AI connector privacy disclosure

This disclosure describes RetailHardHat's MCP connector. It supplements your organization's existing RetailHardHat service agreement and privacy arrangements. Your AI provider has its own policies.

Data processed and purpose

When you link an account, RetailHardHat processes your account and organization identifiers, administrator role, granted scopes, client registration/callback details and consent. We use these to authenticate, enforce permissions and provide the requested integration.

Depending on the modules you select, tool responses can include organization sites and addresses; contact/vendor names and contact details; task assignments and notes; project, permit, lease, budget and invoice details; attachments and field photos; dates and reporting metrics. Files or notes can contain personal information supplied by your team. Grant only the modules you need.

Recipients and controls

The assistant/provider you connect receives tool results and permitted file content. Its processing, retention and use of conversation data are governed by that provider's policy. RetailHardHat does not receive an entire chat by default, but tool arguments may contain information from it. Existing configured carrier and lease integrations may process tracking or synchronization requests. Hosting and storage providers process application data as part of the existing service.

Owners/admins can choose read-only access, restrict modules, deny writes, revoke connections and inspect activity in Settings → MCP. Existing workspace access and deletion controls continue to apply. Revoking access does not delete copies already received by an AI provider.

Storage, security and retention

OAuth access/refresh tokens and authorization codes are stored as cryptographic hashes, not plaintext. Authorization requests expire after 10 minutes; issued codes expire after 2 minutes. Expiry stops use; expired authorization metadata and audit records are not automatically deleted solely on expiry. Connection and approval/activity records remain under the workspace's data-retention lifecycle. Deleting an organization cascades its connection data. Public-client registrations are retained for reconnecting clients. File storage follows the normal application lifecycle.

Transport uses HTTPS in production. Tenant and parent-record ownership, role checks, bounded results and human approvals remain enforced. Application hosting/security logs may process network metadata to prevent abuse. The connector does not expose authentication credentials or execute payments.

Questions and requests

Contact your organization's administrator or use RetailHardHat support for access, correction, deletion or retention questions.