Privacy notice · Touchbud Play and Touchbud Play+ for ChatGPT
1. Who is responsible
Controller: FEEDEX Ltd. (FEEDEX Kft.), 79 Ipar St, 9023 Győr, Hungary, VAT number HU10669879. Touchbud is a joint project of Dice and FEEDEX Ltd.; front office: factory300, Tabakfabrik Linz, Peter-Behrens-Platz 10, 4020 Linz, Austria.
Contact for all privacy questions: info@touchbud.com, +43 660 88 23 73 1.
This notice supplements our general Privacy Policy. Where the two differ for the plugin, this notice applies.
2. What the plugin does
When you connect the plugin, ChatGPT opens a Touchbud Play sign-in page. After you sign in, ChatGPT may call the plugin’s tools on your behalf: list and inspect your screens, playlists and media library, create and change playlists and their schedules, assign playlists to screens, rename or delete media and screens, add images and videos (from a file you attach in the chat, from a public link you give, or through a one-time upload link) and request a screenshot of an online screen. ChatGPT normally asks for your confirmation before it calls a tool that changes or deletes data. What the plugin may do is limited by your role in Touchbud Play: administrators can use every tool, editors can manage media and playlists, all other roles can only read.
2a. Touchbud Play+
Touchbud Play+ is a second app with the same Touchbud Play sign-in. One connection covers every company your account belongs to: each tool call names the company it works in, and in each company the tools can do only what your role there allows (administrators everything, editors media, playlists, modules and the catalog, all other roles only read). In addition to the Touchbud Play tools, Touchbud Play+ can:
- list the members of a company, invite a person by e-mail address with a role, change a member’s role and remove a member – administrators only. An invited person receives an invitation e-mail from us; a new address gets a Touchbud Play account;
- read and change screen settings (check-in interval, rotation, debug overlay), restart a screen or clear its cache;
- create and change modules (for example clocks, weather, texts, QR codes), set what a screen shows when someone touches it and schedule a playlist switch for a later time;
- add web pages – our server opens the page once to take a screenshot as its thumbnail – and PDF documents, whose pages we store as images;
- read play statistics and an overview of online and offline screens, and switch your e-mail alarm for offline screens on or off;
- manage the kiosk catalog: categories with their fields, and items.
3. Data we process
| Category | What exactly | Source |
|---|---|---|
| Sign-in data | Your e-mail address and password, entered on the Touchbud sign-in page. The password is checked by Google Firebase Authentication and is not stored by the plugin and never passed to ChatGPT. We keep your user id and e-mail address with the access you granted. | You |
| Access credentials | Authorization codes, access tokens and refresh tokens issued to ChatGPT, the client name and redirect address ChatGPT registers, the granted permissions and the company chosen. Tokens are stored only as one-way hashes. | Generated by us |
| Company content you work with | Screen names, ids, online state, player version and current playlist; playlist names, items and schedules; media names, types, durations, file links and thumbnails; the state of upload links. | Your Touchbud Play account |
| Files you add | Images and videos you attach in the chat or whose public link you give, and files you upload through a one-time link. ChatGPT hands us a temporary download link for an attachment; we download the file once and store it in your library. | You |
| Screenshots | A picture of what a screen shows at the moment you request it. It can contain whatever is visible on that screen. | Your screen |
| Members (Touchbud Play+) | E-mail address, name, role, language and confirmation state of the members of a company, and the e-mail address, role and (optionally) name and language of a person you invite. | Your Touchbud Play account, you |
| Statistics and alarms (Touchbud Play+) | Play counts and display times per media, screen, playlist and day as reported by your screens, and taps on kiosk screens; whether a member’s offline alarm is on and after how many hours it sends an e-mail. | Your screens, you |
| Web pages, PDFs, modules and catalog (Touchbud Play+) | Addresses of web pages you add and a screenshot of each; PDF files you add and an image of each page; module settings (for example a place for the weather); catalog categories and items with their texts, prices, pictures and translations. | You |
| Request logs | For each request to the client API: time, company, your e-mail address (or the API key id), the client id, the operation called, the result status and the duration. For each tool call: time, company, user, client id, tool name, success or the error message, duration and the names of the arguments sent – never their values. | Generated by us |
| Platform logs | Technical execution logs of our hosting platform (time, duration, status, error messages). | Google Cloud |
We do not receive your ChatGPT conversation. We only receive the tool calls ChatGPT decides to make, with the arguments it fills in (for example a playlist name or a media id). Please do not put sensitive personal information into names of media, playlists or screens.
