ResellerHQ's ChatGPT / MCP plugin: what it can read and write, and why

Returns: your account name, environment (sandbox or live), status, which product lines are open, your wallet's available and held balance and its recent movements, and the billing defaults a new invoice falls back to (legal name, address, tax id, billing email).

Why: So an assistant can check there is enough in the wallet before it previews a purchase, and can fill an invoice's defaults correctly.

Who receives it: The assistant and the host you are using (ChatGPT, or another MCP client), for the one request that asked. ResellerHQ's own servers see it to serve the call, the same as any other API request to your account. Nobody else.

Kept for: This is a live read of your own account's existing records; ResellerHQ stores nothing extra because a tool was called. The call itself — which tool, whether it succeeded, how long it took — is logged the same as every other API request; the fields it returned are never written to that log.

Returns or takes in: a customer's email, name and billing address, your own reference for them, their tax id, and which price list they are on.

Why: To look a customer up before quoting, buying or invoicing for them, and to record one you add through the assistant.

Who receives it: The assistant and host, for that one call; ResellerHQ's own servers to serve it. Nobody else — a customer's details are never sold, shared with a data broker, or forwarded anywhere outside your account.

Kept for: As long as the customer record itself exists in your account, exactly as it does today through the dashboard and the REST API. Marked as untrusted text in the tool's own result, since a customer chose those words, not you.

Your controls: Change or remove a customer's details from the dashboard or the API; both change what the plugin reads immediately, since it reads the same record.

Returns or takes in: domain names, their status and nameservers, and the registrant/admin/tech/billing contact on file — name, organization, email, phone, address, city, state, postal code and country.

Why: To check availability and price before registering, to show what you already hold, and to change a domain's nameservers, lock or contacts when you ask the assistant to.

Who receives it: The assistant and host, for that one call; ResellerHQ's own servers, and the domain registry when a name is actually checked or registered — the same registrar call the dashboard makes. Nobody else.

Kept for: As long as the domain is registered through your account. Every contact field is marked as untrusted text in the tool's own result, since it was written by whoever set the contact, not by you.

Your controls: Change a domain's contacts or nameservers from the dashboard, the API, or the assistant itself; WHOIS privacy, where the ending offers it, keeps the contact off the public WHOIS record the same way it does today.

Returns: the numbers you hold, their status and rental details, and the SMS they have received — the sender and the message body.

Why: To buy, renew or cancel a rental, and to read messages a customer or a verification service sent to a number you hold.

Who receives it: The assistant and host, for that one call; ResellerHQ's own servers, and the carrier that routes the number. Nobody else.

Kept for: As long as the rental and its messages exist in your account, the same retention the dashboard shows them under. Every message's sender and body are marked as untrusted text, since whoever texted the number wrote them, not you — an assistant is told to treat that text as data to report, never as instructions to follow.

Your controls: Cancel a rental shortly after buying it, from the dashboard, the API or the assistant, and nothing further is charged or received.

Returns or takes in: which plans are on offer, the licences you hold — plan, vendor, domain, seat count and status — each mailbox on a licence, with its first and last name, email address and provisioning status, and, when you buy licences, the admin mailbox's email and the organisation name set on the vendor account. Nothing about any mailbox's own contents.

Why: To buy mailbox licences on a domain, change a seat count, or see who the seats on a licence belong to, when you ask the assistant to.

Who receives it: The assistant and host, for that one call; ResellerHQ's own servers, and the mailbox vendor (Google or Microsoft) when seats are actually provisioned — the same provisioning call the dashboard makes. Nobody else.

Kept for: As long as the licence exists in your account.

Returns or takes in: what a customer is quoted or charged, your margin, invoice line items and totals, a note shown on an invoice, the price rules a price list is built from, and an order's own status and dates —list_orders and get_order return the same domain, number or licence order details already covered above, not a new category. share_invoice creates a public, read-only link to one invoice.

Why: To price something for a named customer, bill them for what they bought, and record that they paid — ResellerHQ takes no payment itself; you collect it however you already do and record that here.

Who receives it: The assistant and host, for that one call; ResellerHQ's own servers. A shared invoice's link is readable by anyone holding it, exactly as the dashboard's own "share" feature already makes it. Nobody else.

Kept for: As long as the sale, invoice or price list exists in your account. An invoice's own note is marked as untrusted text.

No payment data: No card number, bank detail or payment-processor credential is ever read or written through this surface — only the wholesale cost, the price charged, and the resulting order or invoice id, the same figures the dashboard already shows you.

First-party attribution: two cookies, rhq_attribution_first and rhq_attribution_last, record which page you landed on and which campaign link (if any) brought you, for up to 90 days. They are set on every visit to the marketing site, whatever you choose below — they are strictly about how an account arrived, never sent anywhere but our own servers, and the one thing the sign-up form reads to credit a campaign.

Processor: PostHog (PostHog Inc., US region) sees pageviews, session replay on the marketing site, blog, docs and the sign-up and sign-in pages, and feature flags — but only after you accept the cookie banner on your first visit. Before that, and if you reject it, posthog-js is never loaded and nothing is sent to PostHog. Requests go through our own domain (/ingest), so they are first-party; PostHog's own data is kept in your browser's local storage, never a cookie, and every input on every recorded page is masked.

Inside the dashboard: once you have accepted the cookie banner, your own use of the dashboard is recorded the same way, with every piece of text masked by default as well — only navigation, headings and the odd status badge are shown; wallet balances, every amount, customer names, addresses, domains, phone numbers, API keys and anything typed never are. This is off for every account flagged internal, and any reseller can switch it off for their own account in Settings → Session recording.

Withdraw consent: "Cookie settings" in the footer reopens the banner at any time, on any page, and switches PostHog on or off immediately — no reload, and no partial state left behind either way.

Returns: the matching page from ResellerHQ's own public docs site, as Markdown.

Why: So an assistant can answer a question from the docs instead of guessing.

Who receives it: The assistant and host, for that one call. The docs are public pages with no personal data in them; nothing about your account is sent to fetch them.

Kept for: Not applicable — no account data is involved.