Privacy Policy
Controller (draft): Shay Levi, Israel (עוסק פטור / individual developer), operating Gotoquill Cloud. Contact: privacy@gotoquill.com Product site: https://gotoquill.com/
This policy applies to the hosted Gotoquill Cloud MCP and related web pages. The open-source local gotoquill CLI/MCP on your own machine is under your control and is not covered here except where you voluntarily connect to Cloud.
Summary
- We design Cloud to be ephemeral: no long-term document archive.
- Sealed signing links use end-to-end encryption; the decryption key is intended to live only in the URL fragment or on the client.
- We collect minimal metadata needed to run OAuth, abuse prevention, and short-lived requests.
- We do not sell personal data. We do not use your documents to train models.
Categories of personal data
| Category | Examples | When |
|---|---|---|
| Account / auth | Opaque tenant id, OAuth client id, token digests, IP (short-term rate limits) | Connect / authorize |
| Request metadata | Request id, timestamps, expiry, byte sizes, status | Signature request lifecycle |
| Document content | PDF bytes, page previews, signature images, typed names | Briefly while processing or stamping; deleted on complete/expire |
| Ciphertext blobs | Encrypted payloads in ephemeral storage / relay | Until TTL or delete-on-read |
| Support | Email content you send to support@gotoquill.com | When you contact us |
| Logs | Technical errors, coarse request counts (bodies redacted) | Operations |
We do not intend to collect government IDs, payment card data (PCI), or health data (PHI). Do not upload such documents to Cloud.
Purposes
- Provide e-signature orchestration via MCP to connected chat apps
- Authenticate tenants and isolate their requests
- Security, rate limiting, fraud/abuse prevention
- Meet legal obligations and App Developer Terms (e.g. breach notice to OpenAI where required)
Recipients / processors
- Hosting providers you configure for production (e.g. Fly.io, Cloudflare) under their terms
- OpenAI / Anthropic / Meta (or other MCP hosts) as independent platforms when you connect the plugin — they receive tool inputs/outputs you authorize in chat
- Email provider for support
- Optional: public ciphertext relay infrastructure if used for sealed links (ciphertext only)
We do not sell personal data.
Retention
| Data | Retention |
|---|---|
| Ephemeral document / ciphertext blobs | Default ≤ 1 hour, maximum 24 hours, or earlier on complete / cancel / delete-on-read |
| OAuth access tokens | Hours (configurable); refresh tokens until revoked/expiry |
| Rate-limit counters | Minutes |
| Support emails | As needed to resolve the request, then delete/archive per support practice |
| Aggregated metrics | May be kept longer without document contents |
Your controls
- Disconnect the plugin in ChatGPT / host settings (revokes ongoing use; in-flight blobs expire by TTL).
- Cancel a pending request via the
cancel_requesttool. - Email privacy@gotoquill.com to request deletion of support correspondence or residual account metadata we can locate.
- Do not use Cloud for data you are not allowed to process.
International transfers
Servers may be located outside Israel (e.g. EU/US regions of the host). Draft: document final regions before launch and add SCCs/transfer language as advised by counsel.
Children
Not directed at children under 13. Do not use if under 13.
Changes
We will update this page and revise the “Last updated” date. Material changes for a submitted plugin should stay consistent with OpenAI Plugin guidelines.
Last updated
DRAFT — 2026-10-28 (America/New_York). Not published.