PALO Governance privacy notice

Version 1.1. Effective 29 October 2026.

Controller and scope

Fabrizio Degni is the controller for the processing attributable to the PALO Knowledge Reader and PALO support described here. PALO Framework is the project name. Contact info@paloframework.org for privacy questions and requests to exercise your rights.

This notice covers the PALO Governance plugin and the read-only Reader at guide-api.paloframework.org. The plugin is undergoing evaluation and is not published in the public ChatGPT directory. The public canonical Reader at /mcp-public is a separate access surface from the existing Entra-protected /mcp-guide Reader. The existing website privacy notice covers ordinary website browsing. This notice does not replace the privacy information for your ChatGPT or Codex account, Microsoft identity services or other services you use.

Information received and why

The plugin's six packaged workflows help the host prepare governance documentation. When a connected Reader tool is used, the host sends that tool's arguments to PALO over HTTPS. These can include a search query, use-case description, role, objectives, current state, system or deployment details, and a requested knowledge-record identifier. Information you put in those fields can identify people or disclose confidential matters.

The Reader returns released PALO reference materials and source provenance. Some responses reflect the context supplied in the request. The host receives these results and may keep them with the conversation under its own settings. The Reader is not a private-document connector and does not operate your business systems.

The public /mcp-public Reader does not require a PALO account, Microsoft sign-in, OAuth token or MFA. It does not receive a delegated tenant identity or grant access to private repositories. It rejects credential-bearing requests. Anonymous access does not mean anonymous network transport: connection metadata is still processed, and tool arguments may themselves contain personal information.

The separate protected /mcp-guide Reader continues to use Microsoft Entra sign-in. For that protected service only, the Reader validates token issuer, audience, expiry, tenant, client and delegated permissions; tokens can contain user identifiers. Microsoft passwords belong in Microsoft's sign-in flow, never in Reader questions. Entra tenant access and MFA policies have not been changed by the public Reader.

The HTTPS infrastructure processes connection and request metadata, such as IP address, time, request URL, HTTP status and user agent, for delivery, troubleshooting, availability and security. The public route's ordinary nginx access log records time, HTTP method, status, response size and duration; it excludes IP address, query string and request body from that access-log format. Diagnostic/error logs and provider infrastructure may still contain connection or request metadata. The protected route retains its separate access-log format. The connecting IP may belong to the host service rather than the person using it. Runtime diagnostics and errors can also be recorded. PALO support processes the contact details and information you choose to send in correspondence.

Purposes and legal bases

Where the GDPR applies, the bases for PALO's processing are:

Article 6(1)(b), where processing is necessary to supply the requested service under a contract with you or respond to your requested pre-contractual steps.
Article 6(1)(f), for the legitimate interests of providing a limited reference service to authorized users, authenticating access, preventing misuse, diagnosing failures and responding to ordinary support requests where the contractual basis does not apply. These interests must be balanced against your rights; you may object to processing on this basis.
Article 6(1)(c), where processing is necessary to meet applicable legal obligations, including handling data-protection requests.

An OAuth approval is a technical permission, not a claim of GDPR consent. PALO does not use the Reader to make decisions about people that produce legal or similarly significant effects. Its governance outputs require accountable human assessment.

Minimize your input

Use synthetic examples or concise, redacted descriptions. Do not send passwords, tokens, payment details, private case files or raw sensitive personal records. The Reader does not need your private SharePoint, Drive, employee or customer records to retrieve canonical PALO guidance. Minimization instructions do not mean that all sensitive information is automatically detected or removed. Where available, review tool arguments before permitting a call.

Recipients, hosting and international processing

Fabrizio Degni and authorized service administrators may access information as necessary to operate the Reader and handle support or privacy requests. Infrastructure and identity providers process information needed to deliver their services. Authorities or professional advisers may receive limited information where legally required or necessary to establish, exercise or defend legal claims.

