Privacy policy: ChatGPT integration

Last updated: October 2026.

This notice supplements the general CheapCharts privacy policy for the CheapCharts app in ChatGPT. Linking a CheapCharts account is optional. Public title searches and price queries work without login. The controller is the CheapCharts website operator; contact details are in the legal notice linked below.

Account connection

You sign in on a CheapCharts page using your password or an email code. OpenAI does not receive your CheapCharts password. Before connecting, the consent page shows the requested permissions and selected store country.

Data exchanged

CheapCharts sends the results of the tools you use to OpenAI/ChatGPT. With an account connection, these can include your wishlist, owned titles ("My Purchases"), custom lists and list names, wishlist deals ("My Deals"), store country, title names, title and list IDs, prices and operation status. Account tool results do not include your account email address or device IDs. Text you put in a list name is included in list results.

CheapCharts receives tool calls and their parameters, such as search terms, title IDs, list names and store country. Account authorization also processes the OAuth client identifier and access credentials. Requests transmit technical connection data, such as request time, HTTP metadata and the connecting IP address. The integration receives tool requests rather than your entire chat history.

Purpose and legal basis

We process account connection data and account tool requests to provide the integration you initiate, under Article 6(1)(b) GDPR. OpenAI acts as an independent controller for processing in ChatGPT. Its privacy policy explains how it processes received data.

OpenAI privacy policy

Credentials and logs

OAuth access tokens, refresh tokens and authorization codes are stored by CheapCharts as hashes. Access tokens are valid for 60 minutes. Refresh tokens, when issued, are replaced on each use and are valid for up to 30 days, with an absolute limit of 180 days from the initial authorization-code exchange. Authorization codes are valid for 60 seconds and can be used once. Email login codes are stored as hashes in the login session, are valid for 10 minutes and are removed on successful verification.

The cleanup routine removes expired unused authorization codes. Expired access tokens and unused refresh tokens become eligible for deletion 30 days after expiry or revocation, once they have expired. Used refresh-token hashes are retained until 30 days after the absolute token-family expiry; used authorization-code hashes until 30 days and 60 minutes after that expiry. This retained evidence helps detect credential reuse. Deletion takes place when the cleanup routine runs.

Technical integration logs support operation, error analysis and abuse detection. They record actions, outcomes, timing and selected technical parameters; they may include shortened token or email hashes. The integration application logs do not record passwords, raw tokens or login codes. The general privacy policy also describes server logs and specifies no fixed retention period for them.

Disconnecting

You can disconnect CheapCharts in ChatGPT. CheapCharts processes token revocation requests from the client; revoking a refresh token invalidates its token family, while revoking an access token invalidates that token. Deleting your CheapCharts account removes all associated OAuth database records. Changing your password currently does not disconnect existing connections. Disconnecting does not delete results already transferred to ChatGPT; OpenAI handles those under its own privacy policy.

Your rights

The general privacy policy explains your rights and how to contact CheapCharts. Under the applicable conditions, you can request access, correction, restriction, deletion and data portability. You also have the right to lodge a complaint with the competent data protection supervisory authority. Please use the contact details in our legal notice for requests.