Last updated: 5 October 2026

FIDES Ecosystem Explorer ChatGPT App / MCP connector — app-specific privacy notice

This section describes the data practices for the FIDES Ecosystem Explorer ChatGPT App and MCP connector at https://api.fides.community/api/mcp. The general policy for the FIDES website and other services follows in sections 1–14 below.

The connector is a read-only public catalog lookup service. It does not require a FIDES account, sets no cookies, does not receive your ChatGPT account identity from us, and never asks for payment details, health information, government identifiers, passwords, API keys, MFA codes or other restricted data.

a. Tool inputs we receive

The connector exposes 17 read-only tools: search, fetch, search_wallets, get_wallet, search_credential_types, get_credential_type, search_organizations, get_organization, search_issuers, get_issuer, search_relying_parties, get_relying_party, search_use_cases, get_use_case, explain_terms, list_site_content and read_site_page. When you ask ChatGPT to use the app, it may send us the following inputs:

• Free-text lookup terms: search, query, terms (glossary terms), tag, tags and authority.
• Catalog item identifiers: id, orgId, walletId and credentialCatalogId.
• Structured filters: country, role, certification, trustService, sector, ecosystem, theme, category, credentialKind, vcFormat, environment, subjectType, type (wallet type), platforms, capabilities, protocols, interoperabilityProfiles, openSource, status, readiness, interactionMode, featured, productionDeployment and hasIssuers.
• Pagination and sorting: sort, direction, page and size.
• Website browsing: list_site_content takes no input. read_site_page receives an exact FIDES page or post slug or URL, plus an optional character offset to continue reading a long page. The URL must belong to the configured FIDES Community website.

These inputs are limited to the values needed to perform the requested lookup. Because free-text inputs can contain whatever you type into ChatGPT, please do not include sensitive personal data in prompts intended for the connector.

b. Tool outputs we return

The connector returns public FIDES directory, glossary and website information:

• Wallet records and summaries: name, provider, organization id, country, type, status, open-source flag, platforms, supported credential formats, capabilities, interoperability profiles, website, detail URL and API URL.
• Credential type records and summaries: id, display name, credential kind, VC format, authority, schema information, sectors, ecosystems, themes, category, tags, issuer availability, detail URL and API URL.
• Organization records and summaries: id, name, country, sectors, ecosystem roles, website, certifications, trust-service codes, detail URL and API URL.
• Issuer records and summaries: id, display name, organization id, country, environment, credential issuer URL, website, credential configuration information, detail URL and API URL.
• Relying party records and summaries: id, name, country, readiness, status, interaction mode, sectors, accepted credential formats, provider, website, detail URL and API URL.
• Use case records and summaries: id, title, summary, sector, organization name, country, deployment status, interaction modes, credential formats, tags, more-information URL, detail URL and API URL.
• Generic search and fetch results across the catalogs: result ids, titles, text summaries, catalog-type metadata, canonical URLs and API URLs.
• Glossary definitions, including term, name, type, description and reference URL.
• Website browsing: list_site_content returns the titles, slugs, URLs, headings and heading counts of published FIDES Community pages and posts. read_site_page returns up to 30,000 characters of plain text per call, with the page title, URL, page/post type, modification time and pagination details. Further calls can read more of a long page. Public pages may contain names or business contact details.

We apply data minimization to every response: internal operational metadata used to build the catalogs (such as crawl timestamps and internal source paths) is removed before a response is returned.

The connector returns public information only. It returns no private FIDES account data and no private ChatGPT account data. Public catalog records may include business contact details or names published by organizations or compiled from public sources; those details can constitute personal data under data protection laws.

c. Purposes of processing

We process connector inputs and outputs to:

• answer your catalog, glossary or FIDES website lookup request;
• operate and secure the MCP endpoint;
• apply rate limits and prevent abuse;
• debug reliability issues;
• maintain public catalog quality and understand aggregate usage.

We do not use connector inputs or outputs for advertising profiling, sale of personal data, automated decisions with legal effects, or training our own AI models.

d. Recipients and processors

Connector requests and responses may be processed by:

• FIDES Labs BV, as operator of the FIDES Ecosystem Explorer;
• hosting and infrastructure providers that run api.fides.community, including Vercel;
• upstream FIDES catalog backends used to retrieve the requested public catalog records;
• the FIDES Community website / WordPress API when list_site_content or read_site_page is used;
• the public FIDES vocabulary source when the explain_terms tool is used;
• Matomo Cloud (EU) for aggregated, cookieless usage analytics that include no free-text query content and no IP addresses;
• the AI assistant provider you chose, such as OpenAI or Anthropic, because it sends the tool request on your behalf and receives the tool response.

