MCP Privacy Notice

This notice covers the public MCP server at mcp.kiuli.com and supplements the main Kiuli privacy policy.

1. Who is the data controller

Kiuli Ltd, operating kiuli.com and mcp.kiuli.com. Contact hello@kiuli.com.

2. What the MCP server processes

When a third-party AI chatbot (Claude, ChatGPT, Perplexity, Grok, etc.) calls our MCP tools on your behalf, the following data flows to Kiuli:

plan_safari: the natural-language trip brief you wrote, optional traveller count, optional preferences, and any contact details you chose to share. The brief and resulting sketch are stored as a row in our itinerary-sketches table for later reference and for downstream handoff.
search_properties, list_published_itineraries, get_published_itinerary_by_slug: search query strings and slug lookups. These are logged for rate-limit and abuse-detection purposes only.
request_inquiry_handoff: your name, email, and phone number (phone is optional); the prior sketch id; any free-text notes; and the partner slug attribution. This data creates a row in our Inquiries table, a HubSpot contact + deal, and triggers customer-confirmation + designer-notification emails.

3. Identifiers we record

OAuth client identity. Each connector that registers via Dynamic Client Registration receives a client_id that we associate with the calls it makes — for rate limiting and abuse detection. We do not attempt to identify the end-user behind a connector.
Partner slug attribution. If your connector sends an mcp_partner_slug (e.g. claude, chatgpt), we record it on the resulting inquiry so we can measure which AI platforms produce qualified leads.
Token state. OAuth access + refresh tokens are stored in Amazon DynamoDB (region eu-north-1) with TTLs that match the token lifetimes. Expired tokens are auto-deleted by DynamoDB's native TTL.

4. Where the data lives

Inquiries + sketches: Neon Postgres, region eu-west-2 (London).
HubSpot contact + deal: HubSpot's standard EU data region.
OAuth tokens + client registrations: DynamoDB, region eu-north-1 (Stockholm).
Rate-limit counters: Upstash Redis, EU region. Counters expire 70 seconds after they're written.
Emails: Resend (transactional email provider), EU region.

5. Legal basis

We process this data on the basis of your consent (you chose to install the connector and call request_inquiry_handoff) and our legitimate interest in operating the MCP server safely and measuring distribution channel performance. You can revoke consent and ask us to delete the data we hold about you by emailing hello@kiuli.com.

6. Retention

OAuth tokens / auth codes / pending-auth: auto-expire via TTL (5 minutes for auth codes, 1 hour for access tokens, 60 days for refresh tokens, 10 minutes for pending-auth state).
Sketches: retained while the underlying inquiry is active. If no handoff is created within 90 days of the sketch being persisted, we delete the row.
Inquiries + HubSpot records: retained per the standard Kiuli retention policy in the main privacy policy.
Rate-limit counters: 70 seconds.

7. Recipients

The Kiuli designer assigned to your inquiry.
Our subprocessors: Neon (database), DynamoDB / S3 (AWS), Upstash (Redis), HubSpot (CRM), Resend (email), OpenRouter + Anthropic (LLM inference for the plan_safari narrative). None of these resell your data.
We do not share data with the calling AI chatbot platform beyond what their MCP transport requires (i.e. tool responses + standard OAuth flow). We do not sell data to anyone.

8. Your rights

You can request access to, correction of, or deletion of the data we hold by emailing hello@kiuli.com. We respond within 30 days. If you believe we've mishandled your data, you can complain to the UK ICO (ico.org.uk).

9. Changes

We'll update the “Last updated” date at the top of this page when we change anything material.

2. What the MCP server processes

When a third-party AI chatbot (Claude, ChatGPT, Perplexity, Grok, etc.) calls our MCP tools on your behalf, the following data flows to Kiuli:

plan_safari: the natural-language trip brief you wrote, optional traveller count, optional preferences, and any contact details you chose to share. The brief and resulting sketch are stored as a row in our itinerary-sketches table for later reference and for downstream handoff.

search_properties, list_published_itineraries, get_published_itinerary_by_slug: search query strings and slug lookups. These are logged for rate-limit and abuse-detection purposes only.

request_inquiry_handoff: your name, email, and phone number (phone is optional); the prior sketch id; any free-text notes; and the partner slug attribution. This data creates a row in our Inquiries table, a HubSpot contact + deal, and triggers customer-confirmation + designer-notification emails.

3. Identifiers we record

OAuth client identity. Each connector that registers via Dynamic Client Registration receives a client_id that we associate with the calls it makes — for rate limiting and abuse detection. We do not attempt to identify the end-user behind a connector.

Partner slug attribution. If your connector sends an mcp_partner_slug (e.g. claude, chatgpt), we record it on the resulting inquiry so we can measure which AI platforms produce qualified leads.

Token state. OAuth access + refresh tokens are stored in Amazon DynamoDB (region eu-north-1) with TTLs that match the token lifetimes. Expired tokens are auto-deleted by DynamoDB's native TTL.

4. Where the data lives

Inquiries + sketches: Neon Postgres, region eu-west-2 (London).

HubSpot contact + deal: HubSpot's standard EU data region.

OAuth tokens + client registrations: DynamoDB, region eu-north-1 (Stockholm).

Rate-limit counters: Upstash Redis, EU region. Counters expire 70 seconds after they're written.

Emails: Resend (transactional email provider), EU region.

5. Legal basis

6. Retention

OAuth tokens / auth codes / pending-auth: auto-expire via TTL (5 minutes for auth codes, 1 hour for access tokens, 60 days for refresh tokens, 10 minutes for pending-auth state).

Sketches: retained while the underlying inquiry is active. If no handoff is created within 90 days of the sketch being persisted, we delete the row.

Inquiries + HubSpot records: retained per the standard Kiuli retention policy in the main privacy policy.

Rate-limit counters: 70 seconds.

7. Recipients

The Kiuli designer assigned to your inquiry.

Our subprocessors: Neon (database), DynamoDB / S3 (AWS), Upstash (Redis), HubSpot (CRM), Resend (email), OpenRouter + Anthropic (LLM inference for the plan_safari narrative). None of these resell your data.

We do not share data with the calling AI chatbot platform beyond what their MCP transport requires (i.e. tool responses + standard OAuth flow). We do not sell data to anyone.