PayLayer, LLC · Last updated November 8, 2026
This notice covers the PayLayer ChatGPT plugin and supplements the PayLayer Privacy Policy. It describes this integration's current data handling. The integration is intended for authorized PayLayer agents in the United States.
Account connection and information received
ChatGPT supplies a Site-scoped user identifier so the integration can keep each person's connection separate. The hosting platform may also supply a verified ChatGPT email and display name. Your ChatGPT email may differ from your PayLayer agent email; PayLayer access depends on your active PayLayer account, its role and its record permissions.
To connect, enter your @paylayerpayments.com agent email and password on the connection page. The plugin sends these over HTTPS to PayLayer for authentication. The plugin code does not persist your password or request it in chat. It stores the returned PayLayer session token encrypted with AES-GCM in Cloudflare R2, associated with your Site-scoped ChatGPT identity.
Information used and returned to ChatGPT
When you request a supported operation, the integration checks your current PayLayer session, agent email domain and role, then requests records permitted by PayLayer. Tool results may include merchant and business names, record identifiers, business contact details, application stages and statuses, estimated revenue or requested processing-volume summaries, servicing-agent information and permitted agent profiles.
Selected results are returned to OpenAI and become available in your ChatGPT conversation to answer your request. Use the plugin only for information you are authorized to access and share in that environment. Field allowlists limit the returned data; this version does not expose document downloads, bank-account fields, passwords, session tokens or residual-economics fields as tool results.
The integration does not copy merchant or application records into its own persistent storage. PayLayer remains the source of those records. OpenAI and Cloudflare provide hosting, authentication or storage services used by the integration. Platform and PayLayer operational or security logs may be maintained under their applicable policies.
Session retention and disconnection
The plugin's saved connection has an access expiry of no more than eight hours. PayLayer may expire or revoke it sooner. Expiry stops the plugin from using that saved connection. Expired encrypted objects are deleted when the user next accesses the connection; there is currently no automatic background cleanup of untouched expired objects. Reconnecting replaces the stored session.
Use Disconnect my account on the connection page to delete your stored connection immediately. The plugin also requests logout from PayLayer; a network failure may prevent that separate logout request from completing. PayLayer's account controls and session policies continue to apply.
Disconnecting does not delete underlying PayLayer merchant/application records or past ChatGPT messages. PayLayer records follow PayLayer's separate retention requirements. ChatGPT conversations and tool results are governed by your OpenAI account settings and applicable OpenAI terms and policies; manage those conversations through ChatGPT's controls.
Support and privacy requests
For access, correction, deletion, account help or plugin privacy questions, contact support@paylayerpayments.com. Identify the account and request without sending passwords, session tokens, bank details or merchant documents. PayLayer may need to verify your authority and retain underlying records for the reasons described in its Privacy Policy.
Changes
This integration supports permission-controlled reads and, when enabled for the deployment, routine CRM creation and updates. These may include business contacts, companies, deals and stages, notes and activities, and follow-up tasks. Write requests send the fields you provide to PayLayer and produce audit records in the existing PayLayer backend. Idempotency request identifiers and results may be retained by PayLayer to prevent duplicate writes. Agent assignments remain governed by account permissions; restricted administrative and financial operations are not exposed. Outbound email sending and financial execution are unavailable.