EcoSynq Connect Data Use Notice

Complete service inventory

This table contains the 68 active concrete service products only. Generic connectors and the separately disclosed research candidate are not service-list entries.

Storage abbreviations: Local = device-local data; only a row that explicitly says DPAPI credential means the protected credential vault; Broker = encrypted OAuth delivery for at most 10 minutes plus up to 120 seconds of post-delivery retry; Relay = device-encrypted WhatsApp event, acknowledgement or 24-hour expiry; WV = separate isolated WebView2 profile. Deletion also requires provider revocation wherever the provider issued a token.

Meta account boundary: meta-business is the shared runtime provider/account/OAuth boundary for Facebook Pages, Instagram, Meta Business Messenger and Meta Ads Manager. It is not a Meta Business Suite service, owns no product operation and is absent from the service list.

Standard mail/contact/calendar boundary: Fastmail uses an exact account-bound built-in JMAP adapter with 41 executable operations. Any other JMAP, IMAP4rev2/SMTP Submission, CardDAV or CalDAV connection is an account-level protocol profile, not a shared credential or automatic provider approval. Provider-specific OAuth/API remains first choice. Each connection needs its own validated server, identity, TLS, OAuth or explicitly enabled app password, policy acceptance and sync cursor; no normal account-password storage, credential reuse, cleartext/downgrade or unvalidated discovery target is permitted.

Candidate boundary: Skype for Business Server Subscription Edition is listed only as a separate fail-closed research candidate. Connect accepts no credential and exposes no operation for it; its UCWA surface has no adapter and must not inherit Microsoft Teams capabilities.

Integration connectors outside the service list

The integration catalog retains two generic connectors. They never appear as services and cannot own a concrete provider product's operations.

Fail-closed product candidate

Official terms for runtime-gated and unavailable providers

The links below are mandatory sources for connection, adapter and provider/tenant review. A connection/credential profile does not mean provider approval or availability of every catalogued operation. For Mattermost, Element (Matrix), Rocket.Chat, Zulip, Nextcloud Talk, Webex Messaging, Chatwork, Toggl Track, Teamwork Projects, GroupMe, Pushbullet, Twist, Twitch and Zoho Cliq, only runtime Executable operations can run and AdapterMissing rows remain disabled. Fastmail has 41 built-in executable JMAP operations. Plurk, VK and Threema Gateway are AdapterUnavailable.