4. Why we process it (purposes and legal bases)
- To provide the plugin – sign you in, check your permissions, carry out the actions you ask for and return the results to ChatGPT (performance of our contract with you or your company, Art. 6(1)(b) GDPR).
- Security and abuse prevention – limit sign-in attempts and request rates (120 requests per minute per account or API key), detect misuse, investigate errors (legitimate interest, Art. 6(1)(f) GDPR).
- Support – answer your questions about a failed action using the request logs (legitimate interest).
- Legal obligations – where the law requires us to keep or disclose data (Art. 6(1)(c) GDPR).
We do not use plugin data for advertising, profiling or marketing, we do not sell or rent it, and we do not use it to train AI models.
5. Who receives the data
- OpenAI – the results of the tools ChatGPT calls (for example the list of your screens or a screenshot) are returned to ChatGPT, the application you chose to connect. OpenAI handles that information under its own terms and privacy policy.
- Google Cloud / Firebase (Google Ireland Limited and its affiliates) – our hosting, database, file storage and sign-in provider, acting as our processor under the Google Cloud data processing terms. The plugin’s servers, database and files are located in the region europe-west3 (Frankfurt, Germany).
- Public web servers you name – when you ask the plugin to add a file from a public link, our server downloads it from that address. When you add a web page (Touchbud Play+), our server opens it once to take a screenshot; a PDF from a link is downloaded the same way.
- Invited persons (Touchbud Play+) – when you invite someone, we send an invitation e-mail to the address you give, from our own mail server.
- OpenStreetMap Nominatim (OpenStreetMap Foundation) and the Norwegian Meteorological Institute (api.met.no) – when you create a weather module with a place name (Touchbud Play+), the place name is looked up with Nominatim, and the forecast for those coordinates later comes from api.met.no; no personal data is sent.
- Authorities – only where we are legally obliged.
No other third parties receive plugin data.
6. How long we keep it
| Data | Retention |
|---|---|
| Authorization codes | valid 10 minutes, deleted at the latest 24 hours after expiry |
| Access tokens | valid 1 hour, deleted at the latest 24 hours after expiry |
| Refresh tokens | valid 90 days, replaced on every use; deleted at the latest 24 hours after expiry or right after they are revoked |
| Pending sign-ins | 15 minutes, then deleted within 24 hours |
| One-time upload links | usable 30 minutes; the record is deleted after 24 hours |
| Request and tool-call logs | 90 days, then deleted automatically |
| Platform logs | 30 days |
| Media, playlists, screens and screenshots | as long as they are part of your Touchbud Play account – until you or an administrator of your company deletes them, or until the account is closed |
| Members, statistics, alarm settings, modules, web pages, PDFs and catalog content (Touchbud Play+) | as long as they are part of your Touchbud Play account – until an administrator of your company removes them, or until the account is closed |
7. Your choices and rights
- Disconnect at any time in ChatGPT (Settings, Apps). ChatGPT then stops calling the plugin; its tokens expire and are deleted as described above. On request we revoke them immediately.
- Control what the plugin may do through your role in Touchbud Play; an administrator of your company can change roles in the Touchbud Play admin at play.touchbud.com.
- Delete content – media, playlists and screens can be deleted in the Touchbud Play admin or through the plugin itself.
- Touchbud Play+ and your companies – Touchbud Play+ acts only in the companies your account belongs to and only with your role there. If an administrator removes you from a company or changes your role, that applies to the very next tool call.
- Your rights under the GDPR – access, rectification, erasure, restriction of processing, data portability and objection. Write to info@touchbud.com; we answer within one month. We may need to confirm your identity first.
- Complaints – you can lodge a complaint with a supervisory authority, in Hungary the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, naih.hu), or with the authority of the country where you live or work.
8. Security
All connections use HTTPS. Passwords are checked by Firebase Authentication and never stored by the plugin; access tokens and refresh tokens are stored only as hashes; every request is limited to your own company and to the permissions of your role. No method of transmission or storage is completely secure, but we review and improve these measures continuously.
9. Children
Touchbud Play is a business service for operating digital signage. The plugin is not directed to children.
10. Changes
We update this notice when the plugin or our practices change; the effective date above shows the current version.
Recent Comments