Privacy Policy
Last updated: 6 October 2026. This policy explains what MCP for HighLevel, operated by HighLevel Automation Lab ("we", "us"), does with data.
The short version
We store the details needed to connect to your GoHighLevel sub-accounts, and a log of which tools were called and when. We do not store your CRM contents. Your contacts, conversations, deals and invoices stay in GoHighLevel; we pass requests through and return the results without keeping them.
What we collect
| Data | Why | Kept |
|---|---|---|
| Your email address and account id | To create your account and contact you about the service | Until you delete your account |
| Sub-account name, GoHighLevel Location ID, and Private Integration token | To call the GoHighLevel API on your behalf | Until you delete that sub-account |
| Optional ChatGPT connection: linked sub-account, opaque profile ID, approved permissions, and connection and last-use dates | To identify the sub-account you approved and manage its plugin access | The profile stays until you delete your account or sub-account. Connection records are pruned after their credentials expire. OAuth client registrations are retained for reconnection. |
| Hashes of OAuth authorization codes, access tokens and refresh tokens | To verify ChatGPT access without storing the original OAuth credentials | Authorization codes last 2 minutes, access tokens 1 hour, and refresh tokens 30 days. Refresh tokens rotate on use. Expired records are pruned daily. Revoking a connection immediately blocks further access. |
| Audit log: which tool was called, for which sub-account, whether it succeeded, and when | Troubleshooting, abuse prevention, and usage statistics | 90 days, then deleted automatically |
| PayPal subscription id and status | To bill you correctly | As long as required for accounting |
The audit log records tool names, not tool arguments or results. We do not log the contents of your contacts or messages.
How your token is protected
Your GoHighLevel Private Integration token is encrypted with AES-256-GCM before it is written to our database, using a key held separately as a platform secret. Our server decrypts it to validate your saved connection or make a GoHighLevel API call on your behalf.
It is never returned by any part of our API, never displayed back to you in full (you see
only a masked hint such as pit-f855...4182), and never sent to Claude, ChatGPT or any
other AI system. AI clients authenticate with your private link or, for the optional ChatGPT
plugin, separate OAuth access and refresh tokens. These are not your GoHighLevel token.
OAuth approval uses a security cookie that lasts 15 minutes to bind the connection request to your browser.
Who we share it with
We do not sell data. We share only with the processors needed to run the service:
- Cloudflare — hosting, database and caching
- Clerk — account sign-in
- PayPal — payments (we never see your card or PayPal password)
- GoHighLevel — the API we call on your instruction
We may disclose data where legally required.
AI processing
When you connect a private link or authorize the ChatGPT plugin, that AI client sends instructions to us and receives the GoHighLevel data it requested. The ChatGPT plugin also receives the connected sub-account's display name, opaque profile ID and your account email for identifying the connection. That data is handled under your AI provider's terms. Choose your GoHighLevel token scopes and the plugin permissions with that in mind.
Our AI image generation tool sends your prompt to Cloudflare Workers AI and writes the result into your GoHighLevel media library.
Your rights
You can see your connected sub-accounts at any time in your dashboard, and delete any of them, which erases the stored token immediately. You can ask us to delete your whole account and everything attached to it by opening a support ticket from your dashboard; we action deletion requests within 30 days.
You can revoke a ChatGPT plugin connection from the ChatGPT section of your dashboard. This blocks that connection's access without disabling your GoHighLevel sub-account or changing billing.
Depending on where you live you may also have rights to access, correct, export or object to processing of your data. Open a ticket and we will help.
Security incidents
If we become aware of a breach affecting your stored credentials, we will notify affected customers by email without undue delay and tell you what to revoke. We recommend rotating a Private Integration token in GoHighLevel if you ever suspect a problem — it takes a minute and invalidates the old one.
Contact
Open a support ticket from your dashboard, or write to HighLevel Automation Lab, Cavite, Philippines.