Privacy Policy

Privacy Policy

Effective date: 16 September 2026

This notice describes how the current release actually works. Where a fact depends on a provider contract we have not separately negotiated, we say so instead of making a claim we cannot support.

1. Who is responsible

The operator of resolvenengine is Szegi Roland Attila E.V., a Hungarian sole proprietor, registered at 5000 Szolnok, Városmajor út 59/B, B épület, 2. emelet 24., Hungary. Sole proprietor registration number: 61835722. Tax number: 91754804-1-36. Contact: hello@dropsite.hu, +36 30 798 2618.

We are the controller for website administration, account management, subscription access, support and security. When a business customer instructs us to process personal data in its connected services or conversations, we act as its processor to the extent described in our Business Data Processing Agreement. The customer remains responsible for its instructions and the legal basis for that processing. Providers may have their own controller responsibilities; using our service does not make every provider our processor for every purpose.

2. What the service does

resolvenengine is an AI browser assistant delivered through a Chrome extension and supporting server services. You can ask it to work with a web page or an authorised connector. Google sign-in identifies your resolvenengine account; it does not itself authorise reading your Gmail, Drive or Calendar. Connecting a service is a separate permission step.

The current release supports Gmail, Google Drive, Google Calendar, ClickUp, Google Analytics, Google Search Console, GitHub, user-added HTTPS/OpenAPI connectors and remote HTTPS MCP servers. Availability and permissions may vary by provider and version. Your selected AI service processes the content needed for your requests. Under the BYOK plan, you configure and pay for your own AI API access.

Google Analytics access is read-only and can include account/property identifiers, report dimensions and metrics, and realtime reports. Standard Analytics reports can remain incomplete for approximately 24–48 hours. Search Console access is read-only and can include verified properties, search performance, sitemaps and URL inspection results; Search Console data commonly lags by 2–3 days. GitHub requests repo, read:user and user:email: this can grant read and write access to public and private repositories and permit repository, file/commit, issue and pull-request creation when you explicitly request and authorise those operations.

For a custom connector, you choose an HTTPS API endpoint and supply an OpenAPI 3 description or connect a remote HTTPS MCP server. You may also provide a bearer token or API key. We validate and store the connector configuration and encrypted credential, discover its available operations, and send task arguments to the endpoint you selected when you use it. We do not control that endpoint's identity, location, retention, security or privacy practices. Returned connector content is treated by the product as untrusted provider data.

3. Personal data we process

We do not need your Google, ClickUp or GitHub password. Signing in takes place with the provider. A custom API/MCP credential is supplied directly by you and stored encrypted by our backend; it is not returned to the AI model or browser after creation. Do not deliberately include passwords, payment-card details or unnecessary sensitive personal data in prompts or attachments. Browser pages and connected content can nevertheless contain sensitive information; review the material and permissions you make available.

Some information is necessary: without account identification we cannot provide an account; without the relevant connector permission we cannot perform its API operations; without subscription entitlement we cannot provide paid access. Optional support attachments and optional consent-based features are not required to create an account.

4. Purposes and legal bases

For business content processed on customer instructions, the customer determines the applicable legal basis; our DPA governs our processing. A contract with a subscriber is not automatically a legal basis for every use of third-party email senders' data. Where we determine a purpose for such data, we must establish an appropriate basis and meet applicable transparency requirements. Where we determine such a purpose, we rely on our legitimate interest in operating the assistant on the user's instruction, we do not use that data for advertising or model training, and we keep it only as part of the user's own conversation record.

OAuth permission is technical authorisation. It is not a blanket GDPR consent for unrelated processing. Article 6 alone is not sufficient for intentional processing of special-category data: an Article 9 condition is also needed. Do not use the product for regulated or special-category workflows until the applicable conditions and safeguards have been agreed.

5. AI processing and human access

To answer or perform a task, relevant instructions and content are sent to the AI API endpoint you configure. This can include retrieved email/file text, page content, screenshots and conversation context. It does not mean that all of your connected account is automatically copied to an AI provider. The actual scope depends on the task and the tools used.

Before any AI transfer, the extension asks you to allow it and names what would be sent: your prompt, relevant conversation history and context, page data and URLs, and where applicable a screenshot, file or connector result. A permission given for one API endpoint does not apply to a different endpoint origin. Your AI API key is held in browser session storage by default; you can choose local persistent storage instead. AI requests go from the extension directly to the endpoint you configure.

The reviewed configuration supports an Anthropic API endpoint and may support compatible custom endpoints. Provider identity, processing location, retention and training rules must be checked for the endpoint and contract actually selected. BYOK does not automatically mean zero retention or that no international transfer occurs. Supported endpoints are listed in our Service Provider and Transfer Schedule. Because you supply your own API key, the retention, training and location rules of your chosen AI provider apply to that traffic, and you should read that provider's terms before selecting an endpoint.

We do not sell connected Google user data, use it for advertising, or use it to develop, improve or train generalised AI/ML models. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, and applicable Google Workspace API policies. We cannot control the internal policies of an AI endpoint you configure yourself, which is why the extension asks for your explicit permission, naming what would be sent, before any AI transfer.

Authorised personnel may access data only where necessary for a permitted support, security, maintenance or legal purpose, with appropriate access controls. Google-derived data is subject to additional restrictions on human access under Google's policies. This is not an end-to-end encrypted service in which the operator is technically unable to access all content.

6. Storage and connector credentials

The reviewed backend encrypts stored connector credentials and synchronised conversation payloads using server-managed encryption keys. HTTPS protects transport. This is encryption at rest and in transit, not a promise of end-to-end encryption.

