Site.nu CRM Copilot privacy notice

Site.nu is the controller for Site.nu CRM Copilot. Site.nu is established at Bos en Lommerplantsoen 1, 1055AD Amsterdam, the Netherlands, and is registered with the Dutch Chamber of Commerce under number 98687565. Its VAT number is 98687565.

This notice applies when you connect and use Site.nu CRM Copilot as a plugin in ChatGPT. The app is read-only: it cannot create, change, delete, send, publish, or activate CRM data.

The app processes only data from the connected Site.nu workspace that is needed for the read you requested and that your Site.nu account is permitted to access.

• OAuth references to the Site.nu user and workspace, the granted scope, and technical client-registration data.
• Tool parameters such as object name, requested fields, filters, sorting, date range, limit, and necessary record, dashboard, widget, Campaign, Form, or Workflow identifiers.
• CRM names, job titles, business statuses, stages and sources, and requested company, opportunity, and task data.
• Dashboards and selected widget data.
• Aggregate Website Analytics without visitor or session identities.
• Campaign content and settings, aggregate delivery and engagement analytics, and aggregate audience information, without recipient lists.
• Form and Workflow configuration, without submissions, notification recipients, or secret step settings.
• Timestamps needed for a requested date range, sorting, or a creation or update question.
• Limited operational security metadata such as tool name and category, outcome, duration, IP address, browser/client type, and an error category or correlation code.

• Passwords, OAuth tokens, cookies, API keys, or other credentials.
• Recipient email lists or individual Campaign delivery and engagement events.
• Your complete ChatGPT conversation history; Site.nu receives only the tool call ChatGPT makes on your behalf.
• Website visitor identities or individual Website Analytics sessions.
• Debug payloads, request identifiers, diagnostics, telemetry, or raw error payloads.
• Tool arguments, CRM values, or tool result bodies in operational application logs.
• Third-party analytics in the widget; the widget makes no network requests and sets no tracking cookies.

• Authentication, consent, and enforcement of workspace and field permissions.
• Executing the read you requested and returning an answer or explicitly requested widget.
• Security, abuse prevention, troubleshooting, and support.
• Compliance with legal obligations and valid legal requests.

We process this data to perform the Site.nu service and the action you requested, for our legitimate interests in providing a secure and reliable service, and where applicable to meet legal obligations.

OpenAI/ChatGPT receives the minimized Site.nu tool result because you selected ChatGPT as the client. OpenAI processes that data further under its own privacy terms, product settings, and contracts.

Carefully selected providers for hosting, databases, object storage, content delivery, security monitoring, and support may also process data for Site.nu. They may use it only to provide the agreed service and are contractually bound to security and confidentiality. Competent authorities receive data only where legally required.

Where data is processed outside the European Economic Area, we use a valid transfer mechanism such as an adequacy decision or the European Commission's Standard Contractual Clauses, with supplementary safeguards where needed.

• OAuth authorization codes: no more than 10 minutes and single use.
• OAuth access tokens: no more than 1 hour.
• OAuth refresh tokens: no more than 30 days and rotated on use.
• OAuth consent grant: until you disconnect or revoke access; we then delete the corresponding refresh-token family and stored grant. An access token already issued may remain valid for up to 1 hour.
• Dynamic OAuth client registrations: no more than 10 years unless they expire or are deleted earlier.
• Operational security events and application error reports: no more than 90 days.
• Support correspondence: no more than 24 months after the request is closed, unless a legal retention duty requires longer.
• Backups: at least 7 daily, 4 weekly, and 3 monthly recovery points; older recovery points are overwritten by rotation.

Source CRM data remains in the Site.nu workspace under the customer's instructions and retention settings. CRM Copilot does not create a separate persistent copy of tool results.

• Disconnect Site.nu in ChatGPT's connected-app settings to stop future access.
• A workspace administrator can change or revoke Site.nu membership, role, and field permissions.
• You may request access, correction, deletion, restriction, objection, or portability for personal data.
• You may complain to the Dutch Data Protection Authority or another competent supervisory authority.

Send privacy and export requests to support@site.nu and identify the relevant workspace. We acknowledge requests and normally respond within one month; complex requests may be extended as allowed by the GDPR.

Site.nu does not use CRM data retrieved through CRM Copilot to train its own AI models or build advertising profiles. OpenAI independently determines how ChatGPT data is used based on its terms, account type, and your settings.

We use encryption in transit, workspace and field-level access control, short token lifetimes, bounded responses, output filters, security monitoring, and backups. No security measure can eliminate every risk.

This notice is effective 26 July 2026. We publish material changes on this page and, where appropriate, notify users in the product or through the available contact channel.