
Some of these providers are located outside the European Union; transfers are covered by the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.
Cookies
- Necessary (always on): sign-in session, cart, your cookie choice, your language choice, and your acceptance of the terms while signing in with GitHub (1 hour).
- Audience measurement (Google Analytics 4): set only if you click “Accept all” or turn them on in “Customise”. No Google script is loaded before your consent.
You can change your mind at any time with the “Manage cookies” button at the bottom of each page.
Your rights
You have the right of access, rectification, erasure, portability, objection and restriction, and you can withdraw any consent you gave (audience measurement) at any time. You can also set instructions for what happens to your data after your death. From the Account page, you can delete your data yourself; to get a copy of your data (access, portability) and for the rest, use the contact form: answer within one month. You can also contact the CNIL, the French data protection authority (cnil.fr).
No decision with legal effects is made about you in a fully automated way: automatic hiding (3 reports) is temporary and checked by a person.