Data and privacy
Privacy notice
This draft explains the data handling that the current Special Guest implementation can substantiate, including optional external AI connections.
Last updated: 15 September 2026
Who is responsible
Special Guest is operated by TEST VALUE (operator name) TEST VALUE (legal form), registered office: TEST VALUE (registered office, Romania); Trade Register number TEST VALUE (Trade Register number), company tax identifier (CUI) TEST VALUE (CUI). Contact for platform privacy requests: test-privacy@example.invalid. Customer businesses control the purposes for which they collect and use their own customer data; the platform processes that data under their instructions.
Data we handle
Special Guest handles account identity and security data; invitations and business memberships; business profiles, news, achievements, offers and events; community membership, chat text and images; audit and security records; language and notification preferences; and technical session, OAuth and push-subscription data. If you connect Google or LinkedIn for sign-in, Special Guest receives the provider's stable account identifier and basic profile claims needed to authenticate you; it does not receive your provider password or retain provider access tokens. When you use profile assistance, it also handles the text or public website you provide, generated suggestions and your review decisions.
Why data is used
Data is used to authenticate users, enforce business and community permissions, provide public listings and member features, deliver requested notifications, protect the service, keep accountability records, and prepare owner-reviewed profile suggestions. The publisher must still approve and document the precise legal bases for each purpose.
External AI clients and the MCP tools
OAuth shares only the access you approve for the selected business. The tools can return its management profile, store supplied text or bounded public-website evidence, and save factual profile proposals. Special Guest never accepts your external AI provider password or API key, and these tools cannot apply or publish changes. Known tool attempts record the user, business, client, tool, result, time and correlation identifier without storing prompts, source text or token contents in that tool audit event.
Services and recipients
Data may be handled by the infrastructure, database, backup, email, web-push and security services used to operate Special Guest. The built-in profile assistant sends supplied source text to the configured AI provider. When you deliberately use an external AI connector, relevant profile and evidence data is exchanged with that provider under your connection. A final notice must name or categorize approved providers and state any international-transfer safeguards after owner review.
Public authority data requests
Retention
Current external AI connector access tokens last 15 minutes, rotating refresh tokens 30 days and new grants no longer than 90 days. Prepared source batches expire for new submissions after 24 hours; evidence attached to a submitted proposal remains for review and audit. Community chat content is configured for 30-day expiry, while protected backups may retain older copies. Account closure hides public content, ends sessions and revokes connector access but does not erase account, business, audit or backup records. A complete, owner-approved retention and deletion schedule is still required.
Your controls
You can edit your profile, decide which suggestions to apply, connect or disconnect a supported sign-in provider, disconnect an AI connection, manage supported notification choices and close your account through the workspace. Closing an account is not a permanent-erasure request. Public business information and public website evidence should be supplied only when you have permission to use it.
Your data-protection rights
Depending on applicable law, you may have rights to information, access, correction, deletion, restriction, objection, portability and withdrawal of consent. You can lodge a complaint with ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal). Contact us to exercise your rights or ask which data we hold.
Privacy requests
Send privacy and data-deletion requests to test-privacy@example.invalid. Include the email you used with Special Guest and enough context to locate the relevant account or booking. See the data-deletion instructions below. Do not send passwords, access tokens, identity-document copies or national identification numbers.