The Reader's current Hostinger VPS is in Frankfurt, Germany, with weekly backups shown in Lithuania. The Microsoft tenant's primary data location is shown as United States datacenters; this identity service is used for the protected Reader, not the public anonymous route. The host conversation service and provider support activities remain separate processing components. The connected service is not an EU-only processing service.

Hostinger publishes a data-processing addendum and international-transfer provisions. Microsoft publishes its Products and Services Data Protection Addendum and privacy statement. OpenAI provides privacy information for its host products. Their provisions depend on the service, account and applicable agreement. PALO is verifying the VPS-specific contractual arrangements, provider-side retention and transfer safeguards before public release; this notice does not assert that a particular adequacy decision or contractual safeguard has already been verified for every processing operation. Contact info@paloframework.org for available information or copies of applicable safeguards.

Retention and deletion

The Reader's canonical index contains released reference materials, not a per-user case database. This does not mean zero retention across infrastructure, authentication, host conversations or backups.

Requests and responses: processed to answer the call and return the result. A dedicated per-user request archive is not part of the Reader's canonical index. Runtime, proxy and provider processing must be considered separately; no blanket zero-storage promise is made.
Reader proxy logs and container diagnostics: routed to the dedicated PALO Reader journal namespace, with Docker's additional local cache disabled. An hourly task rotates the active journal and expires archived files older than 13 days, with an additional volume target. The operational target is no more than 14 days while the clock, expiry task and server remain healthy. File-span granularity, scheduling delays, failed tasks and downtime can extend the actual period; a persistent timer catches up after restart. A local health check checks both journal sockets, actual synchronization and stale successful-run receipts, but no external alert destination is configured. Volume pressure may remove younger entries sooner; no minimum preservation period is promised. Global host-process errors may remain under separate host policies.
Legacy Reader logs: the previously inventoried nginx files and former Docker-managed log have been retired after the cutover. The retirement receipt and absence of the inventoried files were verified on 29 October 2026; configuration backups do not retain their contents.
Backups: the current plan uses weekly replacement. Hostinger's published VPS guidance describes two weekly copies replaced as new backups are created. Failed or skipped backups and account-specific deletion timing have not yet been confirmed. Selective removal of an individual request from a whole-server backup is not promised.
Support and privacy correspondence: retained while needed to resolve the request, demonstrate its handling or address a documented security issue or legal claim. Necessity is assessed when a case closes and when a deletion request is received. A fixed maximum for all correspondence has not been adopted for the current evaluation phase.
Host and identity records: subject to the relevant provider, account and administrative settings. Disconnecting PALO does not erase previous ChatGPT or Codex conversations, Microsoft records or infrastructure backups.

For information under PALO's control, you can request deletion or restriction at info@paloframework.org. PALO will assess the request, identify relevant systems and explain what can be removed, what must temporarily be retained and why. Any restoration must take account of accepted deletion or restriction requests before affected information is returned to ordinary use. Immediate removal from every provider system or backup is not guaranteed.

Your rights

Where applicable, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Send the request to info@paloframework.org with enough context to locate the interaction, such as the approximate date and tool used. Do not send a password or access token. PALO may ask for proportionate identity verification.

Requests are handled without undue delay and within the applicable legal deadline, ordinarily one month under the GDPR. If a lawful extension is needed, you will be told within that initial period. You may complain to the competent supervisory authority, including the Italian Garante per la protezione dei dati personali at https://www.garanteprivacy.it/.

You can stop using and disconnect the plugin through the host's controls. Use the host's own settings for conversation history and provider-specific requests. PALO will explain the boundary of its control rather than promise deletion from another controller's systems.

Changes and evaluation status

This notice describes the evaluation service after activation of the separate public Reader and bounded logging on 29 October 2026. It transparently records retention and provider-verification work still outstanding; publication of this notice is not a declaration that the plugin is approved or ready for public release. Material changes will be dated here and reflected in the plugin's published information. Version 1.1 adds the active separate anonymous access model and verified log controls.