Your data in Chaski

Effective October 4, 2026 · Updated October 7, 2026

Chaski connects your ChatGPT identity to the SAP Business One company you configure. You can sign in with ChatGPT to create your own workspace. Each account has its own SAP connection and activity. This notice describes the workspace’s SAP connection, usage records, draft proposals, and billing.

Information we use

• Sign-in: ChatGPT supplies a site-specific identifier and may provide your name and email to the sign-in layer. Chaski’s account table stores the identifier, rather than dedicated name or email fields. If you submit a signed-in data request, its stored encrypted contents include the sign-in email and your optional note.
• Your connection: the workspace name, SAP endpoint, company database, SAP username, encrypted SAP password, and connection verification time. The endpoint, database name, and username are saved as connection settings without application-level encryption.
• Your activity: requested SAP results, quotation proposals and SAP draft references, operation types and requested entities, request identifiers and hashed input fingerprints, timestamps, outcomes and error codes, and connection or permission changes. Depending on requested SAP fields, results may contain names, contact details, identifiers and transaction information about customers, suppliers, employees or other people.
• Request limits: one counter per account and request category, recording the count and time window to limit abuse. These counters are reused for each minute’s requests; they contain no SAP payloads or separate log of every request.
• Billing: Stripe customer, subscription and checkout references, checkout parameters, plan status, billing periods, and processed webhook event identifiers. Payment details are entered with Stripe and are not stored in Chaski’s application database.

Requested SAP data can include document comments, custom fields, CRM notes and attached files. Field discovery reads the connected company’s schema and custom-field descriptions. Chaski respects the permissions of the configured SAP account.

Why we use it

This information lets Chaski authenticate you, connect to your company, return requested records, enforce usage allowances and permissions, prevent duplicate operations, and manage subscriptions. Chaski does not maintain a complete copy of your SAP database.

Where information goes

OpenAI provides ChatGPT sign-in and the Sites platform; Cloudflare provides the hosted application, database and private object storage. Stripe Managed Payments acts as merchant of record for paid subscriptions and handles checkout, billing details, receipts, subscription transactions, and payment support under its payment terms and privacy practices. Its indirect-tax coverage depends on the customer’s country; Chaski remains responsible where that coverage does not apply. Checkout may request a name and billing address for tax calculation. Chaski remains responsible for its product and workspace service. Your configured SAP server receives the requests you authorize. Infrastructure providers may process network and security information needed to operate their services.

When you use Chaski tools in ChatGPT, the requested SAP results are returned to ChatGPT. Their subsequent handling follows your ChatGPT account’s applicable settings and terms. Your organization decides which records may be processed and must have authority and a lawful basis to share them. Provider processing can involve countries outside your location; applicable processing agreements and transfer safeguards must be established before sharing data that requires them. Chaski’s application does not include advertising trackers or sell records through its features.

Provider notices: OpenAI privacy, Cloudflare privacy, and Stripe privacy.

Credentials and retention

SAP passwords, retry-cache results, report progress, and prepared proposal contents are encrypted with AES-256-GCM in Chaski’s database. Temporary report batches and calculations are encrypted in private object storage. The encryption key is held separately in the hosted application configuration. This protects stored contents; Chaski’s server can decrypt them to provide the service. Passwords are not returned in query results or sent to ChatGPT.

• Connection credentials remain until you replace them or disconnect SAP.
• Reporting workflows keep temporary working data for a 24-hour follow-up window. Access ends at expiry, on deletion, or when you reconnect or disconnect SAP. A scheduled cleanup removes expired working data, with a short upload grace period and retries if storage is unavailable. Physical deletion is not guaranteed at the exact expiry time. Chaski does not create a permanent report archive by default. Word and Excel files delivered in ChatGPT follow your ChatGPT account’s settings and are not deleted by Chaski’s cleanup.
• Successful query results can be reused for duplicate-request protection for 15 minutes. Expired retry payloads are cleared by scheduled cleanup or when you load your workspace. Operation counts remain for billing and usage records.
• Downloaded SAP attachments are encrypted in private temporary object storage. Access lasts up to 15 minutes and ends when the SAP connection changes or workspace data is deleted. Download links require your signed-in account. Expired bytes are removed by scheduled cleanup, subject to retries and a short upload grace period. Copies downloaded to your device or delivered in ChatGPT are outside Chaski’s cleanup.
• Proposals expire for confirmation after 10 minutes. Stored proposals older than 30 days, and operation and audit records older than 100 days, are removed when you load your workspace.
• These are cleanup thresholds, not guaranteed deletion deadlines. Report working data and expired retry payloads have scheduled cleanup. General operation, proposal, and audit history cleanup depends on loading your workspace, so those records can remain longer if you do not return. Account records, request-limit counters, billing references, and processed webhook identifiers have no automatic deletion schedule. Hosting backups and provider records follow their respective retention arrangements.

Your controls

You can update connection details and disconnect SAP in SAP connection, and disable writes in Settings. Review, confirm or discard pending quotation drafts in ChatGPT. Disconnecting removes the saved credentials and cancels pending proposals; it does not delete your account, past activity, or records already created in SAP. Settings provides an account-metadata export and tracked requests for broader access, correction, workspace-data deletion or privacy complaints. Chaski support owns the queue, verifies scope and records an outcome visible in Settings. The export excludes passwords and temporary SAP contents. Deletion is processed by support; it is not completed when you submit a request. Minimal account, subscription, usage, terms-acceptance and request records may remain for billing, security and complaint handling, with the outcome explaining retained records.

You can manage or cancel a paid subscription in Usage & billing. Disconnecting SAP does not cancel a subscription. For questions about your workspace data, contact Chaski support. For Managed Payments transaction or payment-data questions, contact Stripe transaction support.

Privacy requests

Use Settings to request access, correction, deletion or another right available under applicable law. Requests require website sign-in. If your request concerns SAP information processed for your organization and you do not have a Chaski account, contact your organization’s SAP administrator or privacy contact. Support verifies identity and authority proportionately and coordinates with your organization where appropriate. The Settings export is account metadata, not a complete response to every possible privacy request. Support records receipt, the applicable response deadline and the outcome. Do not send SAP passwords or unrelated customer records.

Support requests and service terms

When you submit a data request while signed in, Chaski records your account identifier, request type, status, dates and outcome. Your optional note and sign-in email are encrypted. Your account can see the request status and outcome; the assigned support operator can decrypt its note and contact email to handle the request and process verified workspace-data deletion. Terms acceptance records contain the version and acceptance time. Support requests and acceptance records have no automatic deletion schedule; support reviews continued necessity when handling deletion or broader access requests and in periodic retention review. Retained account identifiers and deletion markers protect account isolation and prevent stale requests restoring data; billing references and operation counts support subscription and usage reconciliation; consent and request records document agreements, rights handling and disputes. Retention must be limited to the applicable purpose or legal obligation. Request outcomes should contain only necessary information.

Browser storage and tracking preferences

Your light or dark appearance preference is saved in browser storage. A seven-day cookie stores whether the workspace sidebar is open. Authentication uses the sign-in platform’s session mechanisms. Chaski does not currently implement advertising or cross-site behavioral tracking, and does not change its application behavior in response to Do Not Track signals. The application does not add third-party advertising trackers; platform sign-in and linked services process information under their own notices. This statement does not describe all collection on those providers’ other websites.

Updates to this notice

Changes to these practices will be reflected on this page with a revised update date. Material changes presented with revised service terms appear in the workspace terms-review panel before a new SAP connection or paid checkout. Read the current notice before connecting a company or using a new capability. Support can provide details about a change and any additional agreement required for your organization.