We do not sell, rent or trade connector data and do not share it for third-party marketing.

e. Retention

• Operational MCP request logs, if created, are kept for up to 30 days for security, abuse prevention, debugging and operations, then deleted or aggregated into non-identifying statistics.
• Aggregated usage analytics may be kept longer for trend analysis, but include no IP addresses, no free-text query content and no information intended to identify individual users.
• Public catalog records remain available for as long as the relevant entry is part of the FIDES public catalog, unless updated or removed.
• We do not store a long-term ChatGPT conversation history for connector use.

f. User controls

You can stop connector processing at any time by not invoking the app or by removing the FIDES Ecosystem Explorer connector from your AI assistant. You can avoid sending personal data by keeping prompts and search terms limited to catalog lookups. For privacy questions or GDPR rights requests, contact privacy@fides.community.

Because the connector requires no FIDES account, we may not be able to identify a particular unauthenticated request in short-lived technical logs. For public catalog entries about your organization, contact us to request correction, update or removal where applicable.

1. Who we are

This service is operated by FIDES Labs BV, Vredenburg 40, 3511 BD Utrecht, the Netherlands (“we”, “us”). For the processing described in this policy, FIDES Labs BV is the data controller unless stated otherwise.

For any privacy question or to exercise your rights, contact us at privacy@fides.community.

This policy concerns the processing of personal data. The use of cookies and similar tracking technologies on the website is described separately in our Cookie Policy, where you can also manage your consent.

This policy applies to:

• the FIDES website at fides.community, including contact forms, optional sign-in, submissions and account features;
• the FIDES Ecosystem Explorer and related catalogs;
• the public catalog APIs served at api.fides.community;
• the AI connector / MCP server at api.fides.community/api/mcp;
• the conversational assistant offered on the FIDES website;
• paid plans, subscriptions, checkout, billing and account access related to the Service.

2. In short

• The public FIDES catalogs, APIs and AI connector are an open directory; no account or login is required to browse or query the public catalog.
• FIDES is built on the principle that organizations remain in control of the information they choose to publish, maintain or manage through the Service.
• The AI connector only receives the search terms, filters and item identifiers needed to perform a lookup, and returns public catalog, glossary and website content. It does not receive your AI account, identity or conversation history.
• The website also offers optional sign-in, contact forms, community features, submissions and paid plans. These involve some personal data.
• Payments and subscriptions are processed through third-party checkout and payment providers, including SureCart and Mollie.
• We do not sell personal data and we do not use the catalogs, APIs or connector for advertising profiling or automated decision-making with legal effects.
• We keep only the data needed to run, secure and improve the Service, manage accounts and subscriptions, provide support, comply with legal obligations and respond to you.
• When you use the website conversational assistant, the text of your question is sent to an AI language model provider to generate an answer.
• Cookies and tracking on the website are covered by our separate Cookie Policy.

3. What information we process

a. Catalog content and public organization data

The catalogs contain information about organizations and their products, services or activities in the digital-identity and digital-trust ecosystem, such as names, websites, logos, supported standards, use cases, contact details, countries, sectors and related metadata.

This information may be published by the organizations themselves, submitted by users, obtained from public registries, or compiled from trusted public sources. It is intended to be public and is not used to profile individuals.

FIDES is built on the principle that organizations should remain in control of the information they choose to make available about themselves, their products, services, credentials, wallets, issuers, relying-party activities, technologies and use cases.

The FIDES Ecosystem Explorer acts as a federated discovery platform. FIDES aggregates, structures, indexes and makes information discoverable and accessible through the website, Ecosystem Explorer, APIs, MCP server, AI assistant and other discovery services, while enabling organizations to publish, maintain and control information about themselves where relevant account or listing management features are available.

For public catalog information provided, approved or managed by organizations, those organizations remain responsible for the accuracy, legality and maintenance of the information they publish, submit, approve or manage through the Service.

For public catalog information obtained from public registries or trusted public sources, those registries or sources remain responsible for their own published information. FIDES may structure, index, summarize, classify, link or display that information to make it discoverable within the Service.

Publication, aggregation, indexing or display of information through the Service does not transfer ownership of that information to FIDES. Organizations and other rightsholders retain any rights they hold in the information they publish, submit, approve, manage or otherwise make available. FIDES receives only the rights needed to operate, display, structure, index, distribute and make the information discoverable through the Service, as further described in the Terms of Service.

FIDES may create derived metadata, classifications, tags, indexes, summaries, links and technical identifiers to make catalog information searchable and interoperable. These FIDES-created structures and metadata may be used by FIDES as part of the Service.

b. Technical and usage data

When you visit the website or call our API or MCP endpoint, our servers and infrastructure providers automatically process standard request data such as IP address, timestamp, requested endpoint or tool, request parameters, response status, latency and user-agent.

