The connector receives only the tool parameters needed for the JamStation operations you explicitly request. It does not read your full ChatGPT conversation history.
We do not sell personal data obtained through this Plugin or use it to build cross-service advertising or behavioral profiles.
You can revoke the connection in ChatGPT, relink a store, or contact JamStation to request access, correction, cessation of use, or deletion of data.
1. Scope and service provider
This notice is provided by JamStation ("we") and supplements the data-processing information for the JamStation ChatGPT Plugin and its MCP connector. Read it together with the JamStation Privacy Policy.
OpenAI is responsible for messages you enter in ChatGPT and ChatGPT's own data processing under its applicable policies. This connector receives only tool names, necessary parameters, and OAuth authorization information sent by ChatGPT for the JamStation functions you select. It does not request or reconstruct your full conversation history.
2. Data we collect or process
| Data category | Examples | Source |
|---|---|---|
| Account and store linking data | JamStation main account, store identifier, sub-account, and store display name | Provided by you during OAuth linking or obtained from JamStation sign-in results |
| Authentication and authorization data | Browser-hashed passwords/PINs, JamStation access tokens, OAuth clients, scopes, token hashes, and expiration times | You, the ChatGPT OAuth client, and JamStation authentication services |
| Tool operation data | Business information, playlists, volume, ad copy, voice selections, schedules, and distribution settings you request to query or change | Sent by ChatGPT under your instructions or returned by JamStation APIs |
| Operation audit data | Tool names, success/failure results, store identifiers, and operation timestamps | Generated by the MCP connector during tool execution |
| Necessary technical data | Temporary session cookies, pending OAuth state, and IP addresses used for rate limiting | Your browser, network requests, and OAuth flows |
We do not ask you to provide passwords, PINs, API keys, MFA/OTP codes, or payment card information in ChatGPT conversations or MCP tool fields.
The JamStation sign-in page hashes passwords and PINs in your browser before sending them to the connector for encrypted storage. Do not paste these secrets into conversations.
3. Purposes of processing
- Authenticate your JamStation account and limit ChatGPT authorization to the single store you select.
- Query or manage business data, playlists, ad assets, in-store/cross-store distribution, volume, and playback schedules as you request.
- Maintain OAuth sessions, refresh access tokens, check permissions, and prevent unauthorized use.
- Provide rate limiting, anomaly detection, auditing, debugging, and service security maintenance.
- When you request AI ad copy, send business style, promotion content, and, in certain modes, the store name and city/district to JamStation's configured copy-generation service, and retain input/result summaries as usage records.
We do not use data collected by this Plugin for marketing unrelated to these purposes or to build cross-service behavioral profiles.
5. Data retention
| Data | Typical retention |
|---|---|
| OAuth pending authorization | 10 minutes by default; deleted by periodic cleanup after expiration |
| OAuth authorization code | 5 minutes by default; cannot be reused after redemption; deleted by periodic cleanup after expiration |
| OAuth access token records | 1 hour by default; only token hashes are stored in the database; deleted by periodic cleanup after expiration or revocation |
| OAuth refresh token records | Up to 30 days by default; only token hashes are stored in the database; deleted by periodic cleanup after expiration, rotation, or revocation |
| Sign-in/linking cookies | Up to 30 days, or invalidated earlier when you sign out or clear cookies |
| IP rate-limit buckets | Stored only in service memory for approximately 1 minute to 1 hour depending on the endpoint; not written to the account database |
| Account links, encrypted credentials, and audit records | Retained as needed to provide linking services and maintain security. Relinking replaces old store credentials; you may also request deletion. |
| JamStation member, asset, and schedule data | Retained according to your JamStation account lifecycle, service agreement, legal obligations, and JamStation's general Privacy Policy |
If security incidents, dispute resolution, or legal obligations require longer retention, we retain data only to the extent necessary and delete or de-identify it when the purpose no longer applies.
6. Your controls and data rights
- You can revoke the JamStation connection in ChatGPT Plugin/connector settings to stop subsequent OAuth access.
- You can select a different store through JamStation linking. Completing relinking replaces the old store credentials.
- You can decline confirmation before any write, deletion, ad generation, or cross-store distribution. The operation should not proceed without confirmation.
- You may request access, inspection, copies, supplementation, correction, cessation of collection/processing/use, or deletion of personal data related to this Plugin.
Revoking the ChatGPT connection stops new requests but does not immediately delete existing JamStation member data or records retained by law. To request deletion, contact us below; we may need to verify your identity first.
7. Security measures
- Production uses HTTPS. OAuth uses authorization codes, PKCE S256, restricted redirect URIs, and resource audiences.
- JamStation passwords and PINs are hashed in the browser and encrypted server-side with AES-256-GCM.
- OAuth access/refresh tokens are stored in the database only as irreversible hashes.
- Scopes separate read and write permissions. Rate limits, expiration, revocation, and periodic cleanup reduce abuse risk.
No security measure guarantees absolute security. If you suspect unauthorized account or connection use, revoke the connection immediately and contact us.
8. Children
This Plugin is intended for business and store management, not children under 13. We do not knowingly collect personal data from children under 13 through this Plugin.
9. Updates to this notice
We may update this notice as features, data flows, or laws change. We will publish a new effective date on this page and provide appropriate notice of material changes as required by applicable law.
10. Contact us
For questions about this notice or personal data processing, or to exercise your data rights, contact JamStation:
Privacy/legal: legal@jamstation.ai
Customer support: contact@jamstation.ai