Privacy policy

Last updated: October 9, 2026 · Controller: Brightstep Tech Inc., Resi-Huber-Platz 1, 81371 München, Germany · Contact: [email protected]

Summary: we do not store your trips. Destinations, dates and costs are used once to look up rates and do the calculation, then discarded. We keep only an anonymous usage count for 90 days and a cache of public rate data.

What we process

• Trip details: the destinations (ZIP code, city, county, state or country), travel dates, provided meals and nightly room costs that ChatGPT sends. They are processed in the server's memory for that one request and are not logged or kept after the response.
• No identifiers: the tools do not ask for names, employee IDs, agencies, email addresses or payment details. What you share with ChatGPT itself is covered by OpenAI's privacy policy.
• Requests to official sources: to find a rate our server queries the GSA Per Diem API (api.gsa.gov), downloads the State Department's public monthly per diem file (allowances.state.gov or aoprals.state.gov) and reads the DoD non-foreign per diem bulletins through the Federal Register API (www.federalregister.gov). Only the GSA city search contains anything from your request: for a town that is not a GSA key city, its name, state and the fiscal year. The other requests are fixed downloads of whole public tables. No request contains anything about you; these sites see our server's IP address, not yours.
• Rate cache: to stay within GSA's request limits, public rate tables are cached on our server (refreshed daily; past State Department months for 30 days) and kept as a fallback if a source is down. GSA's answers to town searches are cached for 7 days and deleted 30 days after they were fetched; the cache holds place names and rates only, with no link to any user or request.
• Usage statistics: for each tool call we record the hour, the tool name, whether it worked, which assistant made the call (Claude, ChatGPT or other, from the request's technical headers, plus the app name it declares), the country and language reported by ChatGPT, and a one-way hash of the anonymous user identifier from OpenAI. This is used only to count usage and fix errors, and is deleted after 90 days. It contains no destinations, dates or amounts.

Legal bases

• Looking up rates and totaling the trip you ask for: Art. 6(1)(b) GDPR (providing the service you request).
• Anonymous usage statistics: Art. 6(1)(f) GDPR; our legitimate interest is to run the service, count usage and fix errors.
• Security and delivery through Cloudflare: Art. 6(1)(f) GDPR; our legitimate interest is to keep the service secure and available.

What we do not collect

We do not collect names, email addresses, phone numbers, accounts, chat history, cookies or advertising identifiers, and we do not log IP addresses (see Cloudflare below). We do not sell or share data, and we do not use it to train models.

Processors and location

The server runs on Amazon Web Services (Frankfurt, EU). Requests to this service pass through Cloudflare, Inc. (content delivery network and TLS proxy), which processes the connecting IP address and the request data in transit to deliver them to our server; The server is in the EU (AWS, Frankfurt). Cloudflare operates a global network, so request data in transit may be processed outside the EU/EEA, including in the USA; such transfers rely on the EU-US Data Privacy Framework where the recipient is certified, or on the EU Standard Contractual Clauses. Privacy policies: Cloudflare, AWS. The official sources named above receive only the place queries described there.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, objection (to processing based on legitimate interests) and data portability. Because we keep no trip data, there is nothing to access or delete beyond the anonymous usage count. Write to [email protected]. You can also complain to a supervisory authority, in particular in your country of residence; our lead authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (lda.bayern.de). In California you have the rights described in the CCPA, and we do not sell or share personal information.