Privacy Policy

Controller and contact

Max Benz, Am hohen Stein 36a, 01189 Dresden, Germany. Contact: team@thegtmlead.com.

Account and early access

Sign-in uses a single-use email code delivered through SendGrid. We store your verified email address, optional display name, membership and access-code redemption. Session secrets and MCP keys are stored as hashes; verification codes are protected with a server-side HMAC key. No ChatGPT account is required.

Workspace records

We process the applications, software costs, seat counts, requests, offers, documents, comments, notifications and review history you add. Your workspace owner assigns roles and decides who can access this data. For company data supplied by customers, the customer determines the purposes of processing.

Hosting and storage

This installation is deployed through OpenAI Sites on Cloudflare Workers. Structured records are stored in Cloudflare D1 and uploaded documents in R2. Hosting providers process technical request data such as IP address, requested URL, timestamps and response status to deliver and secure the service. Providers may process data in countries outside your own jurisdiction under their applicable service and data-processing terms.

Email and connected assistants

Login codes use SendGrid. Workspace or product operators can configure Resend to deliver invitations, test messages and opted-in reminders. Email recipients receive the relevant invitation or reminder content. Keys are encrypted server-side. If you connect an AI assistant through the product’s MCP tools, the data that the assistant requests is shared with that assistant’s provider under your agreement with that provider.

Cookies and browser storage

Authentication uses an essential HTTP-only session cookie, secure on HTTPS, that expires after 14 days. You can revoke all sessions and MCP keys in Settings. The app stores your workspace selection as a device preference. The demo stores only its demo records in browser local storage. This release adds no marketing analytics, advertising pixels or external font requests.

Purpose and legal basis

Account and workspace data are processed to provide the requested service and collaboration features. Technical security records support reliable operation. Applicable legal bases include performance of a contract or steps before entering a contract and legitimate interests in secure service delivery. Optional reminder preferences can be changed in the app.

Retention, exports and deletion

Active workspaces retain their data while you use the service. Archived records remain recoverable. Workspace archiving ends normal access and does not immediately erase all stored records. You may export your records and request permanent erasure at the contact above; statutory retention duties may apply. Invitation tokens expire after seven days. Successfully delivered email bodies are removed from the application outbox.

Your rights

You may request access, correction, erasure, restriction and portability of your personal data and exercise applicable objection rights. Contact the controller above. You may also complain to your competent data-protection authority; the operator is based in Saxony, Germany.