Privacy policy.

1. Who is responsible for the data?

This policy covers skogmcp.com and Skog MCP. Details of the organisation acting as data controller must be filled in before this becomes a final policy.

Legal name

To be completed

Registration number and address

To be completed

Contact for privacy enquiries

To be completed before launch

2. What data is covered?

When you visit the website, Cloudflare may process technical information, such as your IP address, time of access, requested URL and browser information, to deliver and protect the site. The website has no separate account login.

In the plugin, your forest management plan may contain property identifiers, map areas, owner information, stands, tree species, ages, standing timber volumes and proposed actions. Information that can be linked to an individual is personal data.

A future service running on servers may also need to handle account identifiers, contact details, uploaded files, processed plan data and support enquiries. The final list must describe the data actually used.

3. Why do we use the data?

Planned purposes are to open and display your plan, save it for continued use, answer questions in ChatGPT, provide support and protect the service against abuse.

Provisionally, contract is the legal basis for data needed to provide the service you request. Security and necessary operations may rely on legitimate interests following a documented balancing assessment. Legal obligation applies where processing is required by law. Any optional purposes requiring consent must be offered separately.

The legal basis must be established for each processing activity before launch. Data about other people in a plan needs a separate assessment. This policy provides information and does not itself constitute consent to processing.

4. How it works today

The interactive example on the website uses fictional stands and prewritten answers. It makes no AI calls and does not upload your files.

The current plugin prototype uses a local MCP server connected to ChatGPT through a secure tunnel. When you select a file in the plugin view, it is transferred to that server. Plan information needed for the conversation is shared with ChatGPT. Procedures for the prototype's temporary files and logs need to be documented in the next policy version.

5. Planned storage within the EU

We plan to let you upload and save forest management plans on servers through Cloudflare, so you can return to your plan. The intention is to store original files, saved plan data and associated backups within the EU.

Server storage has not launched. Storage location, access, operations, logs and backups must be checked and documented before the feature becomes available. Only upload plans you have the right to use in the service.

Planned EU storage of your files does not guarantee that all web traffic or all processing by ChatGPT takes place within the EU. Providers' processing and any transfers outside the EU/EEA must be assessed, and applicable safeguards described in the final policy.

6. Cloudflare and ChatGPT

Cloudflare is used to host and protect the website and is intended for future server storage. Necessary data processing agreements, subprocessors and operating settings must be verified for the future service.

ChatGPT is provided by OpenAI. When you use the plugin, relevant plan information may be included in the conversation. OpenAI's handling is also governed by your account, your settings and OpenAI's privacy policy. Skog MCP's planned EU storage does not include a promise about OpenAI's storage location or use of conversation data.

7. How long is data retained?

The planned principle is to retain data only for as long as needed for its purpose. Saved plans should be removable when you request deletion or close the service, except for data that must be retained by law.

To be completed: exact periods for plan files, account information, temporary files, support, security logs and deletion from backups. Deletion functionality and time limits must be verified before server storage launches.

8. How is your plan protected?

The website uses HTTPS. Before server storage launches, access must be restricted to authorised users and necessary operations staff. Encryption, access controls, backups and incident procedures must be implemented and verified. The final policy must describe the safeguards actually in place.

9. Your rights

Under the GDPR, you can request access to your personal data, correction, erasure, restriction and, in some cases, portability. You can object to processing based on legitimate interests and withdraw consent where processing relies on it. These rights apply subject to the conditions in the GDPR.

Contact details for these requests must be filled in under section 1. You also have the right to complain to the Swedish Authority for Privacy Protection, IMY.

10. Cookies and tracking

The website's own code uses no analytics or marketing cookies and embeds no tracking scripts. Cloudflare may use necessary security features. ChatGPT has its own cookie rules when you go there. If optional tracking is introduced, this information and any consent options must be updated first.

11. When will the policy be updated?

This is version 0.1, dated 2 October 2026. The policy must be updated when the responsible organisation and actual procedures are established, and before planned server storage launches. The current version must be available on this page.

The draft's structure follows IMY's guidance on privacy policies.