Privacy & data notice.
How the Boomi MCP Server collects, uses, stores, and protects your personal data — and the rights you have over it.
This notice explains how RenEra.ai (“we”, “us”, the “operator”) processes personal data when you use the Boomi MCP Server hosted at boomi.renera.ai (the “Service”). It is written to align with the EU/UK General Data Protection Regulation (GDPR) as a baseline standard, regardless of where you are located. For the purposes of the GDPR, RenEra.ai is the data controller for the personal data described below.
The Service is a Model Context Protocol (MCP) server that lets AI agents operate your Boomi AtomSphere account on your behalf. To do this, it stores credentials that you choose to provide. Please read this notice before signing in or saving any credentials.
1Who we are
The Service is operated by RenEra.ai. For any privacy question or to exercise your rights, contact us at [email protected]. We will respond to data-subject requests without undue delay and, in any case, within the timeframes required by applicable law (generally one month under the GDPR).
2What data we collect
- Account identity. When you sign in with Google, we receive your Google account email address and a stable Google account identifier (the OpenID
sub). These are held in an encrypted, cryptographically signed session cookie. - Boomi credentials you choose to store. When you save a profile, we store your Boomi Account ID, Boomi account username (your email, prefixed with a token marker), your Boomi API token, and a profile label you supply.
- Operational logs. Standard server and access logs — such as IP address, timestamps, request metadata, and error traces — are generated via Google Cloud Logging for security, debugging, and audit purposes.
We do not intentionally collect special-category data, and you should not enter any into the Service. We do not use advertising cookies or third-party trackers.
3Why we process it, and our lawful basis
- To authenticate you and maintain your session — necessary to provide the Service you have requested (GDPR Art. 6(1)(b), performance of a contract / service).
- To store and use your Boomi credentials so the Service can call the Boomi API on your behalf when your agent invokes a tool — carried out on the basis of your explicit consent, which you give via the checkbox on the credentials page, and to provide the Service you request (Art. 6(1)(a) and 6(1)(b)).
- To keep security, audit, and operational logs — our legitimate interest in securing the Service, preventing abuse, and ensuring reliability, and to meet our legal obligations (Art. 6(1)(f) and 6(1)(c)).
We do not sell your data, share it for any party's independent purposes, or use it for advertising, profiling, or automated decision-making that produces legal or similarly significant effects.
4Where and how it is stored
- Your Boomi credentials are stored in Google Cloud Secret Manager, encrypted at rest and in transit (TLS).
- Access is IAM-controlled, isolated per user, and audit-logged. Credentials are validated against Boomi before they are saved, and each user is limited to a small number of stored profiles.
- The website and the MCP endpoint are served over HTTPS only.
No method of transmission or storage is completely secure. You provide credentials at your own risk. We strongly recommend storing a scoped, least-privilege Boomi API token rather than a primary account password, and revoking the token in Boomi if you suspect it has been compromised.
5Who we share it with (recipients & processors)
- Google Cloud Platform — hosting, Secret Manager, and logging, acting as our data processor.
- Google LLC — Google Sign-In (OAuth) for authentication.
- Boomi (Dell Technologies) — when your agent uses a tool, we transmit your stored credentials and the request to Boomi's API to fulfil it. Your use of Boomi is governed by your own agreement with Boomi.
- Legal authorities — only where we are required to disclose by law.
6International transfers
The Service is hosted on Google Cloud infrastructure in the United States. If you access it from the European Economic Area, the United Kingdom, or elsewhere, your personal data is transferred to and processed in the United States. Where required, such transfers rely on appropriate safeguards offered by our infrastructure provider, including Standard Contractual Clauses.
7How long we keep it
- Stored Boomi credentials are kept until you delete the profile (using the “Delete” control on your credentials page) or ask us to delete them. Deletion removes the corresponding secret from Secret Manager.
- Session data expires automatically.
- Operational logs are retained for a limited period under standard Google Cloud Logging retention, after which they are deleted.
8Your rights
Subject to applicable law, you have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability; and to withdraw consent at any time (without affecting processing already carried out). You can exercise erasure yourself at any time by deleting your profiles and signing out. For any other request, email [email protected].
You also have the right to lodge a complaint with your local data-protection supervisory authority if you believe your data has been handled unlawfully.
9Your responsibilities
Only store credentials that you are authorised to use. Do not store other people's personal data or credentials without a lawful basis and their knowledge. You are responsible for ensuring your use of the Service and of Boomi complies with your own organisation's policies and applicable law.
10Children
The Service is intended for professional use and is not directed to anyone under the age of 16. We do not knowingly collect data from children.
11Trademarks & affiliation
“Boomi” is a trademark of Boomi, LP. “Google” and “Google Cloud” are trademarks of Google LLC. RenEra.ai is an independent project and is not affiliated with, endorsed by, or sponsored by Boomi or Google.
12Changes to this notice
We may update this notice from time to time. The “Last updated” date at the top reflects the current version. Material changes will be reflected here before they take effect.
13Contact
Questions, requests, or concerns about this notice or your data: [email protected].