Mizar — Privacy Policy
Last updated: 21 October 2026 (version 1.1.0, hosted server)
Who we are
Mizar is a plugin for ChatGPT and Codex published by Midchat (“we”, “us”). Privacy contact: privacy@midchat.io.
The short version
- From version 1.1.0, Mizar uses a Midchat server (
mcp.midchat.io) to check invoice fields, calculate totals, and render the invoice PDF. - ChatGPT sends that server only the invoice details needed for the document (see below) when Mizar’s tools are used. No account, no sign-in.
- We do not store invoice details: each request is processed in memory and discarded when the response is sent. We keep no database, no files, and no logs of invoice content.
- Download links are encrypted and expire after about 60 minutes. The invoice data travels inside the encrypted link; anyone you share a link with can open the invoice until it expires.
- We do not sell your data, use it for advertising, or use it to train models.
- Your conversation itself is processed by OpenAI under OpenAI’s terms and privacy policy: openai.com/policies/privacy-policy.
What the server receives
When ChatGPT calls a Mizar tool it sends the invoice fields you provided in the conversation: seller and client names and addresses, email (optional), VAT ID / tax number, client PO number, bank details (IBAN, BIC, account holder) or payment instructions, invoice number and dates, line items (description, quantity, unit, price, tax rate), discount, tax note and notes. Mizar’s tools do not ask for or receive your chat history, files, location, or account identifiers.
Mizar does not send invoices, contact your clients, take payments, or connect to accounting or banking tools.
Data we process
| Situation | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Tool calls (check fields, compute totals, render) | the invoice fields listed above | produce the totals / PDF you asked for | Art. 6(1)(b) | none — discarded after the response |
| Download link | invoice fields, encrypted inside the link | let you download the PDF / printable HTML | Art. 6(1)(b) | link expires after about 60 minutes; nothing stored on the server |
| Server operation | technical request metadata in our host’s runtime logs (IP address, user agent, time, path, status); paths contain only the encrypted link token, never readable invoice content | security, abuse prevention, troubleshooting | Art. 6(1)(f) | 1 day (Vercel Pro runtime-log retention) |
| You email support or privacy | email address, name, message, attachments | answer your request | Art. 6(1)(b) or (f) | 12 months after the support request is closed |
| You visit our website | technical data processed by our hosting provider (e.g. IP, browser, time); a cookieless page-view count (site name, hostname, event type) | deliver and secure the site; count visits | Art. 6(1)(f) | per hosting provider: GitHub Pages — https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement; page-view counts are aggregate and set no cookies |
OpenAI may make aggregated plugin metrics available to us as publisher. We do not sell personal data or use it for advertising, and our website sets no cookies.
Please don’t email real invoices, bank statements, or full receipts unless needed; blur sensitive values.
Sub-processors and recipients
- Vercel Inc. — hosting of
mcp.midchat.io; compute region Frankfurt, Germany (EU). Vercel is a US company; transfers are covered by the EU–US Data Privacy Framework / Standard Contractual Clauses under Vercel’s DPA. - GitHub, Inc. — website hosting.
- OpenAI — processes your ChatGPT conversation under its own terms.
Restricted data
Do not enter card numbers, passwords, health data, or government ID numbers; Mizar does not need them.
Your rights (EU/EEA)
You have rights of access, rectification, erasure, restriction, portability, and objection (Art. 15–21 GDPR). Contact privacy@midchat.io. Because we do not store invoice data, there is usually nothing for us to retrieve or delete beyond short-lived host logs and support emails. For ChatGPT conversation data, exercise rights with OpenAI — we cannot access or delete it. You may also complain to a data protection supervisory authority, in particular in the EU member state where you live or work.
Changes
We’ll update this page when the product changes, adjust the “Last updated” date, and note material changes in the plugin’s release notes.
Suite privacy overview: /privacy · Terms: /mizar/terms · Support: /mizar/support