Privacy Policy

Codex and ChatGPT plugins: how your data is handled

This policy covers plugins published by The Doers Firm for Codex and ChatGPT, including skill packages and any separately identified apps or integrations. The plugin listing, installed version, requested permissions, and connected services determine which features are available. Installation does not by itself give The Doers Firm access to your account, conversations, repository, or device.

For a skills-only plugin, the package supplies instructions and supporting resources to the host assistant. Using those instructions does not itself send your prompts, files, source code, or outputs to a server operated by The Doers Firm. Codex or ChatGPT may process task context using the platform tools and permissions you have enabled. OpenAI handles that processing under its own terms, privacy policy, and your account or workspace settings.

An authorized workflow may read or edit local files, run commands, inspect a browser, create artifacts, or use connected services. Those capabilities depend on the host and installed tools; a skill is not an independent permission grant. Files and outputs written in your workspace remain there until you delete them or a workflow you authorize transfers them.

Data sent to us and other recipients

We receive contact details, support messages, attachments, and diagnostic information you choose to send to us. These are used to answer requests, investigate reported faults, and maintain our products. Website hosting and email delivery providers process the data needed to deliver those services. Contact-form delivery may use FormSubmit or Resend depending on the service configuration.

If a particular plugin version includes a developer-operated service, its service notice must identify the operator, inputs, purpose, recipients, retention, and controls before you connect or send data. Do not assume all plugins include such a service. A connected app or external API receives the inputs sent to its tools, under that provider’s policy. Inputs may include prompts, selected files or excerpts, URLs, request parameters, and authentication metadata required for the task. We do not obtain platform passwords simply because you install a plugin.

Retention, training, and tracking

There is no developer-side copy or retention period for task content that is never sent to us. OpenAI and connected providers have their own retention and model-training settings; this policy does not change those settings. Local artifacts remain under your control. We do not use plugin task content received through support to train our own foundation models or sell it.

Support enquiries and voluntarily supplied diagnostics are covered by the enquiry retention period below: up to 24 months after our last contact, or earlier deletion on request unless a legal obligation or active dispute requires retention. Avoid sending passwords, API keys, access tokens, or unnecessary personal data in diagnostics. A service-specific retention period must be disclosed for a developer-hosted integration; the general AI-request period below does not describe OpenAI or local workspace retention.

Our skills-only packages do not add a developer analytics endpoint or independent conversation tracking. Platform usage reporting, connected-provider logs, and website access logs are separate. We do not claim access to your full platform conversation history through a skill installation.

Your controls and privacy requests

You can disable or uninstall a plugin, disconnect connected services, revoke provider access, change workspace permissions, and delete local artifacts using the controls of the relevant host or provider. Uninstalling does not erase existing conversations, local files, or records already retained by a connected service.

Contact thedoersfirm@gmail.com for access, correction, deletion, or other rights concerning data we actually hold. Identify the plugin and version, the relevant service or support request, and the data concerned. Do not send secrets or your full conversation history. We cannot delete records held solely by OpenAI or another provider; use that provider’s data controls.

1. Introduction

The Doers Firm ("we", "us", "our") respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices and rights available to you.

This policy applies to our website at https://thedoersfirm.com, our design and development services, and our digital products, including any AI-powered tools and Codex plugins and ChatGPT applications, GPTs, plugins, and actions that we publish or operate (together, the "Services").

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services.

2. Who is responsible for your data

The Doers Firm LTD is the data controller responsible for the personal data described in this policy. We are based in the United Kingdom.

For any privacy question, request, or complaint, contact us at thedoersfirm@gmail.com. We aim to respond within one business day.

3. Information we collect

We only collect information that is necessary to operate our business and provide the Services. The categories of information we may collect include:

3.1 Information you provide directly

Contact details such as your name, email address, company name, and telephone number when you submit a form, email us, or start a project.
Project information such as your requirements, brief, budget range, timelines, and any files or content you choose to share with us.
Account information such as a username, email address, and authentication credentials when you register for one of our products.
Payment information such as billing name, billing address, and transaction history. Full card details are handled by our payment processors and are never stored on our servers.
Communications including emails, chat messages, support requests, and feedback you send to us.

3.2 Information collected automatically

Device and usage data such as IP address, browser type, operating system, referring pages, pages viewed, and the dates and times of your visits.
Cookies and similar technologies used to remember preferences, keep sessions secure, and understand aggregate traffic patterns. See our Cookie Policy for details.
Approximate location derived from your IP address, used for analytics and security purposes.

3.3 Information from third parties

Authentication providers, if you choose to sign in through a third-party service.
Payment processors and fraud-prevention providers who confirm transaction status.
Analytics and advertising partners who provide aggregated reporting.

3.4 Information processed through Codex plugins and ChatGPT applications and plugins

When you interact with a ChatGPT application, GPT, plugin, or action that we operate, the conversation is processed by OpenAI under your agreement with OpenAI and OpenAI's own privacy policy. A developer-operated endpoint receives only the fields sent to that endpoint. Skills-only workflows do not themselves send task content to us.