Drive, Calendar, ClickUp, Analytics, Search Console, GitHub and custom OpenAPI/MCP credentials are used by the backend proxy. In the Gmail implementation, a short-lived Gmail access token is returned to the extension for Gmail API requests; the refresh token remains on the backend. Local browser storage also holds app session information and AI configuration. Protect access to your device and Chrome profile.

Custom connector credentials are encrypted with owner- and connector-specific authenticated encryption. They are sent only to the exact HTTPS origin stored for that connector. Redirects, private/local network destinations, URL credentials and cross-origin OpenAPI operations are rejected. These safeguards reduce accidental disclosure but do not make a user-selected third party trustworthy.

Cloud conversation synchronisation is a separate opt-in setting per account and installation, and does not run before you make that choice. Once enabled, it runs automatically when a conversation changes and when a conversation is opened, plus a 12-hour check while the panel stays open. We do not claim a guaranteed scheduled backup while Chrome is closed.

Saved conversations can include conversation content, operation results and generated output, not just the messages you typed. Raw attachment binaries and the full local Context Vault are not automatically uploaded to the cloud, and the local copy has its own scope and limits rather than being an unlimited archive.

7. Recipients and international transfers

Data is disclosed only as needed to hosting/database/security providers, Google, ClickUp, GitHub, the custom API or MCP endpoint you select, the AI provider used for the task, subscription provider Polar, authorised support personnel, and authorities or advisers where legally necessary. Our Service Provider Schedule explains these roles and transfer considerations.

Polar handles the sale and payment checkout as Merchant of Record/authorised reseller. It processes purchase, payment, fraud-prevention and tax information under its own applicable terms and privacy notice. We receive information needed to associate payment status with your account. Our application is not intended to collect or store full payment-card details.

Providers and their personnel may process information outside the EEA. Where the GDPR requires safeguards, the applicable transfer must be covered by a valid adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with any necessary supplementary measures. We do not claim that every provider is covered by the same mechanism. Our database and stored conversation data are hosted in the European Union (Ireland, eu-west-1). Website and backend requests are served through a global edge network, so request routing and security processing can occur outside the EEA. We rely on the published data-protection terms and standard contractual clauses offered by these providers; we have not negotiated separate bespoke agreements and do not claim identical coverage for every recipient. Contact us for information about applicable safeguards and a copy where available, subject to necessary redactions.

8. Retention

We retain account, conversation and connection information for the purposes described here, subject to your deletion/disconnection instructions, applicable legal duties and necessary legal claims. Disconnecting a built-in service removes its encrypted credential while retaining non-secret preferences; deleting a custom OpenAPI/MCP connector removes its encrypted credential, configuration and policies. Neither action automatically deletes content already saved in a conversation. Turning synchronisation off stops further syncing for that installation; it does not automatically delete data already stored on the server or change another installation's settings. Reading and deleting your own existing data is never behind the subscription gate, including after a subscription expires. Signing out ends the current app session; it does not delete your account, conversations or every provider grant.

Some records have technical validity periods: app sessions currently expire after 30 days; OAuth states after 10 minutes; certain hand-off records after 2 minutes. These are validity limits, not proof that a physical database cleanup job has run. Conversation retention, deletion completion, infrastructure logs and backup expiry require the deployment-specific schedule below.

Our retention rules are: app sessions expire after 30 days; OAuth state records after 10 minutes and hand-off records after 2 minutes, with a daily job deleting expired OAuth rows; built-in connector credentials remain until disconnection, account deletion, provider revocation or token failure; a non-expiring ClickUp credential is represented internally with a maximum three-year technical validity and must then be reconnected; custom OpenAPI/MCP credentials remain until you delete the connector or your account; cloud conversations are kept until you delete them or ask us to delete your account, and a deletion request is completed within 30 days of verification; billing and accounting records are kept for the statutory Hungarian retention period (currently 8 years) by us and by Polar as seller. Infrastructure logs and encrypted platform backups are retained by our hosting and database providers under their own periods; we do not publish a deadline we cannot enforce, and a restored backup has deletion instructions reapplied. Statutory records and narrowly scoped evidence needed for legal claims may be retained separately when deletion of ordinary account data is appropriate.

9. Your choices and rights

You can choose which services to connect and which available operations to allow. You can disconnect a connector, revoke the app's grant in the provider's account settings, sign out, and request deletion. These actions have different effects, as explained in our Data Deletion and Rights page.

Depending on the applicable conditions, you may request access and a copy, rectification, erasure, restriction, portability of qualifying data, and object to processing based on legitimate interests. You can withdraw consent at any time for processing based on consent without affecting earlier lawful processing. Contact hello@dropsite.hu. We normally respond within one month; if a lawful extension is necessary, we will explain it within that first month. We use proportionate identity checks and do not routinely require an identity document.

You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11., Hungary, postal address 1363 Budapest, Pf. 9., email ugyfelszolgalat@naih.hu, website naih.hu, telephone +36 1 391 1400. You may also complain to the competent authority where you habitually reside, work, or where the alleged infringement occurred, and seek a judicial remedy.

10. Children and automated decisions

The service is intended for adults aged 18 or over. We do not knowingly offer accounts to children. Contact us if you believe a child has supplied data.

AI generates answers and proposes or performs requested operations. The service is not intended to make solely automated decisions producing legal or similarly significant effects about individuals. Do not use it for such decisions without a separate lawful design and appropriate safeguards. AI output can be inaccurate; review consequential actions and results.

11. Changes and contact

We will identify the effective date of changes and notify users of material changes through an appropriate service or email notice. A new purpose or consent requirement will not be introduced merely by silently changing this page. Questions: hello@dropsite.hu.