Privacy Policy — How CNXT handles data

1. Information we collect

• Account information you provide: name, contact details, and credentials.
• Transaction data: orders, settlement records, and wallet activity.
• Usage data: how you navigate the network, used to operate and improve it.
• Visit measurement: CNXT's own first-party funnel records one visit per browser session under an anonymous session key your browser generates, the first-touch campaign tags (utm_source / utm_medium / utm_campaign) you arrived with, the referring site reduced to its hostname, and the landing page reduced to its first path segment. Section 12 states exactly what is kept, who can read it, and how it is deleted.
• Catalog search: searches on the /s search page are answered by Vertex AI Search for commerce, a Google Cloud service (Google LLC). CNXT's server sends Google the words you searched and, so Google can rank the catalog by what shoppers open and choose, which catalog products a search showed, the product pages you open, your add-to-cart presses, and your wallet purchases of an edition (its catalog id, amount, currency and an order reference). These events are tied to a one-way hash of the anonymous session key described above — never the key itself, your name, email address or account. They are sent from CNXT's server, so Google does not receive your IP address or browser details with them.
• Site analytics: CNXT web pages carry Google Analytics (Google LLC), which sets first-party _ga cookies and reports page views and a small set of named events — such as a press on the Add to Chrome link for $://THeXTeNSioN — to Google Analytics properties CNXT operates: one for the site as a whole, and a second one that receives only the $://THeXTeNSioN pages (the landing page and the mining console). In the EEA, the UK and Switzerland the tag defaults to its cookieless, consent-denied mode. When CNXT's Google Ads conversion measurement is switched on, the same tag also reports three events to Google Ads (Google LLC) — an account opened, a checkout started, and a purchase completed (with its amount, currency and an order reference) — together with the ad-click identifier (gclid, gbraid or wbraid) of a visit that arrived from a Google ad, kept in your browser for that session so Google can attribute the event to the ad. The same regional consent defaults apply. The browser extension itself carries no analytics.
• Optional Google connection: if you choose Connect Google in CNXTCLOUD, we receive Google account identity and authorization data and, only with separate project consent, Google Cloud project metadata. This is not Google Analytics. Sections 9–11 explain this connection's narrower purposes, storage, sharing and deletion rules.
• Device and security signals needed to keep your account safe.
• A referral marker when you arrive through a partner link, set as a cookie by our affiliate-attribution provider so the referring partner can be credited.

2. How we use it

We use your information to operate the network: fulfill orders, settle payments, resolve identities, prevent fraud, provide support, and personalize what you see. We do not sell your personal information.

Google account and project data received through Connect Google is not used for these general network purposes; its use is limited to the connection and project features and the security and legal exceptions in sections 9–11.

3. The identity layer

CNXT anchors entities — products, datasets, apps — to canonical GTIN identities. This identity graph describes things, not people. Your personal data is held separately and is never minted into a public identity anchor.

4. Sharing

The following describes network data generally. Google account and project data received through Connect Google is governed instead by the narrower sharing and Limited Use rules in section 11.

• With sellers and Hubs only as needed to fulfill your orders.
• With service providers bound by confidentiality and data-protection terms.
• With our affiliate-attribution provider (PromoteKit): if you arrived through a partner link, your account email is shared after sign-in so the referring partner is credited for your sign-up and qualifying purchases.
• With our site-analytics provider (Google Analytics, Google LLC): page views and named events from CNXT web pages, under Google's data-processing terms. IP addresses are not logged or stored by Google Analytics 4. You can opt out with the Google Analytics opt-out browser add-on or by blocking the tag; the network works the same either way. With Google Ads (Google LLC), when conversion measurement is switched on: the three conversion events and ad-click identifier described above, under Google's data-processing terms; blocking the tag stops them too.
• When required by law or to protect the network and its users.

5. Your controls

• Access, correct, or export your data from Your Account.
• Request deletion, subject to records we must retain by law.
• Manage communication and personalization preferences at any time.

6. Retention & security

We keep personal data only as long as needed for the purposes above or as required by law, and we protect it with encryption in transit and at rest, access controls, and continuous monitoring.

7. THeoPeNAiDesK CNXTioNPaRTNeR — the ChatGPT connector

THeoPeNAiDesK CNXTioNPaRTNeR is CNXT's connector for ChatGPT: a Model Context Protocol resource served by this network at https://centralbanks.app/api/theopenaidesk/gptx, with CNXT itself as the OAuth authorization server. When you use it, your prompt and the tool call ChatGPT derives from it pass through OpenAI first — OpenAI's own terms and privacy policy govern that leg; CNXT receives the tool call, not your conversation.

