BangkokVacay Connector – Privacy Policy

Effective October 11, 2026. This policy covers the BangkokVacay Connector (the MCP server and REST API at https://bangkokvacay-connector.michael-b38.workers.dev), operated by Cloudalien Technologies LLC ("we"). It applies when the connector is used by AI assistants, including Meta's Muse. The bangkokvacay.com website has its own privacy policy.

What we collect

• No accounts and no personal profile data. The connector needs no sign-in, sets no cookies, and never asks for names, email addresses, phone numbers, payment details or account credentials.
• Request data. To answer a request we process the tool arguments the assistant sends (for example keywords, filters, dates, a map coordinate or a listing id) and technical request data (IP address, user agent, time). Tool arguments are not written to any database.
• Operational logs. Our host, Cloudflare, records request logs (time, URL path and query string, status, IP address, user agent; MCP request bodies are not logged). We use them only for security, abuse prevention and fixing faults, and they are kept for no more than 30 days. IP addresses are also held in memory for up to one minute to enforce rate limits.
• Caching. Results built from public directory data and Viator results are cached briefly (see docs). Caches contain no information about who asked.

Purpose

We use request data only to answer the request and to operate, secure, support and improve the connector. We do not sell or rent it, do not use it for advertising, do not build profiles, do not combine it with other data, do not infer sensitive characteristics (such as health, religion, sexual orientation, political views, race or ethnicity), and do not use it to train AI models.

Who we share data with

• Viator (search_tours only): the search keywords, dates, price and rating filters and currency are sent to Viator's partner API to get live results. No IP address or user identifier is sent.
• Cloudflare hosts the connector and processes requests on our behalf as our service provider.
• When a user opens a booking or website link, they leave the connector; the destination (for example Expedia, Viator, Klook or the business) applies its own privacy policy and may use cookies to credit BangkokVacay with a commission. We receive aggregate commission reports from those programs, not data about individual connector requests.
• We may disclose data if required by law. Recipients never receive broader rights than we have.

Meta / Muse

When the connector is used through Muse, Meta and Cloudalien Technologies LLC each act as independent controllers of the data they process. Meta's handling of your Muse conversations is governed by Meta's own policies; we receive only the tool calls described above.

Retention and deletion

Tool arguments are discarded once the response is sent (apart from the logs above). Logs are deleted automatically within 30 days, and rate-limit data within one minute. Because we hold no account or profile data, there is normally nothing to access or delete; if you ask us to delete data relating to you, we will delete any matching log entries we can identify.

Your rights

Depending on where you live, you may have rights to request access to, correction of, or deletion of personal data, and to object to processing. Email michael@cloudalien.com and we will respond within 30 days. Our lawful basis for processing request data is our legitimate interest in providing and securing the service you asked for.

Security

All traffic is encrypted in transit (HTTPS only). API keys for upstream services are stored as encrypted secrets, are never placed in responses, URLs or logs, and are accessible only to the operator. Access to the hosting account is restricted to authorized personnel with least-privilege credentials. If a security incident affects user data, we will notify affected partners, including Meta for Muse users (within 48 hours), and cooperate with any investigation.

Children

The connector is a general travel and business directory and is not directed at children under 13. We do not knowingly collect personal data from children.

Contact

Cloudalien Technologies LLC · michael@cloudalien.com

Changes

We will post changes here and update the effective date.