Privacy Policy

VTEX CX Platform Analytics MCP Server — Last updated: March 2026

1. Overview

VTEX CX Platform Analytics is an MCP (Model Context Protocol) server developed by VTEX. It provides real-time analytics tools for VTEX CX Platform chatbot projects, including conversation metrics, customer satisfaction scores (CSAT), Net Promoter Score (NPS), topic distribution, sales funnel data, and human support monitoring.

This policy describes what data the server accesses, how it is handled, and what information may be returned to the AI model or user interface.

2. Data Accessed

When a tool is called, the server queries the VTEX CX Platform Insights API on behalf of the authenticated user. The data accessed includes:

• Conversation volume and resolution metrics (aggregated)
• Customer satisfaction (CSAT) scores and distributions
• Net Promoter Score (NPS) data
• Conversation topic and subtopic distributions
• Sales funnel metrics (leads, orders, conversion rates)
• Human support agent performance data
• Ongoing and finished conversation room records

3. Personal Data and Anonymization

Some tools return data that may include personal identifiers. The following anonymization rules are applied before any data is returned to the model or user:

• Customer/contact names are replaced with a short, consistent, anonymous identifier (e.g., Contact #a3f2b1) using a one-way SHA-256 hash. The original name is never exposed.
• Agent email addresses are masked (e.g., a***@company.com). Only the first character and domain are visible.
• Internal URLs that may contain agent email addresses are removed from responses entirely.
• Agent names (first and last name) may appear in responses as operational data necessary for supervisors to identify support staff performance.

4. Authentication

All requests to the server are authenticated via OpenID Connect (OIDC) using Keycloak. The server does not store authentication tokens or credentials. Access tokens are used only to authorize API requests during the active session and are never logged or persisted.

5. Session Tracking

To monitor platform access and maintain security, the server records a minimal session log in a private database whenever an authenticated user connects. The following information is stored:

• User email address — used to identify who is accessing the platform
• First login timestamp — when the user first connected
• Last activity timestamp — updated on each authenticated request
• Active session flag — whether the session is currently active

This data is used exclusively for access control and operational observability (e.g., auditing who has active sessions). It is not shared with third parties and is not used for analytics, profiling, or advertising purposes.

6. Data Retention

The MCP server does not store, log, or retain conversation content or analytics results. All analytics data is fetched in real time from the VTEX CX Platform Insights API and returned directly to the requesting client. No caching of analytics or personal data occurs beyond the session tracking described in Section 5.

7. Third-Party Services

The server communicates with the following external service:

• VTEX CX Platform Insights API (insights-engine.weni.ai) — the source of all analytics data. Data handling by this service is governed by VTEX's Privacy Policy.

8. User Rights

Users whose data appears in the analytics (e.g., support agents, end customers) have rights under applicable data protection laws, including the Brazilian General Data Protection Law (LGPD) and GDPR where applicable. To exercise these rights, contact support.weni@vtex.com.

9. Contact

For questions about this privacy policy or data practices, contact:
VTEX
support.weni@vtex.com
https://vtex.com/pt-br/products/cx_platform