Anonymous read tools process only the query or identifier needed to answer: curated public knowledge, the public machine census and network status, offer information, profitability scenarios, launch requirements, and public network discovery. Nothing from an anonymous read is stored against a person.

OAuth-scoped tools process: the access token in memory for authorization; the token's issuer, audience, lifetime, signature, subject, and scopes for verification; a keyed pseudonymous actor identifier derived from issuer and subject; and, for a connection request, its category, summary, requested items, approved HTTPS endpoint descriptions, optional opaque external reference, and idempotency key — together with timestamps, status, a payload hash, and a hash-chained audit event. The connector is designed not to store the access token or the raw OAuth subject.

Draftroom tools (available only where CNXT is the authorization server) additionally process, for the CNXT account behind the token, the campaign brief you give, the caller-supplied idempotency key, the generated copy and render references, allowance and spend accounting, and the network's policy decision. These are stored by CNXT Draftroom under that account exactly as a signed-in studio session would store them, and are readable back only by the same account.

• Do not send names, emails, phone numbers, payment-card or bank data, government identifiers, passwords, API keys, bearer tokens, OAuth client secrets, access or refresh tokens, MPP credentials, private agreements, signatures, medical information, or other sensitive personal data through the connector. Likely secrets and personal contact details are rejected automatically; automated detection is not a guarantee.
• Retention: connection-request content is kept for 365 days unless a different period is published on this page. Once a request is older than that, a bounded sweep — run at the next intake write or on operator demand — redacts its content (summary, requested items, endpoint descriptions, external reference) while the audit chain, which holds hashes and never content, keeps verifying. Idempotency records are keyed hashes and carry no content.
• Deletion: ask through Your Account or the Support page; the privacy team at $://THeCeNTRaLDesK actions it. What is removed is the request content and Draftroom drafts held under your account. What survives, and why: audit-chain entries (integrity hashes carrying no content) and any settlement entries, which are financial records the network has to keep.
• Money: the connector never creates a checkout, mints a payment credential, or moves treasury funds, and Stripe is not a processor for it. Where a deployment serves the premium dataset read, it debits the caller's own CNXT wallet at the per-call price disclosed before the call and appears in that wallet's own records; the connector as submitted to ChatGPT does not serve it.
• Security, as built: HTTPS only; OAuth resource and audience binding; token signature and lifetime validation; least-privilege scopes; principal pseudonymization; explicit write confirmation; idempotency; HMAC audit chaining; secret and personal-data rejection; HTTPS-only endpoint descriptions; output redaction; and strict separation from financial execution. No security measure is absolute.

8. Text messages from the CNXT desk line

$://THeCeNTRaLDesK operates a phone line, +1 (650) 307-5424, that receives calls and — once US carrier (10DLC) registration of the line completes — sends text replies. Texts are sent only to a mobile number whose holder opted in by submitting the consent form at /texts: an unchecked box with the full consent statement, recorded with the statement's version as displayed, the time, the page it came from, a keyed pseudonym of the submitting address, and the browser identifier. A submission made against a superseded statement is refused, not recorded.

What we send: replies to your own requests, the specific links you asked for, receipts for your own transactions, and notices about your own account. We do not send marketing campaigns or broadcast texts, and we do not text numbers from purchased, shared, or scraped lists.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile numbers and text-messaging opt-in data are used only to deliver the messages described above and are processed by the telephony provider that carries the line, bound by its own confidentiality and data-protection terms. The consent record itself is kept as an append-only ledger — each opt-in and each opt-out is a new entry, never an edit — for as long as needed to prove consent under applicable law.

Opting out: reply STOP to any message, or use the unsubscribe form at /texts; reply HELP for help. A stop request is recorded the same way the consent was, and every send is checked against the newest record for the number before it leaves — an opt-out, or no record at all, refuses the message. The line does not send at all until its inbound STOP/HELP handler is connected; the /texts page shows that state. Message frequency varies and message and data rates may apply. Consent to texts is never a condition of any purchase.

Texts from the desk line — opt in, opt outSupport

9. Connect Google — data access and use

Connect Google is an optional feature in CNXTCLOUD. It associates a Google account with your existing CNXT account; this connection is separate from CNXT sign-in. It is separate from the Google Analytics site measurement described above. Connecting an account does not itself grant Google Cloud project access.

