Privacy Policy

Scope and operator

Huagongshe is operated by Shandong Shenglan Chemical Technology Co., Ltd. This policy covers huagongshe.com, its HTTP API, MCP server, OAuth authorization flow, and plugin integrations that connect to those services.

Information we process

Depending on how you use the service, we process account information such as username, display name, email address, profile or avatar information; authentication and security data such as password hashes, sessions, API-token metadata, OAuth client and grant records, scopes, network/request metadata such as IP address and user agent where processed by service infrastructure, and security events; user-created content such as saved reactions, reusable skills, and Notes; and chemistry requests such as names, CAS numbers, HCIDs, HRIDs, SMILES, reaction data, and stoichiometry inputs.

When you use Huagongshe through ChatGPT or another MCP client, Huagongshe receives only the OAuth and tool requests sent to the MCP server. Huagongshe does not request or reconstruct your full chat history.

How we use information

We use this information to authenticate accounts, enforce permissions, provide chemical search and data retrieval, render structures, calculate stoichiometry, store user-requested records, operate reusable skills, prevent abuse, investigate failures, and maintain service security and reliability.

Some chemistry requests may trigger enrichment or identity work against external chemistry data sources. Those requests are limited to chemistry identifiers or structures needed for the requested operation; account profile data is not sent as chemistry lookup data.

Sharing and service providers

We may use hosting, network, database, email, security, and operational service providers to run Huagongshe. Chemistry-source providers may receive the identifiers required for enrichment. If you invoke Huagongshe through OpenAI products, OpenAI separately processes your conversation and connection under its own terms and privacy practices.

Public website pages may load analytics or advertising scripts when those features are enabled in the site configuration; those providers may receive browser, device, or network metadata needed to deliver their service. The MCP tool transport itself does not embed browser advertising scripts.

Retention

• OAuth authorization codes are valid for 5 minutes, access tokens for 1 hour, and refresh tokens for 30 days. OAuth codes and tokens are stored as cryptographic digests rather than plaintext secrets.
• User-created records are retained while they remain in the account or until the user deletes them through an available product control or requests account/data deletion through support.
• OAuth client registrations are retained while the client remains registered or until disabled or removed.
• Operational access and security logs are retained for up to 30 days, except where a longer period is necessary for an active security investigation or required by law.

Your controls

You can control the visibility of supported user records and revoke AI Keys. Disconnecting an OAuth connection in the client stops that client from using the connection; changing your HGS password also revokes active HGS sessions, AI Keys, and OAuth grants covered by the password-rotation security flow. For account or data deletion requests, contact support.

Security and credentials

Do not place passwords, API keys, OAuth tokens, MFA codes, or other authentication secrets into chemistry fields, plugin prompts, public Notes, or public reaction records. Huagongshe validates authorization server-side for protected operations and applies rate and resource controls to expensive operations.

Contact

Privacy and data requests: [email protected].