• Webex Messaging: Developer Terms, Cisco Privacy, App Hub submission. PKCE, least scopes, app privacy/terms/support, test instructions and, where applicable, organization admin/licences are required.
• Chatwork: API Terms, Terms, Privacy, API docs. In addition to OAuth/app registration, an organization-admin API application may be required except for eligible personal-plan use.
• GroupMe: API License, Privacy, Terms, Brand Standards. The API requires the X-Access-Token header; Connect will not use a query-string token.
• Pushbullet: Terms, Privacy, API docs. An OAuth app and user authorization are required; EcoSynq claims neither a public app-directory review nor a universal numeric quota.
• Toggl Track: Terms, Privacy, Legal Center, API docs. Only the API token—not a password—may be used; roles, quota and webhook capacity depend on the plan.
• Teamwork Projects: Terms, Privacy, Developer Portal. An owner-company user, publisher/app Product Scope, testing, Teamwork verification/go-live and, where applicable, site-admin/paid webhook access are required.
• Twist: Doist Terms, Privacy, Developer docs. OAuth is required; directory submission separately requires HTTPS privacy/support/install links, English metadata, brand compliance and a signed native app.
• Fastmail: API docs, API Terms, Developer Policy. A distributed client needs a manually registered Fastmail OAuth client; the app owner supplies legal/support URLs, least scopes and redirects, and the user consents.
• Twitch: Helix, EventSub, Chat, scopes, Developer Agreement. App registration, exact token/scope and broadcaster/moderator/bot role/consent are required; a paused chatbot review cannot be bypassed.
• Threema Gateway: Gateway API, E2E. This is a paid business gateway, not a personal-history API; the owner selects mode and controls Gateway ID/secret/key/credit/callback, and E2E requires an official SDK.
• Zoho Cliq: Cliq v3/OpenAPI, OAuth/scopes. Data-centre-specific app/redirect and scopes are required; bot/extension/function/datastore/organization operations may be limited by tenant role/edition/admin and public handlers.
• Plurk: API 2.0. The owner registers app consumer key/secret/callback and the user authorizes an OAuth 1.0a token; without modern fine-grained scopes, Connect operation switches are only an additional least-privilege gate.
• VK: API Rules, official schema. App/community, exact user/group/service token rights, callback or Long Poll and sometimes admin/2FA/provider approval are required; a token never enters URLs, logs or Codex.
• JMAP/IMAP/SMTP/CardDAV/CalDAV: these are open standards, but the exact provider/tenant terms, privacy, OAuth/app-password and retention rules control. Every account receives a separate endpoint, credential, consent and cursor; a standard is not provider approval.
• Mattermost: Privacy, Terms, Licensing, tenant legal settings. In self-hosted deployments the customer/tenant controls end-user data; PAT/OAuth and AI data use require owner/admin approval.
• Element (Matrix): matrix.org Terms, matrix.org Privacy, Element Privacy, Client-Server spec. The exact homeserver and federated room/bridge rules control; matrix.org/Element notices are not universal to every server.
• Skype for Business Server Subscription Edition: fail-closed research candidate only. The current Server documentation and UCWA server context require exact tenant/version/auth review; no adapter or executable operation exists and no Teams operation is inherited.
• Rocket.Chat: Privacy, Terms, Customer Terms. The workspace administrator/customer controls data and authorization; the live tenant API specification, roles/modules/edition and 2FA control.
• Zulip: Rules, Terms, Privacy. Multi-service third-party clients are permitted subject to the rules; the tenant owner controls exports/bots, and data sale, third-party ads, scraping/rate bypass and consent-free contact reuse are prohibited.
• Nextcloud Talk: Nextcloud Privacy, Compliance, Talk API, Login Flow v2. The instance operator's terms/privacy/retention rules control; enabling Talk/Login Flow/bots is an administrator task.

Provider and AI safeguards

• Google: EcoSynq Connect's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The Google Workspace API User Data and Developer Policy also applies. This is a data-use commitment; a Connect checkbox records only a user declaration and is not technical/legal compliance proof or a guarantee. Agentic use requires in-app data/AI disclosure, affirmative confirmation of the concrete external operation, least scopes and prompt-injection protection; otherwise it must fail closed.
• OpenAI: Connect operates exclusively with one linked personal ChatGPT/Codex account. Personal ChatGPT/Codex content may be used for model training unless the user opts out. The “User-attested no-training” status records only the user's dated declaration that model-improvement data sharing is disabled in both ChatGPT and the Codex environment used; Connect cannot verify the external account controls, contract or legal/provider eligibility. Official OpenAI explanation.
• Telegram: API data is excluded from all AI/ML use under Telegram API Terms section 1.5.
• Slack: commercial distribution and AI/history access remain blocked pending a Marketplace-compliant approved architecture. Slack Marketplace requirements.
• Discord: message content is not supplied to AI without Discord's express permission. Discord Developer Policy.
• Zendesk: no bulk export, background collection, persistent index or general-model training; AI processing must be customer-directed and disclosed. Zendesk Developer Terms.
• GDPR and automated notices: processing still needs a purpose-specific legal basis, transparent recipient/processor role and a valid transfer safeguard. AI importance labels are advisory and cannot be the sole basis of a legal or similarly significant decision. Official GDPR text.

Questions: info@e-co-inform.hu. Independent Hungarian/EU counsel review is required before paid/general public launch.