• Account identity and permissions: the initial connection requests openid and https://www.googleapis.com/auth/userinfo.email. CNXT verifies Google's account identifier (the subject, or sub) and verified email address to identify and display your connected account. We store the requested scopes and Google's reported granted scopes separately; a missing or partial grant is not treated as permission you gave.
• Optional project access: choosing Enable project access requests https://www.googleapis.com/auth/cloud-platform.read-only in addition to the identity scopes. Google's read-only Cloud scope is broader than project discovery. This feature uses it only to list projects visible to that account through Google Cloud Resource Manager's projects.list API and to check that the project you select is present in that list before saving a binding. It does not test every permission on that project.
• Project data: we read project IDs, project numbers, display names and lifecycle states returned by Google. If you choose Bind project, we save the selected Google project ID, references to your CNXT account, connected Google account and owned CNXTCLOUD instance, and the access-check and creation/update times. This is a private association, not a public listing. The saved access-check time records a past check, not a guarantee of continuing access.
• Feature limits: this connection does not read Gmail messages, Drive files or project workloads, or create, change or delete Google Cloud resources. Your member grant is not passed to CNXT's separate platform service-account engines or agents and does not authorize them to run in your Google project.

CNXTCLOUD — Connect Google

10. Connect Google — storage, retention and deletion

• Token and email security: authorization and Google API requests use HTTPS. CNXT encrypts your refresh token and Google email before storing them in its database. The refresh token lets CNXT obtain short-lived access tokens for the disclosed project checks without asking you to consent every time. Access tokens and ID tokens are processed in server memory, not saved to the database or returned by CNXT to the browser.
• Other saved fields: the Google account identifier, requested/granted scopes, connection status and timestamps, and selected project binding are ordinary database fields; they are not covered by the separate email/token encryption. Member routes restrict these records to the owning CNXT account. Neither the grant nor the binding is added to public cloud-instance listings or the public identity graph.
• Project-list retention: the list fetched from Google is processed in server and browser memory for the project picker and access check, not saved as a persistent project catalog by this feature. Only the selected binding described in section 9 is saved. We keep a connection until you disconnect it, and a binding until you unbind it, replace it or disconnect its Google account. Token expiry or Google-side revocation can require reconnection but does not itself delete the local records.
• Disconnect: use CNXTCLOUD → Connect Google → Disconnect. CNXT first stops using the grant and attempts revocation at Google, then removes the saved connection, including its account identifier, encrypted email and refresh token, scopes and status, and all project bindings for that connection when local cleanup succeeds. Older pending authorization records are also removed. If Google revocation cannot be confirmed, local removal still proceeds and the interface warns you to remove CNXT access in your Google Account connections settings. If local cleanup is still pending or fails, refresh status or contact Support rather than assuming deletion is complete.
• Unbind: Unbind project on an owned instance removes only that private association. The Google account and its permissions stay connected, and you can bind another accessible project. Neither unbinding nor disconnecting deletes your Google account, Google Cloud projects or resources. Signing out of CNXT is not deletion. For CNXT account deletion or if you cannot use Disconnect, explicitly request removal of your Google connection data through Your Account or Support.
• CNXT account deletion: CNXT periodically checks account status with its identity service. After it can verify that your account was deleted, it permanently blocks further use or restoration of that account's Google connections, removes pending authorization attempts and private project associations, and queues saved Google credentials for revocation and local removal. Unfinished local cleanup is retained for retry without requiring you to sign in again. These checks and retries can take additional time. Local removal proceeds even if Google revocation cannot be confirmed; already issued access tokens or requests that started before detection cannot be recalled by local deletion. An outage or an account record that cannot be safely verified is not treated as proof of deletion; contact Support if cleanup cannot be confirmed.
• Authorization and residual records: single-use authorization attempts hold hashed state, encrypted verification values, requested scopes, callback details and timestamps. Their authorization window expires after 10 minutes; a completed successful attempt is deleted, but expiry alone is not a deletion timer for unfinished or failed attempts. Owner-level safety records and operator-only setup-check records can remain after disconnect or account deletion; the latter contain configuration, outcome and time, not Google email, tokens or project lists. A permanent account-deletion record prevents old credentials from being restored. These residual safety and setup-check records have no automatic timed purge.
• Backups and other retention: disconnect removes the active connection records described above, not every CNXT record or an immediate copy in every backup. Retained backups are access-restricted and are not reused for other purposes. No fixed backup-deletion period is promised here. The general retention standard in section 6 applies; contact Support about deletion and any remaining records. Removing a connection does not erase information independently held by Google under its own policies.

