Private cloud work should stay private.

1. Controller and contact

The publisher and controller for the project-operated bridge is Jens Zimmermann, Girlitzweg 30, 50829 Köln, Germany. Contact: info@asswerbe.de. ASS Werbe GmbH provides technical hosting on his behalf. Do not put personal data or credentials in a public GitHub issue.

A separately self-hosted installation has its own operator. That operator—not this project maintainer—decides its hosting, logs, users, retention, and legal basis and must provide its own notice.

2. Website data

This website sets no non-essential cookies, runs no advertising or behavioral analytics, and contains no account or contact form. The website is delivered through OpenAI Sites on Cloudflare infrastructure. Those providers may process IP address, timestamp, requested URL, user agent, and security events to deliver and protect the site under their own published privacy terms.

3. Bridge account and connection data

The hosted bridge needs the following limited data to operate:

• verified OAuth issuer, subject, client identifier, and scopes; the issuer and subject are converted to a pseudonymous tenant ID;
• Nextcloud base URL, Nextcloud login name, selected workspace root, connection status, opaque identifiers, and timestamps;
• short-lived Login Flow endpoint and poll secret while account connection is pending;
• a Nextcloud-generated app password encrypted separately from connection metadata; and
• optional household display name, root-relative invoice paths, and default currency.

The bridge does not ask for or store the user's Nextcloud account password, recovery codes, or ChatGPT password.

4. File and invoice content

The bridge retrieves only content requested through an MCP tool and processes it transiently to produce the requested result. Tool results are returned to ChatGPT or Codex, where OpenAI's terms and privacy controls apply. The bridge does not use file content to train models or build advertising profiles.

Household invoice extraction is bounded. Raw extracted text is not stored in the bridge database. When a user explicitly saves a review, the redacted structured JSON report is written to that user's own Nextcloud workspace. The user controls that file through Nextcloud.

5. Purposes and legal bases

• provide the requested account connection and file tools under the service terms (GDPR Article 6(1)(b));
• protect tenants, credentials, infrastructure, and the project from abuse and security incidents (Article 6(1)(f)); and
• comply with binding legal obligations where they apply (Article 6(1)(c)).

The app does not make a solely automated decision with legal or similarly significant effects. Invoice checks are decision support for a human user.

6. Retention and deletion

• Pending Login Flows expire after 20 minutes. Maintenance checks for expired flows every five minutes.
• Connection metadata and its encrypted app password remain until the user disconnects, the account is deleted, or retention is no longer necessary.
• Disconnect removes local connection data and attempts to revoke the generated app password at Nextcloud. Orphaned encrypted records are removed after a one-hour recovery grace period, with maintenance checks every five minutes.
• Saved review reports remain in the user's Nextcloud until the user or Nextcloud administrator deletes them.

Daily encrypted backups of the bridge databases and recovery files are kept for 30 days on the German hosting VM. They are not yet copied to another host. Infrastructure and container security logs are kept in the VM's system journal, which has a seven-day retention limit and a 256 MB persistent size cap.

7. Recipients and transfers

Data is sent only where needed to the user's Nextcloud, the user's selected OpenAI product, the self-hosted OAuth provider, and infrastructure providers operating the service. ASS Werbe GmbH hosts the bridge and OAuth provider in Germany. The website is delivered through OpenAI Sites on Cloudflare infrastructure. No personal data is sold. Any applicable international-transfer safeguards for those external services remain a public-launch disclosure gate.

8. Your choices and rights

Users can change the workspace root, disconnect Nextcloud, delete saved reports in Nextcloud, and revoke the bridge app password from Nextcloud security settings. Depending on applicable law, users may also request access, correction, deletion, restriction, portability, or object to processing, and may complain to their competent data protection authority.

Contact info@asswerbe.de for privacy requests. Identity may need to be verified before account data is disclosed or deleted.

9. Security and changes

Security measures include OAuth verification, request-scoped tenant context, encrypted credentials, root-bound paths, transfer limits, network egress policy, rate limits, and secret-free application responses. No system is risk-free. Material changes to this notice will receive a new date and will be shown before continued hosted use where required.