Privacyboard
Start free

AI assistants and your data

Last updated 4 November 2026

Privacyboard lets you connect an AI assistant, such as Claude or ChatGPT, to your workspaces through a connector (an MCP server at https://privacyboard.io/mcp). This page explains what the connector shares, what it never shares, what it can change and how to stop it. It completes our privacy center and our terms of use.

1. Who decides

You choose to connect an assistant, which workspaces it can read and whether it may make changes. For the records in your workspace you remain the controller, and Privacyboard processes them on your behalf, as for the rest of the service. The company that provides the assistant receives what the assistant reads, under its own terms and privacy policy, because you chose to use it. Check those terms, for example whether conversations are used to train models, before you connect it.

2. What the assistant can read

  • Your compliance status and what needs attention.
  • Privacy requests: their reference, the right and law concerned, dates, status and legal deadline, and your own reply templates.
  • Vendors, the processing register, impact assessments and the validated text of your documents.
  • Incidents: title, dates, nature, data and people concerned, risk level and notification decisions.
  • Your cookie banner: declared services and consent totals (rates by period, region and banner version).

3. What it never receives

  • Who sent a privacy request, what they wrote and the emails exchanged with them.
  • The description, consequences, measures and notes of an incident.
  • Any visitor’s own cookie choice or identifier: only totals.
  • Your team, billing, notification addresses, settings and internal notes.

These limits are enforced in our database, before anything is sent, not by the assistant.

4. Changes, only if you allow them

By default the connector only reads. When you connect, you can tick “Also allow a few changes”. The assistant can then, after asking you, set a privacy request to In progress or Awaiting identity, complete a vendor or a processing activity, or record a new incident as a draft. Changes need the editor role or above in the workspace. It can never send an email or a reply, delete anything, or change documents, settings, the team or billing. Each change is checked like a change made in the app, appears in the workspace’s activity, and comes back with the previous values so it can be undone.

5. What we keep

  • The connection: which app, who approved it, for which workspaces, whether changes are allowed, when it was created and last used. Access tokens last one hour and renewal tokens 30 days; we store only a fingerprint (a SHA-256 hash) of each, never the token itself.
  • The activity log: one line per assistant and per day listing what it read, and one line per change. It is kept 13 months, or 3 years on the Business plan, like the rest of the activity log.
  • We do not keep the questions you ask the assistant, nor its answers: they stay with the assistant’s provider.

6. Security

  • Each person approves the connection on Privacyboard, signed in and, when they use it, after two-step verification. The connection screen shows who publishes the app and where it will send you back.
  • The sign-in flow uses OAuth 2.1 with PKCE. A token works only for this connector and cannot be used against our database.
  • Every call checks the connection, the person’s membership, their role for changes and the workspace’s plan. A connection stops when the person leaves the workspace, when it is disconnected, or when an old token is reused. It pauses while the workspace is not on a plan that includes it.
  • Calls are limited to 200 every 10 minutes per connection.

7. How to stop it

Disconnect the assistant in Settings → Connectors: it stops at once. Owners and admins can disconnect anyone’s connection to their workspace. You can also remove the connector in the assistant itself.

8. Questions

Write to hello@privacyboard.io. See also the guide Connect an AI assistant.