Privacy Policy

The following parties are jointly responsible for data processing in connection with AI Registry pursuant to Art. 26 GDPR:

We process the following categories of personal data in particular:

• Account and profile data such as name, e-mail address and login credentials
• Register, organisation and use-case data documented by users
• Data from external submissions, for example via access code or supplier link
• Technical usage data, server logs and security-relevant events
• Payment and billing data, insofar as paid services are purchased

Processing is carried out for the following purposes in particular:

• Provision and operation of AI Registry
• Documentation, processing and export of AI use cases
• Handling of registration, login and team access
• Receipt and tracking of external submissions
• Billing of paid services
• Stability, security, abuse prevention and support

The legal bases are in particular Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures), Art. 6(1)(c) GDPR (compliance with a legal obligation) and Art. 6(1)(f) GDPR (legitimate interests in the secure and reliable operation of the service).

We use Netlify to host the website and run the web application, including its ChatGPT interface. Google Firebase and Google Cloud provide authentication, database and storage services. Where payment processing takes place, we use Stripe.

These services may involve processing outside the European Economic Area. The location of an individual database does not describe the entire data flow, including processing by ChatGPT. We therefore do not promise that all processing takes place exclusively within the EU.

For information about providers and data flows relevant to your use, please use the data protection contact below.

When you use the KIRegister extension in ChatGPT, OpenAI processes your inputs and the results requested in the conversation under the terms and privacy settings applicable to your ChatGPT account. Previews in the conversation are also processed within ChatGPT. KIRegister receives the structured information sent to its tools; it does not automatically receive the complete conversation transcript.

To access saved registers, you sign in on KIRegister and explicitly select the registers to connect and review the displayed permissions. Fields from those registers and the results of save or export actions are sent to ChatGPT as part of your requests. The connection supplies a stable account ID; your password and Firebase sign-in token are not sent to ChatGPT. Access permissions are checked again on subsequent requests.

Describe use cases using roles and data categories. Do not submit credentials, full documents or sensitive personal case details. Technical filters detect certain recognizable patterns but do not provide comprehensive detection of personal or confidential data.

The plugin application does not write conversation transcripts, tool arguments, register contents or access tokens to its application logs or analytics events. For security and safe retries, it stores connection records, expiry times, action references and limited technical counters. Infrastructure operational data and processing within ChatGPT are separate from these application controls.

Disconnecting or revoking the connection prevents further access through that grant. It does not remove content already sent to ChatGPT from the conversation or automatically erase it from your ChatGPT account. Use your ChatGPT account's privacy and deletion controls for that purpose. Register entries already saved in KIRegister remain in the register.

When you use KIRegister as a connector in Claude, Anthropic processes your inputs and the results requested in the conversation under the terms and privacy settings applicable to your Claude account. Previews in the conversation are also processed within Claude. This processing may take place outside the European Economic Area, in particular in the United States. From the conversation, KIRegister only receives the structured information sent to its tools; it does not automatically receive the complete conversation transcript.

To access saved registers, you sign in on KIRegister, explicitly select the registers to connect and review the displayed permissions. Fields from those registers and the results of save or export actions are sent to Claude as part of your requests. The connection supplies a stable account ID; your password and Firebase sign-in token are not sent to Anthropic. Access permissions are checked again on subsequent requests.

Describe use cases using roles and data categories. Do not submit credentials, full documents or sensitive personal case details. For this connection as well, the KIRegister application does not write conversation transcripts, tool arguments, register contents or access tokens to its application logs or analytics events.

Revoking the connection prevents further access through that grant. It does not remove content already sent to Claude from the conversation or automatically erase it from your Claude account. Use your Claude account's privacy and deletion controls for that purpose. Register entries already saved in KIRegister remain in the register.

When information is submitted via an access code or signed supplier link, we store the submitted content, sender details, timestamp, submission source and associated references in order to review the submission internally and maintain an auditable record.

This processing is carried out for the performance of the respective submission process and to safeguard legitimate interests in documentation, security and governance.

For paid services, payment processing may be handled by Stripe. Payment data is processed directly by the respective payment service provider. Within AI Registry we only store the contract and reference data required for entitlement, billing, documentation and support.

We retain personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations.

ChatGPT extension drafts are available to save for up to 24 hours. Private export downloads expire after one hour. Action receipts used to make request retries safe are scheduled for retention for 30 days. Expiry and physical deletion are separate: database cleanup runs asynchronously through configured expiry policies and does not take place at the exact expiry time.

Connection grants and their refresh tokens are valid for up to 30 days. Security records for expired codes and tokens are scheduled for cleanup one day after their respective expiry. Earlier revocation ends access immediately without prematurely removing these technical records.

Register and audit data may additionally be retained for longer periods insofar as this is necessary for documentation, export, governance or legal obligations.

You have the following rights under the GDPR in particular:

• Right of access pursuant to Art. 15 GDPR
• Right to rectification pursuant to Art. 16 GDPR
• Right to erasure pursuant to Art. 17 GDPR
• Right to restriction of processing pursuant to Art. 18 GDPR
• Right to data portability pursuant to Art. 20 GDPR
• Right to object pursuant to Art. 21 GDPR

You also have the right to lodge a complaint with a competent supervisory authority. The lead supervisory authority for ZukunftBilden GmbH is the Austrian Data Protection Authority (Oesterreichische Datenschutzbehoerde), Barichgasse 40-42, 1030 Wien, Austria; www.dsb.gv.at.

Data protection enquiries can be directed to kiregister@zukunftbilden.eu.

We may update this privacy policy where necessary due to product developments, changes to our processes or new legal requirements.