Privacy Policy — Punktero AI services
Last updated: 18 September 2026
1. Who we are
This service is operated by Punktero solutions, s.r.o., Pavlovská 502/12, Kohoutovice, 623 00 Brno, Czech Republic, company ID 068 74 959, registered in the Commercial Register kept by the Regional Court in Brno, section C, file 104838. Contact: support@punktero.com.
2. What this service does
Punktero AI services (ai.punktero.com) is a gateway that lets an AI assistant of your choice — for example Claude, ChatGPT, or an agent you run yourself — work with your own accounts in third-party services through the Model Context Protocol (MCP) and an OpenAPI interface. You create a server instance, connect your account to it, and your assistant can then call the tools of that instance on your behalf.
3. Google user data we access
We access Google data only after you explicitly authorize it on Google's consent screen, for one specific instance that you created, and only through the scopes listed below. Authorizing one instance never grants access to a different Google service.
| Scope | What we do with it |
|---|---|
https://www.googleapis.com/auth/adwords | Read reporting data from the Google Ads accounts you select — campaigns, ad groups, keywords, search terms and their performance. Our Google Ads tools never create or modify anything. |
https://www.googleapis.com/auth/analytics.readonly | Read Google Analytics 4 reports and metadata for the property you configure. |
https://www.googleapis.com/auth/content | Read Google Merchant Center account status, product issues and performance reports for the account you configure. |
https://www.googleapis.com/auth/spreadsheets | Read and write values in the spreadsheets you identify by ID or URL — reading ranges, searching values, appending rows, updating and clearing ranges. |
https://www.googleapis.com/auth/drive.file | Read and write only the Google Drive files you hand over to us through the Google file picker, plus the files we create ourselves in our own folder in your Drive. We cannot see the rest of your Drive. |
https://www.googleapis.com/auth/webmasters.readonly | Read Google Search Console data for the sites you have verified. |
https://www.googleapis.com/auth/userinfo.email | Read the e-mail address of the account. We use it to identify you when you sign in with Google, and Google Merchant Center requires it as the developer contact when registering our Cloud project with your account. |
openid | Sign you in with your Google account. It gives us the identifier Google uses for your account, so that we recognise you on your next sign-in. |
https://www.googleapis.com/auth/userinfo.profile | Read your name and profile picture, so that the application shows your name instead of your e-mail address. |
4. How we use it
Data returned by Google APIs is used solely to fulfil the request your AI assistant made at that moment. We do not sell it, we do not use it for advertising, and we do not use it to create, train, or improve any generalized artificial intelligence or machine-learning model.
5. Who it is shared with
The result of every tool call is returned to the MCP or OpenAPI client you connected, because that is what you asked the service to do. If that client is a third-party AI assistant, its provider processes the data under its own terms, which you accepted with that provider. Beyond that, we do not share Google user data with anyone; we disclose it only where the law requires us to.
The application never sends your Google data to an AI model on its own. Our MCP servers and our model gateway are two separate services: data moves from one to the other only when you connect them yourself, the same way you would connect any third-party assistant. If you do connect an assistant that runs on our gateway, the models behind it are commercial APIs — Anthropic and OpenAI — that do not use customer data for training under their API terms, and open-weight models that we run on our own hardware in our own network, so that data never leaves our infrastructure.
6. What we store and for how long
- Your account. If you sign in with Google, we store the identifier of your Google account, your e-mail address and your name for as long as your account with us exists.
- Files we create in your Drive. Files the assistant creates through the Google Drive tools stay in your own Google Drive, in a folder we create for that purpose. They are yours: deleting your instance with us does not delete them, and you can remove them at any time.
- Authorization. The refresh token issued by Google and the settings of your instance are stored in our database for as long as the instance exists. Deleting the instance deletes them.
- Request logs. Every tool call is logged with its parameters and its response and is deleted automatically after 30 days. We use the logs to troubleshoot failures and to detect abuse. Access is limited to administrators of the service.
- Temporary files. If you use a tool that stages a file for transfer between services, the file is stored on our server and deleted when it expires, by default after 60 minutes.
- Deleted accounts. Deleting your account deletes the stored authorizations and settings of every instance you had, and revokes the Google grants those instances held, together with your LiteLLM API keys, vector stores, server tokens and temporary files. Files already created in your Drive stay there, as described above. Request logs are anonymized rather than deleted — they keep no link to the deleted account and age out on the same 30-day schedule as any other log. The deletion itself is recorded in our administrative audit log together with the account's name and e-mail address, kept for up to 90 days like every other audit log entry.
7. Limited Use
Punktero AI services' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
8. How to withdraw access
Delete the instance in the admin interface, or revoke the authorization at myaccount.google.com/permissions. Either stops all further access immediately. Request logs already created are deleted on the 30-day schedule described above.
You can also delete your account entirely, on the Account page inside the application. That removes every server instance you have together with the authorizations stored in them, your LiteLLM API keys, vector stores, server tokens and temporary files, and revokes the Google grants those instances held. It cannot be undone.
9. Security
All traffic to the service is encrypted with TLS. Access to the production database and to request logs is limited to named administrators of Punktero solutions, s.r.o. We report security incidents affecting user data in line with our incident response procedure.
10. Other documents
The consent to the processing of personal data for marketing purposes covers our commercial communications and is separate from this policy.