ToolScout AI plugin privacy

Effective 25 October 2026. This notice applies specifically to ToolScout's read-only software-decision MCP integration used through ChatGPT and other AI clients. Our separate website privacy notice covers visitors who independently open ToolScout web pages.

Data received and purpose

The AI client sends only the task-related information included in a tool call, which may include software names, business requirements, budget, country, number of seats, and names of tools already in use. Free-text requirements may contain personal data if a user chooses to enter it. ToolScout uses this input only to retrieve and assess software fit, evidence, plan restrictions and trade-offs. The plugin does not request credentials, payment card data, health data or a ToolScout account.

Who processes it

OpenAI or another AI client processes the conversation under its own policy and sends the selected tool-call arguments to ToolScout. Cloudflare provides the ToolScout endpoint, edge delivery and database hosting, and therefore processes requests on our behalf. ToolScout's MCP responses are returned to the requesting AI client. No tool-call body is deliberately sent to Google Analytics or software vendors. Following an external product link is a separate action governed by that website's terms; any disclosed affiliate referral goes through ToolScout's commercial redirect route.

Storage and retention

ToolScout processes MCP request inputs transiently to generate the response, without intentionally storing prompt text, request bodies, AI account identifiers or session identifiers in its application database. Accordingly, the retention period for stored MCP request content in ToolScout's database is zero days. No browser-tracking cookie is issued by the MCP endpoint. Cloudflare may process technical connection information during delivery under its own security and infrastructure retention arrangements. Separately, non-MCP A2A requests can generate limited protocol-operation metadata (operation, client software, outcome and timestamp), without request text; ToolScout's daily D1 cleanup deletes these operational entries after 30 days, subject to bounded cleanup cycles. To measure usage, ToolScout also keeps daily aggregate counts of MCP tool calls and A2A decision requests: per day, protocol, tool and AI client (the assistant family, or the product name the client software sends), with the number of calls and errors. These counts contain no request text, arguments, IP address, AI account identifier or session identifier, and are deleted after 25 months.

Analytics and links

Google Analytics is used only on the public ToolScout website after a visitor grants site analytics consent; it is not used to record this MCP tool request. Its website-specific settings and retention are covered separately in the website notice. Clicks on a ToolScout referral link may be logged for commercial attribution under that notice.

Controls and requests

There is no required plugin login or ToolScout user profile to delete. Avoid including personal or sensitive information in business software requests. For access, correction, objection or deletion requests concerning data ToolScout controls, email pedro@trytoolscout.org; we will assess them under applicable law. Requests involving ChatGPT conversation history must be handled through the AI provider's controls. ToolScout does not sell users' conversations to advertisers.