Last updated: 20 September 2026
This notice explains how Crimson Consulting SL processes personal data when you use ABAPilot, including the ABAPilot Portal and the ABAPilot integration for ChatGPT and other MCP clients.
Who is responsible
Crimson Consulting SL is the controller for the ABAPilot account, licensing and service data described in this notice. Privacy questions and rights requests can be sent through our contact page or to nicolashernandez@crimsonconsultingsl.com.
Data we process
- Account data: name, business email address, tenant or organization identifier, assigned role and assigned SAP systems.
- Authentication data: OAuth client metadata, short-lived access tokens, authorization codes and hashed refresh tokens. We do not store your SAP password in the hosted OpenAI integration.
- Tool requests: the assigned SAP system identifier and parameters needed for the tool you invoke, such as a custom object name or an SAP error message.
- Tool responses: results returned by the customer-controlled SAP connector, such as authorized Z/Y custom source or diagnostic results. These results are returned to the MCP client that initiated the request.
- Operational data: timestamps, service status, usage counters, error information and security audit records needed to operate, protect and troubleshoot the service.
The hosted MCP service does not persist ABAP source code or table contents as application records. Infrastructure and security logs may contain request metadata and error information, but are not intended to record SAP credentials, source code or business table contents.
How ABAPilot uses the data
We use this data to authenticate users, enforce tenant and SAP-system assignments, execute requested read-only tools, protect the service, diagnose failures, meet contractual obligations and improve service reliability. We process the data to perform our contract with the customer, to comply with legal obligations and for our legitimate interests in securing and operating ABAPilot.
ABAPilot does not sell personal data and does not use customer SAP source code or tool results to train ABAPilot models.
ChatGPT and other MCP clients
When you connect ABAPilot to ChatGPT, Codex or another MCP client, that client receives the tool inputs and results required to answer your request. The client provider processes that data under its own terms, privacy notice and workspace data controls. Your organization should choose an account and data-control configuration appropriate for the SAP information it permits users to access.
SAP and security boundaries
SAP remains an authorization boundary. ABAPilot only exposes systems assigned to the authenticated Portal user, and the public OpenAI integration is read-only. Customer connector and relay credentials are not returned to the MCP client. SAP passwords remain in the customer-controlled connector flow and are not stored by the hosted MCP integration.
Hosting and service providers
The ABAPilot Portal and hosted MCP service run on Microsoft Azure in West Europe. We may use hosting, monitoring, email and website providers as processors where needed to deliver the service. When a user connects an external MCP client such as ChatGPT, that provider processes the data as described above.
Retention
OAuth authorization codes expire after 10 minutes. Access tokens expire after one hour. Refresh tokens expire after 30 days or earlier when revoked. Account, assignment, audit and operational records are retained while the service is active and afterwards only as needed for security, contractual, accounting or legal purposes. Expired authentication records and backup copies may remain until routine cleanup and backup rotation completes.
Your choices and rights
You can revoke an ABAPilot authorization from the connected client or ask your organization administrator to remove your SAP-system assignment. Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and you may complain to the Spanish Data Protection Agency or your local supervisory authority.
Changes
We may update this notice when ABAPilot, its integrations or applicable law changes. The date at the top identifies the current version.