Effective 29 October 2026. This notice applies specifically to the POSMENTOR ChatGPT connection.
Who we are
Ahmet Baltacı, a sole trader trading as POSMENTOR, 432 St Anns Road, London, N15 3JJ, United Kingdom. Contact hello@posmentor.com.
Our role and purposes
We control the processing of administrator account, connection-security and support information needed to provide and protect this service. We use contract necessity where you are our customer, legitimate interests in secure administration and support where you act for a restaurant, and legal obligations where applicable. The restaurant determines the purposes of its staff and business records; we process those records on its instructions to provide POSMENTOR. Authorizing a connection instructs us to disclose the requested, permitted results to your ChatGPT account. OAuth permission is a technical access authorization, not a blanket consent to unrelated processing.
Information processed
Sign-in uses your email and password to authenticate with POSMENTOR. The MCP service does not store your sign-in password or send it to ChatGPT. It stores encrypted authorization grants and upstream sessions, hashed token identifiers, client details, permissions and expiry information. Browser security checks use a secure connection cookie. Infrastructure may process IP addresses and request metadata for security.
Depending on the tool and permissions, results include administrator name, restaurant identity, currency, sales aggregates, product names and prices, product groups, rooms, tables and open-order lines. The connection does not provide customer-contact exports or card details. Prepared changes and confirmations include the relevant account/user binding, proposed change, timestamps, result and audit information. Do not put passwords, card details or unnecessary personal information in prompts or product descriptions.
Recipients and locations
Results you request are sent to OpenAI through your ChatGPT connection and are then subject to your OpenAI account arrangements and OpenAI privacy policy. Disconnecting POSMENTOR does not delete your ChatGPT conversations. Authorized POSMENTOR operators and infrastructure providers process information as needed to run and secure the service; the MCP application host uses Vultr. We may disclose information when legally required.
The operator's primary service storage is in England. This does not promise that every recipient, support operation or backup is UK-only. OpenAI processing may involve other countries. Contact us for details relevant to your account before sending data subject to residency restrictions. Where we arrange restricted international transfers, applicable safeguards or a lawful exception are required; this notice does not assert certification or an unverified transfer agreement.
Retention and deletion
- Connection grants expire after at most seven days. Access tokens last at most one hour within that grant. Expired records in the MCP operational store are pruned at startup and approximately every minute while the service runs.
- Write previews expire after ten minutes. Expiry stops their use; it does not delete the API audit record.
- Product, group and order records remain part of the restaurant account until removed under its account-management and retention instructions. Disconnecting does not cancel an order or delete business records.
- Action/replay records are retained to establish what was authorized, prevent duplicate operations and investigate disputes. They are not automatically deleted when a preview expires. Removal requests are assessed against those purposes and any applicable legal hold; missing action records must never authorize a repeat write.
- MCP application logs rotate by size (up to three 5 MB files), not a guaranteed number of days. Proxy logs, support records and encrypted recovery backups have separate operational lifetimes. We retain them only while needed for security, recovery, support or legal obligations. A deletion request includes review of these copies; expired authorization cannot be made valid by restoring an old backup.
We do not promise that OAuth expiry erases every backup or accounting record. Retention decisions consider the account's status, outstanding support/security incidents, recovery needs, restaurant instructions and applicable record-keeping obligations. Requests requiring manual review are handled through the contact below.
Your choices and rights
You can disconnect in ChatGPT and ask POSMENTOR to revoke server-side access. To request access, correction, deletion, restriction, portability or to object to relevant processing, email hello@posmentor.com. We may request proportionate proof of identity and authority over the restaurant. Requests about restaurant-controlled records may need to be handled with that restaurant. We respond within the applicable legal timeframe and explain any lawful restriction or extension. You may complain to the UK Information Commissioner's Office or your competent local authority.
Security and changes
HTTPS, encrypted grant storage, OAuth PKCE, restricted callbacks, per-request account checks and confirmation-bound writes protect the connection. The service does not make eligibility decisions about individuals. We update this notice when its practices change; material changes will be communicated through an appropriate account or service channel.