Privacy kit for portals — GDPR when you join

This is not legal advice. It describes what the protocol requires and what the Isto Intents forwarder and registry actually store, as implemented on 2026-10-27, and gives you text to adapt. Have it checked against your own service and your national law before you use it.

Who is the controller, and when#

The forwarding terms say that each party is a separate controller of the personal data it collects itself. AutoIsto s. r. o. does not process data on your behalf, and you do not process data on its behalf, so forwarding involves no processor contract. The forwarder passes no contact data to you and receives none from you.

The wish is free text written by a person. Treat it as personal data: a person may write their name, their town or something about their family into it.

What the forwarder sends you, and what it keeps#

It sends only what Forwarding §3 lists: the statement, optional wishes, the buy-by date and, if the person stated one, a private maximum price in your currency — and only the properties your input schema declares. Never contact data, the conversation, a location finer than the country, or anything about other people.

What it stores (its code, worker-gateway/, in Cloudflare D1):

• For each forwarded wish: which portal received it (host, server address, operator name), your intentCode encrypted, with a key that only the code held by the person's assistant opens; also when it was created, when it expires and the last status. Not the wish, not the private maximum price, not any contact. Deleted when the forwarder learns the wish ended, at the latest after 200 days.
• Abuse limits: counters per network, keyed by a keyed hash of the network address, never the address itself; deleted within 2 days.
• Demand: numbers per day, country, category and outcome, published at demand by country.
• Deliveries per portal: numbers per day, portal and outcome, published as https://istointents.org/transparency.json, so that equal treatment of portals can be checked from outside. Numbers about portals, nothing about people.
• Technical logs kept by Cloudflare for the Worker (request metadata), for at most 7 days. The forwarder's own log lines carry no wish and no contact.

What to add to your privacy notice#

Copy, adapt the parts in [brackets], and translate. It assumes you follow the consent-link profile as the registry check requires; the reference holder behaves exactly like this.

Wishes from AI assistants (Isto Intents)

If you ask an AI assistant to keep looking for [a car / a home] for you, the assistant may send
us your wish — directly, or through the Isto Intents forwarder operated by AutoIsto s. r. o.
(istointents.com). We receive the wish in your words, optional wishes, the date by which you
want to buy and, only if you stated one, a maximum price. We do not receive your name, e-mail
address, phone number or the conversation. We keep the maximum price private: we never show it
and never give it to sellers.

Until you confirm, the wish is a draft: it is not watched and it expires after 24 hours
[and we delete it after N days].

On our confirmation page you enter your e-mail address and agree to receive e-mails with
listings that match your wish. We then send you a link to confirm the address; only after
you confirm do we start (double opt-in). Legal basis: your consent (Art. 6(1)(a) GDPR).

You can withdraw your consent and end the wish at any time with the link in every e-mail we
send you [or by writing to …]; your AI assistant can also end it for you. This does not affect
what happened before.

We keep the wish and your e-mail address while the wish is active, and delete [them / your
e-mail address] [when it ends / N days after it ends]. A wish ends when you end it, at the
date you gave, or after [180 days]. [Our processors: hosting …, e-mail …]

Legal basis, consent and its proof#

• Consent with double opt-in. The profile requires that the person enters their own contact on your page, reads the consent text — the same as on your other channels — and that you verify the channel before the wish becomes active (MCP binding, profile rule 2). An AI assistant cannot give consent for the person and must not try.
• Proof. Art. 7(1) GDPR asks you to be able to demonstrate consent. Keep when it was given and confirmed, and which version of the consent text was shown.
• A draft is not consent. Nothing is sent for a draft, it is not counted in demand and it expires within 24 hours (profile rule 1).

Retention and ending#

• The protocol does not set how long you keep data after a wish ends; your notice must say it.
• intent_withdraw_intent must take effect immediately. The intentCode works like the unsubscribe link in an e-mail: whoever holds it can read the wish and its matches and stop it, but never the contact or the private maximum price (profile rule 4).
• Give a stop link in every e-mail you send for a wish.
• A wish forwarded to you ends at the forwarder when you report it ended, or at the latest after 200 days.

Data minimisation the check already enforces#

• No tool asks for or returns contact data (e-mail, phone, name or address).
• Refuse arguments your input schema does not declare, and never store a contact sent that way (profile rule 9).
• Usage metering must not record the statement, the code or the contact (profile rule 7).
• Calls marked x-isto-test: 1 (the registry's trial run) should not be counted as demand (profile rule 8).

Transfers outside the EU#

• The forwarder, the registry and both websites run on Cloudflare, Inc. (USA), which is certified under the EU-US Data Privacy Framework. A wish forwarded to you passes Cloudflare's network.
• Your own transfers depend on your hosting, your mailer and your other processors; list them in your notice.
• The person's AI assistant is chosen by the person and processes the conversation under its own provider's terms. It is not your processor, and it is not the forwarder's.

Questions from people about their data#

The forwarder holds no contact and cannot tell who a wish belongs to, so a person who asks AutoIsto s. r. o. about their data at your portal will be referred to you. Write to the editor of the protocol through istointents.com if anything here does not match what you see.