Privacy policy | MplusKASSA AI

1. Who is responsible?

MplusKASSA is responsible for the personal data used to operate this website, its OAuth login and the MplusKASSA AI connection. For business data requested from an existing MplusKASSA installation, your employer or organisation may be the controller and MplusKASSA its processor.

2. Data we process

Depending on how you use the service, we process the following categories:

Identity and account data, such as your name, email address, verified-email status, user identifier and linked MplusKASSA administration.
Authorisation data, such as granted OAuth scopes, account type and encrypted access and refresh tokens.
Tool requests and business data needed to answer them, such as report parameters, selected employee details and results from your MplusKASSA installation.
Security and audit data, such as the tool used, user and administration identifiers, authorisation decision, outcome, duration and error code. Tool arguments and results are not stored in the tool-invocation audit log.
Technical data, such as IP address, browser information, timestamps and server logs.
Language and theme preferences stored locally in your browser.

3. Why and on what basis?

We process personal data only where there is a lawful basis:

To provide the requested connection and tools and perform our agreement with you or your organisation.
To authenticate users, enforce permissions, prevent misuse and keep the service secure, based on our legitimate interests and those of our customers.
To maintain, troubleshoot and improve reliability, based on our legitimate interest in operating a dependable service.
To meet legal obligations and establish, exercise or defend legal claims.
Where required, on the basis of consent. You may withdraw consent at any time without affecting earlier lawful processing.

4. ChatGPT, MCP clients and other recipients

When you invoke a MplusKASSA tool through ChatGPT or another MCP client, that client sends the request to us and receives the response. The client provider processes your conversation and tool results under its own terms and privacy policy. Do not request more personal or confidential data than you need.

We may use hosting, security, support and infrastructure providers as processors. We share data with them only as needed and under appropriate agreements. We do not sell personal data.

5. International transfers

Some client or infrastructure providers may process data outside the European Economic Area. Where we are responsible for such a transfer, we use an adequacy decision, standard contractual clauses or another legally recognised safeguard. Your chosen client provider is separately responsible for transfers it makes.

6. How long do we keep data?

We keep personal data no longer than necessary for the purposes above and applicable legal obligations. Tool-invocation audit records are normally deleted after 90 days. Delegated OAuth credentials are kept while the connection is active or until they expire or are revoked. Operational and security logs are retained for a limited period appropriate to investigation and security needs.

7. Security and automated decisions

We use technical and organisational safeguards, including encrypted delegated credentials, access controls, permission checks and audit logging. No internet service is completely risk-free.

MplusKASSA AI may generate summaries and reports, but MplusKASSA does not use this service to make decisions producing legal or similarly significant effects about you without meaningful human involvement.

8. Your rights

Subject to the GDPR, you may request access, correction, deletion, restriction, objection or data portability. You may also revoke the connection in your client or MplusKASSA account. We may need to verify your identity before acting on a request.

You may complain to the Dutch Data Protection Authority or the supervisory authority in your country. If your organisation controls the business data, submit your request to that organisation first.

9. Cookies, local storage and changes

This website uses local storage for your language and theme preferences and may use essential session and security cookies during authentication. These are not used for advertising. We may update this policy when the service or law changes; the date above shows the latest revision.