We use this to operate the Service, ensure security, apply rate-limiting, prevent abuse, debug errors and understand aggregate usage.

c. Conversational assistant input

If you use the assistant on the website, we process the text you type and queries derived from it to answer your question. We do not ask for and do not need sensitive personal data to answer. Please do not enter sensitive personal information in the chat.

d. Contact forms and enquiries

If you contact us through a website form or by email, we process your name, email address, organization, message and any other details you choose to include, so that we can read, respond to and follow up on your enquiry.

e. Sign-in, accounts and community features

The website offers optional sign-in using your email address. We process your email address to authenticate you and to associate your account with actions such as submissions, likes, voting, listing management or access to paid features.

Depending on the features you use, we may also process your name, organization, role, account status, permissions, submitted content, votes, likes, preferences and activity related to your account.

f. Paid plans, subscriptions and billing

If you purchase or manage a paid plan, such as FIDES Pro, we process information needed to provide the plan and administer the subscription, including:

• name and email address of the billing or account contact;
• organization name;
• billing address;
• country;
• VAT or tax identification number where provided;
• plan, price, billing period and subscription status;
• order, invoice and payment status;
• customer portal and subscription management information;
• limited payment metadata, such as payment method type, transaction status and payment provider references;
• support correspondence related to billing, access, cancellation or renewals.

We do not store full credit card, bank account or payment authentication details on our own systems.

g. Cookies and website analytics

The website uses functional, statistics and optional marketing cookies, including privacy-friendly analytics and embedded content. These are only placed in line with your choices and are described in detail in our Cookie Policy, where you can manage consent.

The catalog APIs and the MCP connector set no cookies.

4. The AI connector — tool inputs and outputs

This section summarizes the connector. The app-specific disclosure of current tool inputs and outputs is at the top of this page (subsections a–f).

The AI connector is a read-only Model Context Protocol server. When you add it to an AI assistant such as ChatGPT or Claude, the assistant calls our tools on your behalf to look up entries in the public FIDES catalogs, glossary and website.

a. What the connector receives

The assistant sends us only what is needed to perform a lookup:

• free-text search terms;
• structured filters such as country, sector, organization, credential format, interaction mode, platform, status, tags or pagination;
• item identifiers for a specific catalog record.

These inputs can contain whatever you type, so please do not include sensitive personal data in your prompts.

b. What the connector returns

The connector returns public directory information only, such as catalog records, glossary definitions and public website content, often with a canonical URL for citation. It returns no personal account data about users; however, public catalog records may include business contact details published by organizations, which can constitute personal data under the GDPR.

c. What the connector does not collect

We do not receive or store your AI assistant account, identity or conversation history. No FIDES login or account is required to use the connector.

d. Logging and analytics for the connector

For security and reliability, short-lived operational request logs may record standard metadata such as timestamp, tool called, parameters, response status, latency, user-agent and IP address for rate-limiting. These logs are deleted or aggregated into non-identifying statistics within 30 days.

Separately, we keep aggregated, cookieless usage statistics in Matomo (Matomo Cloud, EU) to understand how often tools or endpoints are used and the coarse type of AI assistant calling them. This stores no IP address and no free-text content of your queries; these statistics are not used to identify you.

5. Why we process personal data and our legal basis

We process personal data for the following purposes and legal bases:

• To provide the public Service, catalogs, APIs, MCP connector and assistant: our legitimate interest in offering and maintaining an open ecosystem directory and, where applicable, to perform the action you request.
• To respond to enquiries: your consent and/or our legitimate interest in handling and following up on your request.
• To authenticate users and provide account features: necessary to provide the account or community feature you choose to use.
• To manage submissions, likes, votes and official listings: our legitimate interest in operating a reliable ecosystem directory and, where applicable, performance of an agreement with you or your organization.
• To inform registered users about platform features, interoperability developments, participation mechanisms and other updates relevant to the use of their FIDES account: our legitimate interest in operating, maintaining and improving the Service.
• To provide paid plans and subscriptions: necessary for the performance of a contract, including checkout, account access, subscription management, renewal, cancellation and customer support.
• To process payments and issue invoices: necessary for the performance of a contract and compliance with legal, tax and accounting obligations.
• To validate VAT or tax information and maintain records: compliance with legal obligations and our legitimate interest in correct billing and fraud prevention.
• To secure and maintain the Service: our legitimate interest in keeping the Service safe, reliable and available.
• To send transactional service emails: necessary for the performance of a contract or our legitimate interest in providing account, order, subscription, payment and security notices.
• To comply with legal obligations, resolve disputes and enforce our Terms: compliance with legal obligations and our legitimate interest in protecting the Service.

We do not rely on your data for automated decision-making with legal effects.

6. Who receives the data

We share personal data only where needed to operate the Service, process payments, provide subscriptions, host infrastructure, respond to you or comply with legal obligations.