Manage Google Account connectionsSupport — Google-data deletion requests

11. Connect Google — sharing and Limited Use

CNXT's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. These restrictions apply to the Google data itself and data aggregated, anonymized or derived from it.

• Limited purposes: Google connection data is used only for the disclosed account connection, project discovery, access checks and private binding features, subject to the security and legal exceptions below. It is not sold or used for advertising, retargeting, personalized ads, affiliate attribution, credit decisions or lending, or AI/model training.
• Feature-related sharing: data is exchanged with Google for authorization, token refresh, project discovery and revocation, and processed by the hosting and database providers needed to deliver this user-facing feature with your consent. The member connection does not supply Google account or project data to sellers, Hubs, PromoteKit or Google Analytics. Connecting Google is not consent to share that data for their separate purposes.
• Other transfers are limited to necessary security purposes, compliance with applicable law, or a merger, acquisition or sale of business assets only after obtaining your explicit prior consent. The broader network-sharing permissions in section 4 do not expand these Google-data limits.
• Human access: people may read Google connection data only with your affirmative agreement to inspect specific data, when necessary for security, or when necessary to comply with applicable law. These limits apply to CNXT personnel and others processing this data on CNXT's behalf.

Google API Services User Data Policy — including Limited Use

12. Visit measurement & acquisition attribution — the first-party funnel

CNXT measures how visitors arrive and whether they open an account with its own funnel, separate from Google Analytics and from the hosting platform's published-app analytics. Those two report to their own consoles; nothing from them is read back into CNXT.

• Anonymous session key. On first visit your browser generates a random identifier and keeps it in its own local storage. It is not derived from your account, your device or your address, and it is the only key a funnel row is filed under until you sign in. Clearing site data discards it; a later visit starts a new, unrelated key.
• First-touch attribution, captured once. On your very first arrival the browser stores the campaign tags you arrived with (utm_source, utm_medium, utm_campaign — each reduced to a closed tag grammar of letters, digits and a few separators, so a link, query string, address or identifier placed in a tag is replaced by "*"), the referring site reduced to its hostname only, and the landing page reduced to its first path segment only — for example a referral from a search engine's host landing on /apps. The full referrer URL, its path, any query string or fragment, deeper page paths, and your browsing history are never stored, and an address-literal or CNXT's own host is dropped. That record is immutable: a later visit through a different link never rewrites it. The server repeats the same reduction on every event it receives, so a browser cannot persist more than this.
• What each event row holds. The session key, the event name (visit, prompt shown, sign-in started, session link, store click), the CNXT route it happened on, the first-touch fields above, a coarse client classification derived from the browser's user-agent string (human, bot, headless, or unknown, with a label for known crawlers), and a timestamp. IP addresses are not stored: to detect burst abuse, a network prefix — the first three octets of an IPv4 address (/24) or the first 48 bits of an IPv6 address (/48), never the address itself — is held in server memory only — never written to a row — for a sixty-second window, and a timer sweeps expired entries every ten seconds, so no prefix outlives the window by more than ten seconds.
• Server-recorded conversions. Account creation and welcome-reward claims are written by the server from its own records when they happen. A browser cannot emit either, and the intake rejects any attempt to. When you sign in, one session-link row ties your anonymous session to your account so those conversions can be attributed to the channel you first arrived from.
• Who can read it. The rows are never public. Only platform operators on an explicit allow-list can read the aggregates — reach, human reach, sign-ups and conversions by channel, campaign and landing route — in #://CRMx and the campaign console, and those views carry no session keys, account identifiers, referrer URLs or addresses.
• Retention and deletion. Funnel rows are kept as aggregate records of how the network was reached; no automatic expiry runs today, and this section will state the window if one is introduced. Rows filed under a session key that was never linked to an account carry no account identifier, and CNXT holds nothing that ties them to a person. Once you sign in, the session-link row written for that session key makes every row filed under it attributable to your account for as long as the rows exist: clearing your browser's storage starts a new, unrelated key for later visits but does not remove that stored link. The rows that carry your account identifier, and every row filed under a session key linked to it, are deleted on a verified deletion request through the channels in section 13.

13. Contact

Privacy requests can be raised through Your Account or through the channels on the Support page, and are handled by the privacy team at $://THeCeNTRaLDesK. This policy is provided for transparency and is not a substitute for independent legal advice.