Privacy notice for AI assistants

This notice explains what data Hosted Power processes when you connect an artificial intelligence (AI) assistant, such as ChatGPT or Claude, to your TurboStack account. The connection uses the TurboStack Model Context Protocol (MCP) server at https://my.turbostack.app/mcp. How to connect is described in Connect Claude and ChatGPT to TurboStack.

This notice adds to the Hosted Power privacy policy and terms of service. Where they differ for the AI connection, this notice applies.

Last updated: 16 October 2026

Who is responsible

Hosted Power BV, Hundelgemsesteenweg 3A, 9820 Merelbeke, Belgium (Value Added Tax (VAT) number BE0632500178), is the controller for the data described here. Contact: support@hosted-power.com.

Data we process

When you connect

• Your TurboStack identity: the email address you sign in with, your client ID or staff ID, and the list of hosts your login may see.

• Connection data: the name and return address of the AI app you connect, and the access and refresh tokens we issue to that app.

You sign in on the TurboStack page. The AI assistant never receives your password or your two-factor authentication code.

What the tools return to the AI assistant

The assistant only receives data when it calls a tool. Each tool returns data from your own TurboStack account, limited to the hosts your login may see:

Tool	Data returned, including nested fields
current_user	Your account type, email address, client ID and access scope.
list_hosts	Host ID, host name, display name, usage (production or staging) and plan. Staff logins also see the client ID of each host.
get_host	The host's full TurboStack configuration, as you entered it. This can include system usernames, domain names, application settings, IP addresses and other values you stored, such as passwords, certificate private keys and API tokens. Staff logins also see the administrator configuration.
get_health_issues, get_health_reports	Health issues and incident and analysis reports: host and customer name, client ID, severity, findings and their evidence. Evidence can contain IP addresses, URLs, file paths, usernames and log excerpts.
get_threats	Threat Center findings: vulnerabilities, indicators of compromise and runtime detections. Evidence can contain IP addresses, file paths, file hashes, process names, command lines and usernames.
get_monitoring	Monitoring services and their state, and metrics such as load, memory and disk use.
get_deploy_status	Status, type and start time of the latest deploy, the email address of the person who started it, and the last part of the deploy output (debug log).
deploy_host	Confirmation that a deploy started. The deploy is recorded with the email address of the person who started it.

What the tools return can include personal data of your own end users, for example IP addresses of visitors in security findings or log excerpts.

What we do not receive

We do not receive your conversation with the AI assistant. We only receive the tool requests the assistant sends to TurboStack and their arguments, for example a host ID or the host name you confirm for a deploy.

Why we process it

Purpose	Legal basis (General Data Protection Regulation, GDPR)
Identify your account, limit the assistant to your hosts, and answer the tool requests you make through the assistant	Performance of our contract with you (Article 6(1)(b))
Carry out a deploy you request, and record who started it	Performance of our contract (Article 6(1)(b))
Keep the service secure, audit changes and troubleshoot problems	Our legitimate interest in a secure, reliable service (Article 6(1)(f))

We do not sell this data, use it for advertising, or use it to train AI models.

Who receives it

• The AI provider you choose. Everything a tool returns is sent to the AI provider whose assistant you connected, for example OpenAI for ChatGPT or Anthropic for Claude. That provider processes the data as an independent controller, under its own terms and privacy policy, and may process it outside the European Economic Area (EEA). Only connect an assistant whose terms you accept for this data.

• Our hosting provider. TurboStack runs on servers in the European Union (Amsterdam, the Netherlands) at UpCloud Oy, Finland, which acts as our processor.

How long we keep it

• Connection tokens: valid for at most one year, unless we revoke them earlier. Disconnecting in your assistant removes the token from that assistant; to revoke it on the TurboStack side, contact us.

• Your identity record for the connection: while your TurboStack account exists. You can ask us to delete it at any time.

• Deploy records: as long as the deploy history of the host, the same as deploys started in the TurboStack interface.

• Web server logs (time, IP address and requested address of each request): 30 days.

• Tool results: we do not store a separate copy of what a tool returns. The data stays in your TurboStack account as before. The AI provider keeps its copy under its own retention terms.

Your choices and rights

• Disconnect at any time. Remove or disconnect TurboStack in the settings of your AI assistant. To also revoke access on the TurboStack side, email support@hosted-power.com.

• Limit what the assistant sees. Connect with a login that only has access to the hosts you want. A restricted contact only sees the hosts it was granted.

• Your rights under the GDPR: you can ask for access to your data, correction, erasure, restriction or a copy (portability), and you can object to processing based on our legitimate interest. Send your request to support@hosted-power.com.

• Complaints: you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), www.dataprotectionauthority.be.

TurboStack is a business service and is not intended for children.

Changes

We update this notice when the TurboStack MCP server changes what it processes, and change the date at the top.

Related

• Connect Claude and ChatGPT to TurboStack
• Documentation MCP server
• Accounts and access