Recipients may include:

• Hosting and infrastructure providers: the website, APIs, gateway and catalog backends are hosted by our hosting and infrastructure providers, including Vercel and the website hosting provider.
• Checkout and subscription management: SureCart is used to support checkout, customer records, orders, subscriptions and related account or payment workflows.
• Payment providers: payments may be processed by Mollie and other payment providers made available at checkout. Payment providers process payment-related personal data for payment execution, fraud prevention, compliance with financial regulations and related purposes. Depending on their role and legal obligations, they may act as independent controllers or processors.
• AI assistants you connect: if you add our connector to a third-party assistant such as ChatGPT or Claude, that assistant sends requests to our endpoint on your behalf and receives public responses. Your use of that assistant is governed by that provider’s own privacy policy.
• AI language model providers: when you use the conversational assistant on our website, your question is transmitted to OpenAI and/or Mistral AI to generate a response. We configure these providers so that your inputs are not used to train their models where such controls are available.
• Contact forms: form submissions are processed through our website form tool and emailed or stored within our WordPress environment. Spam-prevention services may be used on forms.
• Usage analytics: we keep aggregated, cookieless usage statistics of the website, catalog APIs and AI connector in Matomo (Matomo Cloud, EU); this stores no IP address and no free-text query content. Website cookies and embedded third-party content are described in our Cookie Policy.
• Professional advisers and authorities: where necessary, data may be shared with accountants, legal advisers, tax authorities or regulators.

We do not sell, rent or trade personal data, and we do not share it for third-party marketing.

7. International transfers

Some providers may process personal data outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as EU Standard Contractual Clauses, adequacy decisions or other lawful transfer mechanisms.

For the AI connector, transfers to an AI assistant provider may occur within the assistant you chose to use and are governed by that provider’s own terms and privacy policy.

8. How long we keep personal data

We keep personal data only for as long as needed for the purposes described in this policy, unless a longer retention period is required by law.

• Technical and usage logs, including connector requests: retained for up to 30 days for security and operations, then deleted or aggregated into non-identifying statistics.
• Aggregated usage analytics: retained for trend analysis where it does not identify individuals.
• Conversational assistant input: processed to answer your question and not stored by us as a long-term conversation history; short-lived operational logs may briefly contain request data.
• Contact form messages: retained for as long as needed to handle your enquiry and for a reasonable period afterwards.
• Sign-in and account data: retained for as long as your account remains active, then deleted or anonymized unless retention is needed for legal, security, dispute or accounting reasons.
• Subscription and billing data: retained for as long as the subscription or customer relationship is active and afterwards as needed for support, disputes, legal obligations and accounting or tax retention requirements.
• Invoices, order records and tax-relevant data: retained for the legally required accounting and tax retention period.
• Catalog content: retained for as long as the entry is part of the public catalog, unless removed or updated.

9. Your rights and controls

Under the GDPR you have the right to request access to, rectification of, erasure of, or restriction of processing of your personal data, to object to processing, and to data portability where applicable.

If you have an account, you may be able to update or delete certain account information yourself. To exercise any other right, email privacy@fides.community.

AI connector: because the connector requires no account, there is nothing stored about you to delete on our side beyond the short-term operational logs described in section 4d. You can stop all processing at any time by removing the connector from your AI assistant; any prompt or conversation history held by that assistant is controlled through the assistant provider (OpenAI / Anthropic).

You also have the right to lodge a complaint with your local data protection supervisory authority.

For anonymous browsing or unauthenticated API/MCP use, we may be unable to identify you from technical logs alone. For accounts, subscriptions, contact forms and billing records, we can usually locate data using the email address or organization details you provided.

Please note that some data, such as invoice and tax records, may need to be retained despite an erasure request where we are legally required to keep it.

10. Transactional emails

We may send transactional or service emails related to account access, email verification, platform features, interoperability updates, participation features, important changes to the Service, orders, subscriptions, payment confirmations, invoices, renewals, failed payments, cancellations and security notices.

These emails are necessary to provide the Service and manage your account or subscription. They are not marketing emails.

Registered users may opt out of non-essential platform update emails. This does not affect service emails required for the operation, security or management of their FIDES account.

11. Security

We serve traffic over HTTPS and apply technical and organizational measures designed to protect the data we process. The public catalog APIs and MCP connector are read-only. We apply rate-limiting and other controls where appropriate.

No method of transmission or storage is completely secure, but we take reasonable steps to protect personal data against unauthorized access, loss, misuse or alteration.

12. Children

The Service is intended for professional and general audiences and is not directed at children.

Paid plans are intended for organizations and professional users.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and revise the “Last updated” date above.

14. Contact

FIDES Labs BV
Vredenburg 40
3511 BD Utrecht
The Netherlands
privacy@fides.community