Privacy Policy — ECZ-ID Resolver check in ChatGPT

When you ask an official ECZ-ID GPT to check an identifier, the GPT calls one operation:

GET https://api.ecocitizenz.com/api/p/{ecz_id}.json

It receives the public projection for that ECZ-ID and reports it back to you in the conversation. That is the whole of the action.

It is read-only: a single GET operation, with no authentication, no write path and no payment path. It cannot create, change, activate or revoke anything, and it does not process a transaction.

The action does not transmit to EcoCitizenz:

• your prompt text, or any other message in the conversation;
• your conversation history, or the GPT's replies;
• your name, email address, account identifier or organisation;
• your IP address, browser, device or location;
• any file you have uploaded, or anything read from one;
• any identifier of you as a ChatGPT user.

EcoCitizenz therefore cannot associate a lookup with a ChatGPT user, and does not attempt to. We have no way to tell whether two lookups came from the same person.

Requests to this public API produce ordinary server logs. A log entry contains the ECZ-ID that was requested, the time of the request, and the calling IP address — which, as set out above, is OpenAI's rather than yours.

Those logs are kept for operational and security purposes: keeping the service running, diagnosing faults, and detecting abuse of a public endpoint. This page states no retention period, because we will not publish a number we do not actually enforce. Questions about information we hold go through the general EcoCitizenz Privacy Policy.

This is the point we would rather over-explain than let you discover later. An ECZ-ID is not always anonymous in effect.

Resolving ECZ-GB-EXAMPL tells us that somebody was interested in that subject at that moment. The subject of a lookup is a business or a machine credential, not the person asking — so this is not a record about you — but the interest itself is visible to us in the logs described above.

The practical advice: if the fact that you are checking a particular identifier is something you need to keep confidential — a counterparty you have not approached, an acquisition target, a supplier under review — do not paste that identifier into a GPT. Read the public record directly at https://resolver.ecocitizenz.org/p/{ecz_id} instead, or through your own client.

Only the public projection for that ECZ-ID — the same data any member of the public can already read at https://resolver.ecocitizenz.org/p/{ecz_id}.

No private record is returned. No customer data is returned. No data belonging to any other user is returned. There is no endpoint behind this action that could return any of those, because the route is the public projection and nothing else.

This action adds no analytics, telemetry, advertising or tracking code. It sets no cookies. It creates no user identifier, and appends none to any link the GPT gives you: a Resolver link returned in a conversation carries no query parameter identifying you or the session it came from.

The action itself calls no third-party service. It contacts one host, api.ecocitizenz.com, which is operated by EcoCitizenz.

ChatGPT is not ours.It is operated by OpenAI under OpenAI's own privacy policy and terms of use. Your conversation, your account and everything the platform does with them are governed by those documents, not by this one. EcoCitizenz does not control that processing, is not a party to your agreement with OpenAI, and cannot make commitments on OpenAI's behalf.

OpenAI makes the same point in the other direction, and it is worth repeating here: information sent to a third-party service through a GPT action is governed by that service's policy. When this action runs, that third-party service is EcoCitizenz, and this page is that policy.

The controller for the processing described on this page is EcoCitizenz Ltd, trading as EcoCitizenz, company number 17348848, registered in England and Wales.

Where the limited information described above amounts to personal data, we rely on legitimate interests under the UK GDPR: operating and securing a public identity resolution service. No special-category data is processed by this action.

Data subject rights, and the route for a complaint to the Information Commissioner's Office, are set out in the general EcoCitizenz Privacy Policy, which this page supplements rather than replaces. Governing law is that of England and Wales.

If the action's handling of information changes, this page is updated before or alongside the change, and the effective date is revised. The effective date above is the date this page was published; it is not backdated.

This policy covers the ChatGPT action only. Separate notices cover the ECZ-ID Resolver Check browser extension and each ECZ-ID agent plugin. Those products behave differently and say so in their own words.