We do not receive your full ChatGPT conversation history, your OpenAI account credentials through installation alone. The host may use task context within your permissions. When a developer-operated endpoint is explicitly connected, it may process:

The input you submit to the app (such as text, prompts, or parameters).
Files you deliberately upload for processing.
Technical metadata required to route and secure the request.
The output generated by the app, to the extent needed to return a result or improve reliability.

4. How we use your information

We use personal data for the following purposes:

To provide, operate, and maintain the Services, including responding to enquiries and delivering projects.
To process payments, maintain billing records, and prevent fraud.
To communicate with you about your account, projects, support requests, and updates.
To personalise and improve the Services, including debugging, analytics, and product development.
To generate AI outputs through our tools and Codex plugins and ChatGPT applications in response to your requests.
To comply with legal, tax, and regulatory obligations and to enforce our agreements.
To send marketing communications where permitted by law. You can opt out at any time using the unsubscribe link or by emailing us.

5. Legal bases for processing

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Contract — to provide the Services you have requested and perform our agreements with you.
Legitimate interests — to operate, secure, and improve our business, provided your rights are not overridden. This includes fraud prevention, analytics, and direct marketing to existing customers.
Consent — where we ask for your permission, such as for non-essential cookies or marketing to new contacts. You may withdraw consent at any time.
Legal obligation — to retain records, respond to lawful requests, and meet tax and accounting requirements.

We do not sell your personal data. We share it only as described below:

Service providers

We use trusted third parties for hosting, analytics, email delivery, payment processing, and infrastructure. These processors act on our instructions and are bound by confidentiality and data-protection obligations.

Platform providers

When you use a ChatGPT application, GPT, plugin, or action that we operate, requests are routed through OpenAI's platform. Your use of ChatGPT is governed by OpenAI's terms and privacy policy in addition to ours.

Legal and business transfers

We may disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets, in which case we will notify you of any change in ownership or use of your data.

7. Cookies and tracking technologies

We use cookies and similar technologies to operate the Services, remember your preferences, and measure aggregate usage. Essential cookies are required for the Services to function. Non-essential cookies for analytics and marketing are used only where permitted.

You can control cookies through your browser settings and, where available, our consent controls. Blocking some cookies may affect the functionality of the Services. For a full list of the categories we use, see our Cookie Policy.

8. International data transfers

We may process and store data in countries other than the one in which you live, including the United States and the European Economic Area, where our service providers operate. When we transfer personal data out of the UK or EEA, we rely on appropriate safeguards such as the UK International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, and additional technical and organisational measures.

9. How long we keep your data

We keep personal data only for as long as necessary to fulfil the purposes described in this policy, including any legal, accounting, or reporting requirements. Retention periods vary depending on the type of data:

Enquiries and lead information: up to 24 months after our last contact, unless you ask us to delete it sooner.
Project and client records: for the duration of the engagement and up to 6 years afterwards for contractual and tax purposes.
Billing and transaction records: as required by applicable tax and accounting law, typically up to 6 years.
AI application request data: only for as long as needed to return a result and maintain service reliability, generally no longer than 30 days unless you ask us to retain it.
Analytics data: in an aggregated or de-identified form for up to 26 months.

10. How we protect your data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration. These include encrypted transmission (HTTPS/TLS), access controls, least-privilege permissions, secure credential management, and regular review of our infrastructure.

No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security. If a breach affecting your rights occurs, we will notify you and the relevant authorities as required by law.

11. Your privacy rights

Depending on where you live, you may have the following rights over your personal data:

Access — request a copy of the personal data we hold about you.
Correction — ask us to correct inaccurate or incomplete data.
Deletion — ask us to delete your data where there is no lawful reason for us to keep it.
Restriction — ask us to limit how we use your data.
Portability — receive your data in a structured, machine-readable format.
Objection — object to processing based on legitimate interests or to direct marketing.
Withdraw consent — withdraw consent at any time where processing is based on consent.
Non-discrimination — you will not be treated unfairly for exercising your rights.

California and other US state residents

If you are a California resident, you have the right to know, access, delete, correct, and opt out of the sale or sharing of personal information, and the right to limit the use of sensitive personal information. We do not sell personal information. To exercise these rights, email us. You may also designate an authorised agent to act on your behalf.

How to exercise your rights

Email thedoersfirm@gmail.com with the right you wish to exercise. We may ask you to verify your identity before acting on your request. We will respond within the timeframe required by applicable law, normally within 30 days.

12. Children's privacy

The Services are not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

13. Third-party links and services

The Services may link to third-party websites, tools, or platforms, including the OpenAI GPT Store. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing personal data.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice. Where processing requires consent, a policy update does not replace that consent.

15. How to contact us

For privacy questions, data requests, or complaints, contact The Doers Firm at thedoersfirm@gmail.com or by phone at +44 7366 382523. We are based in the United Kingdom.

If you are in the UK or EEA and are not satisfied with our response, you have the right to complain to your local data-protection authority.

Contact

Questions about this policy? Email us and we will respond within one business day.

thedoersfirm@gmail.com Customer Support