This supplement explains how Leadership Connect handles personal information when you use the Leadership Connect AI plugin, which connects an AI assistant such as ChatGPT, Claude or Microsoft Copilot to our Services. It supplements Leadership Connect's Privacy Statement and Public Data Supplement.
What the AI plugin does
The AI plugin lets an AI assistant that you choose look up records in Leadership Connect on your behalf. Every function is read-only: the assistant can search for and retrieve Leadership Connect directory records, and cannot create, change or delete them. The plugin is available only to users with an active Leadership Connect account. It returns only the data your subscription already entitles you to see in our application.
Information we receive
Leadership Connect receives the tool requests the assistant sends to our service, including their search parameters. These parameters may contain information drawn from your prompts, conversation, or documents. The integration does not give us access to your full conversation history or files beyond information included in those requests.
Specifically, we receive:
- Sign-in and authorization information. You sign in on Leadership Connect's own sign-in page. Each authenticated request then carries an access token that identifies your user account, your organization's account, the permissions granted and the assistant application you authorized. The assistant does not receive your Leadership Connect password.
- Tool requests. For each lookup the assistant sends the name of the function it is calling and the search parameters for it, for example a person's name, an organization, a job title, a bill number or a date range. If a name matches more than one record, the plugin may ask you to choose, and we receive your choice.
- Technical information. The name and version of the assistant application, a session identifier, the protocol version, and standard network information such as IP address and user agent.
Information we return to the assistant
We return the Leadership Connect records that match the request, limited to what your subscription permits. We send them only in response to a request made through your connection.
Information about people in the returned records
Depending on the request and your subscription, returned records can include the following about the officials, staff and executives listed in our directory:
- business contact details: work email addresses, direct and office telephone and fax numbers, office mailing addresses and LinkedIn profile links;
- current position, organization and reporting relationships;
- career history and education history, including schools attended;
- committee memberships, sponsored legislation and participation in congressional hearings;
- political party affiliation, for elected officials and other officials where it is on record;
- date of birth, where it is on record.
These are the same records available in the Leadership Connect application. Our Privacy Statement and Public Data Supplement describe how we source and maintain them.
Inferred connections. Some functions identify people whose records overlap: they worked at the same organization during the same period, attended the same school, or took part in the same congressional hearing. These results are inferences drawn from records. An overlap does not establish that two people know each other or have a personal relationship, and it should not be presented as if it does.
How subscription entitlements limit access
Each request is checked against your account's current permissions and entitlements before any data is returned. If your subscription does not include a data area, the plugin does not return records from it. If your account or subscription ends, the connection stops returning data.
What we record
We keep the following records of plugin use:
- Audit records. One record for each request, each connection, each request for the list of available functions and each request refused for lack of permission. A record contains the function called, whether it succeeded, any error code, how long it took, your user and account identifiers, the authorized assistant application and its stated name and version, the session identifier, the protocol version and the request parameters. New audit records replace text parameter values with hashes and their lengths and exclude IP addresses and user agents. Numeric parameters, a small set of fixed-choice filter values, and user and account identifiers remain in the records. This reduces plaintext logging but does not make the records anonymous.
- Operational and error logs. One line for each request with the same function, outcome, timing and identifier fields and without the request parameters. A line written when an assistant connects records the assistant's user agent. When a request fails, the error log can include the text of the parameter that caused the failure.
- Web access and network logs. New records contain IP address, user agent, time, the address requested and response status. New web access logs exclude request bodies and authorization headers.
- Usage counters. Counts of requests for each user and account, by day and by month, used to apply any usage limits in your subscription.
We do not record the records returned to the assistant. We do not receive, and so do not record, your full conversation.
How we use this information
We use the request, authorization, technical, and usage information we collect through the AI integration only for the following purposes:
- to respond to the requests your assistant sends;
- to authenticate you and apply your entitlements;
- to secure the service and prevent abuse;
- to measure usage and apply usage limits;
- to diagnose errors and measure the reliability, performance and use of the plugin's functions;
- to meet our legal obligations.
We do not use integration requests or usage records for advertising, marketing personalization, or profiling users' interests. We do not disclose integration requests or usage records to third parties for their own advertising or marketing. Other disclosures are limited to the recipients and purposes described below.
Leadership Connect does not use your integration requests to train AI models. We do not sell AI plugin requests or usage data.
Who receives this information
- Your assistant provider. The records we return go to the provider of the assistant you connected (for example OpenAI for ChatGPT, Anthropic for Claude or Microsoft for Copilot) so that the assistant can answer you. Your assistant provider's handling of information sent to it is governed by its terms, your account or workspace agreement, and applicable settings.
- Service providers that host and operate the plugin for us. Amazon Web Services hosts the service and stores the records described above.
- Authorities, where the law requires it, as described in our Privacy Statement.
Where it is stored and for how long
The storage locations and retention periods below apply to records Leadership Connect retains in operating the integration. Your assistant provider's storage and retention practices are governed separately by its terms and your account or workspace settings.
Leadership Connect stores these integration records in the United States. We keep them for the following periods:
- Audit records: 730 days, then deleted.
- Operational and error logs: 30 days, then deleted.
- Web access logs: 730 days, then deleted.
- Network (firewall) logs: 30 days, then deleted.
Usage counters expire shortly after the applicable daily or monthly period ends. Historical usage remains in the audit records and operational logs for the periods above.
Access tokens are checked on each authenticated request. The plugin service and its logging systems do not persist access tokens from new requests.
Your choices
- Disconnect. You can disconnect the AI plugin at any time in your assistant's settings, and your organization's administrator can remove it for the organization. After you disconnect, we receive no further requests from that assistant. To ask Leadership Connect to revoke an existing authorization, contact support@leadershipconnect.io. Disconnecting does not automatically delete records we already hold. Those records remain subject to the retention periods and request procedures described here. Disconnecting also does not delete information previously sent to your assistant provider; its policies and controls govern that information.
- Access to or deletion of your plugin records. To request access to, or deletion of, the records of plugin use linked to your account, submit a Data Subject Access Request. We handle each request as applicable law requires, which can mean keeping some records where the law permits or requires it. If you use our Services through your employer or another customer, please contact them first.
- If you are listed in our directory. You do not need a Leadership Connect account to make a request. To ask us to correct a record about you, submit a Data Subject Access Request. To ask us to suppress a record, use our opt-out form. The Public Data Supplement explains how we evaluate these requests and their limits, including that information which continues to appear in source feeds may reappear. Approved corrections and suppressions affect future responses from the AI plugin within 5 days. They do not change answers an assistant has already given.
Who may use the AI plugin
Our Services, including the AI plugin, are business information services intended for professionals who are at least eighteen (18) years of age. This applies even where an AI assistant is itself available to younger users. Consistent with our Public Data Supplement, the plugin is offered only to authorized business and government customers and their users, and it does not make directory data available to the general public. Use of records obtained through the plugin remains subject to our Terms and Conditions.
