Privacy Policy
1. Controller and scope
Effective: 2 November 2026. The controller is the service provider identified in the Imprint. Contact: info@alsalibi.de. This policy covers the Alsalibi Connect website, accounts, paired-device service and its ChatGPT integration.
2. Data, purposes and legal bases
Account and service data may include name, email address, password-derived hashes, verification status, OAuth authorization records, device identifiers and public-key fingerprints, operating-system category, capabilities, permissions, connection state and subscription/account status. We use these data to create and secure accounts, pair authorized devices and provide the service you request. The legal basis is primarily Art. 6(1)(b) GDPR (contract and pre-contractual measures).
Security and abuse-prevention data may include rate-limit counters, action type and outcome, device-key fingerprints, and protected hashes of network prefixes used for anti-fraud/referral checks. We use these data to protect accounts, infrastructure and other users. The legal basis is Art. 6(1)(f) GDPR (legitimate interests in service security, fraud prevention and defence of legal claims), balanced against user rights. Where processing is required by law, Art. 6(1)(c) GDPR applies.
If a feature requires consent rather than contract necessity or legitimate interests, we will request that consent separately before the processing starts. The legal basis is then Art. 6(1)(a) GDPR, and consent can be withdrawn for the future at any time.
3. Remote-computer payloads
When you explicitly ask ChatGPT or another connected assistant to perform an action, Alsalibi Connect may transmit the command text, file path or file content, process information, screen image, pointer/keyboard input or URL needed to fulfill that request between your paired device and the connected assistant. File and screen contents are not intentionally retained in the ordinary activity log. Avoid submitting passwords, one-time codes, government identifiers or payment-card data through assistant tools.
4. Recipients and processors
Data is shared only as necessary to operate the selected feature. This can include OpenAI/ChatGPT when you connect and invoke the integration, network-delivery and security infrastructure providers for secure transport and tunnel/proxy functions, the configured transactional-mail provider for verification/support messages, and Google when you choose Google OAuth sign-in. The core remote service is operated on infrastructure controlled by the service provider. We do not sell personal data and do not use remote-tool activity for advertising.
Some recipients may process data outside the EEA. Where GDPR Chapter V requires a transfer mechanism, transfers are made only on a legally available basis and with the safeguards required for the relevant provider and transfer at that time.
5. Approximate location and telemetry
For owner-only operational statistics, the service may use country, region and city values you provide or approximate estimates calculated locally from a trusted connection address during sign-in or an authenticated visit. Your connection address is not sent to an external geolocation API. No precise coordinates or raw IP address are stored for this feature. Automatic estimates are overwritten by later visits and removed after 90 days without a new visit.
Optional profile information
Gender and birth year are optional self-reported profile information, visible only to you and the service administrator. Only an approximate age is calculated from the birth year; we do not require a full date of birth. It is never inferred from your name, email or connection. You can clear it in Account Settings. Successful sign-in counts and authenticated visit sessions are separate operational counters; earlier unrecorded activity is not reconstructed.
6. Retention
Verification codes expire after about 10 minutes. Website presence records are removed after about 24 hours. Download events, ordinary application-activity metadata, approximate auto-location records and support records are generally cleaned after about 90 days. Account, device, authorization and acceptance records remain while needed for the active account, contract, security, proof of consent/terms acceptance or legal obligations, and are removed or anonymized when their purpose and applicable retention duties end.
7. Cookies and device storage
The website currently uses only storage needed for sign-in, OAuth security, language and user preferences. It does not currently load optional advertising or analytics cookies. Details, durations and controls are listed in the Cookie & Storage Notice. If optional tracking is introduced later, it will not be loaded before any consent required by law.
8. Your rights
Subject to the statutory conditions, you may have rights of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent for the future. You also have the right to lodge a complaint with a competent data-protection supervisory authority. To exercise rights, contact info@alsalibi.de. We may request reasonable identity verification.
9. Automated decisions and changes
Alsalibi Connect does not use account data for solely automated decisions producing legal or similarly significant effects as part of the ordinary service. Security controls may automatically rate-limit or block suspicious requests; support can review account-access problems. This policy may be updated when features, providers or law change; the current effective date is shown above.
Public help community
Questions and replies posted in /help are public, including your chosen display name and message. Account email addresses are not included in public author data. You can remove your own posts. Hidden or deleted content is removed from this feature after 30 days; request-rate records expire after 24 hours. The automated FAQ assistant uses prepared local answers and does not send questions to an external AI service. Do not post passwords, pairing codes, device keys, OAuth tokens or private screenshots.