Catalog privacy
Anonymous operational task totals
We are changing the former optional counters to automatic, server-side operational totals across our ChatGPT/MCP apps. The update is prospective: collection remains staged until all app definitions and owner reporting are updated, then starts at the rollout activation time shown in the private collection-status record. Earlier optional counts started on 27 October 2026 and are not complete historical usage. There is no login requirement, analytics cookie, added browser storage, visitor identifier or tracking script for these counters.
After activation, an ordinary task call automatically adds only the fixed app name, fixed tool name, UTC calendar day and aggregate numbers of requests, successful results, completed server tasks and failures in our EU-jurisdiction Cloudflare D1 database. Customer inputs, outputs, files, names, contacts, IP addresses, account/session/conversation IDs, fingerprints and individual event histories are not saved in these counters. We do not join them with provider access records or identify individuals. The totals measure non-test task activity, not unique people or verified human customers. Unmarked automated requests cannot always be distinguished from people.
You can ask the assistant not to count a task: usageTracking="off" is always honoured, as are Global Privacy Control and Do Not Track request headers when supplied. The task remains fully usable. The default mode is automatic; the older explicit anonymous choice remains compatible. Developers and reviewers must use test. Test headers/metadata, known internal agents, known fictional fixture inputs, discovery requests and static page requests are excluded. Fixture comparisons are transient; no customer-input hash is stored. Arbitrary new tests must be explicitly marked.
A completed server task means a valid result from a final task tool, not a verified download, job application, booking, purchase or other real-world outcome. Preparation-only tools are separate. Daily aggregates expire after 30 UTC calendar days through write-time pruning and daily maintenance. D1 Free recovery copies follow Cloudflare's separate controls. Only our existing Cloudflare account can inspect totals; no new analytics vendor, advertising service or AI model receives them.
Collection accepts at most 5,000 non-test calls per UTC day across these apps. The account stays on Workers Free with hard provider quotas; collection can stop at a cap, quota or storage failure while the task remains available. The counter cap or D1 failure does not block the task; the separate Workers request/CPU limit can stop the app itself. Counts can therefore be incomplete. Anonymous contributions cannot be retrieved or erased by person because no person identifier is kept. Existing website consent-based statistics, support records and normal provider connection processing remain governed by their separate notices.
Updated 20 October 2026
DUOPORE VENTURES PTE. LTD.
Private Company Limited by Shares, Singapore · Director: Christoph Kaesler
68 CIRCULAR ROAD #02, unit no. 001, Singapore 049422
Register: Accounting and Corporate Regulatory Authority (ACRA), Singapore
UEN: 202628284M (company registration number; not a VAT ID)
Email: ch.kae88@gmail.com · Phone: +49 1567 9820108
Catalog: selected product data only
The hosted tools receive selected supplier column names, mappings and product cells to suggest a mapping or return a basic catalog check. They process those inputs transiently; there is no database of user inputs, product upload store or request-body logging. Do not send customer records, seller credentials, private account links or unnecessary personal data.
The linked standalone Catalog website opens CSV/Excel files locally in your browser and creates local downloads; that workflow does not upload your file to this server. Saved mappings on that separate website use its disclosed local storage. Its privacy notice describes that feature. No seller account is connected and no marketplace listing is published here.
Minimise before sending
ChatGPT may select relevant conversation or enabled-memory information as tool inputs. Our schemas request task fields, not an entire chat or personal profile. The deterministic privacy boundary rejects some explicit private-context and credential patterns, but it cannot undo a client's transmission or detect every sensitive fact in ordinary prose. Review what you send; do not interpret this as a zero-information-sharing promise. Do not use these general tools for sensitive third-party datasets or child profiles. A browser assistant you authorise can also read information visible on the page.
Purposes and legal bases
Inputs are used for your requested calculation or draft, support and proportionate security. Where GDPR applies, an individual's requested service uses Article 6(1)(b); company-contact support and business administration use Article 6(1)(f), with the interest of responding to and managing that request. Security/availability use Article 6(1)(f) to protect the service and its users. Applicable EU or Member State recordkeeping obligations use Article 6(1)(c). This tool does not enroll you in marketing or rely on blanket consent for unrelated purposes.
Recipients and international processing
Cloudflare Workers hosts this public tool service. Cloudflare and network providers receive necessary technical connection information, such as IP address, route, time and request headers, for delivery and security. This application's lack of input storage does not mean providers keep no technical logs. See Cloudflare's privacy notice, customer DPA and subprocessor information.
ChatGPT/OpenAI or your chosen MCP host separately handles conversations, tool history, account settings and any exported files under its terms. See OpenAI's privacy policy. Linked standalone websites have their own providers and notices. Emails you choose to send to our Gmail address are processed through Google's email service under its applicable terms and privacy policy.
DUOPORE operates in Singapore, which has no general EU adequacy decision. Provider processing may occur in the United States and other countries. Cloudflare's incorporated DPA describes safeguards, including standard contractual clauses, for processing within its scope; it does not automatically establish every transfer by DUOPORE. Applicable EEA and Singapore transfer requirements must be met for the actual processing. Contact us for the safeguards relevant to your request or an available copy with unrelated confidential information removed. No customer source-file transfer agreement is created by using this page.
Retention and required fields
The stateless application does not deliberately retain inputs after the request. Working browser data clears with the page's controls or closure; local downloads remain until you remove them. Provider logs and your host's records follow their separate terms and controls. Support emails are retained while needed to handle the request, document its resolution, establish or defend a specific claim, or meet an applicable legal duty, then deleted or anonymised when those reasons end. We do not promise a provider deletion period we cannot control.
Inputs are voluntary and not required just to read this notice. A calculation cannot complete without its stated required fields; you may stop instead of supplying them. Contact details are needed only for a personal support reply. No automated hiring, housing, admission, credit or other eligibility decision is made by this service.
Privacy contacts
DUOPORE is the controller for its service and support processing described here. Singapore PDPA data protection officer: Christoph Kaesler, at the business address and email above. This role does not itself appoint a GDPR DPO.
EU representative under Article 27 GDPR: Kristina Liney, Burchardstraße 4, 18233 Neubukow, Germany. Contact by post there, or email the operator marked “For the EU representative” for routing. The roles are separate.
Your rights
Contact the operator or EU representative to request access, correction, erasure, restriction or a portable copy where the applicable law provides that right. You may object to processing based on legitimate interests. Consent, where used, can be withdrawn for future processing without affecting earlier lawful processing. Singapore PDPA also provides applicable access, correction and consent-withdrawal rights. Legal conditions and exceptions apply.
Identify the service and record with minimum information; do not send a passport or card copy by default. Where GDPR applies we respond without undue delay, normally within one month, and explain any permitted extension within that month. We handle other requests within the applicable statutory requirements. You may complain to a competent EEA authority where you live, work or where the alleged infringement occurred, or Singapore's PDPC. An operator request does not automatically delete copies on your device, in ChatGPT or at an independent provider.