Privacy Policy
Last updated: April 28, 2026 · Version 4.4.0
1. Who we are
This connector is published by API & YOU, the operator of the SecretBox platform (gastronomic gift-experience catalog).
| Publisher | API & YOU |
|---|---|
| Privacy contact | info@api-and-you.com |
| Support contact | contact@console-secretbox.fr |
| Endpoint | https://mcp-claude.api-and-you.com/mcp |
2. What data is collected
When a Claude.ai user queries the SecretBox catalog, the connector receives — for each request, only for the duration of processing:
- The text of your query (for example “gift box near Lyon”), forwarded by the Anthropic proxy.
- Optional technical parameters: language (
fr_FR,en_US…), result count, structured filters (city, region, max price, delivery mode, GPS coordinates if you request a proximity search). - The product identifier (
global_id) when you request the details of a specific gift box.
We do not receive your name, your email address, your IP address, your Claude session identifier, nor any cookie. The Anthropic proxy anonymizes requests on the third-party connector side: we have no way to know who you are.
3. How this data is used and stored
3.1 Usage
The parameters received are used only to build an Elasticsearch query against our catalog, to return the matching results, and to generate the visuals (map, thumbnails) displayed by the widget inside Claude. No other use: no profiling, no analytics, no resale, no model training.
3.2 Storage and retention
Retention: 0 days. No user query data is written to disk, to any database, or to any persistent logging system. Requests are processed in volatile memory and released immediately after.
Server logs: our technical logs do not contain the text of your query (only its length, language, number of filters, and processing time, for performance diagnostics). These logs are volatile, kept in container memory only, neither archived nor sent to an external service.
3 bis. Technical security
- Encrypted HTTPS transport (TLS) between Claude.ai and the connector, terminated by Cloudflare Tunnel.
- OAuth 2.1 with PKCE (S256) compliant with RFC 8414 / 9728 / 7591.
- Origin-header validation: only the origins
https://claude.ai,https://api.claude.aiandhttps://claude.comare accepted on the/mcpendpoint. - No persistent storage of user tokens beyond an OAuth session lifetime (24h max), in memory only.
4. Sharing with third parties
To generate the interactive map shown inside the Claude.ai widget, the connector performs the following actions on the server side only (your browser does not contact any of these services directly):
4.1 OpenStreetMap — map tiles
When your query triggers a map view, our server downloads the corresponding PNG tiles from tile.openstreetmap.org, encodes them as base64 and embeds them in the response returned to Claude.ai. The OpenStreetMap server never receives your identity or your IP address — only our server’s IP and an identifiable User-Agent (secretbox-mcp/4.4.0) as required by their usage policy.
Planned evolution: upon validation of this first version by Anthropic, this mechanism will move to dynamic loading: tiles will be fetched by the widget on demand as the user zooms, via a dedicated MCP endpoint acting as a proxy to a commercial map provider (MapBox, Stadia, or Thunderforest). This evolution will remain compliant with the same no-collection policy: no identifying data will be sent to the provider.
4.2 SecretBox image CDN — product thumbnails
The gift-box images displayed in the widget come from our own SecretBox infrastructure. Our MCP server downloads the source image, resizes it (400 px wide, WebP format quality 55) using the sharp library in memory, and embeds it as a data: URI base64 string in the response. Your browser does not make any request to the SecretBox CDN — the image is already included in the response returned by Claude.
The SecretBox CDN belongs to API & YOU, is not an external third party, and performs no user tracking.
4.3 Elasticsearch — catalog search engine
Our Elasticsearch is hosted on the internal infrastructure of API & YOU, on the same network as the MCP connector. It is not a third party: it is an integral part of our service. It indexes only the public product entries of the SecretBox catalog — no user data is stored in it.
4.4 No other third parties
No analytics service (Google Analytics, Plausible, Matomo, Hotjar…), no advertising tag, no tracking pixel, no CRM integration. No cookie is set.
5. Retention
| Data | Duration | Location |
|---|---|---|
| User query text | 0 (volatile memory only) | Server RAM, released after response |
| Technical metadata (length, language, filters) | Volatile logs, container lifetime | Docker stderr, not archived |
| OAuth tokens issued | 24h max (TTL) | Server RAM |
| OAuth client identifiers (Dynamic Registration) | Container lifetime | Server RAM |
| SecretBox product catalog | Permanent — that is the service | Internal API & YOU Elasticsearch |
6. Your rights (GDPR)
The connector does not process any personal data within the meaning of the GDPR (article 4): we hold no information that allows direct or indirect identification of a natural person. Therefore, the rights of access, rectification, erasure and portability do not apply to this connector — there is nothing to access, rectify, erase or port.
For any question regarding the SecretBox platform itself (purchases, user accounts, etc.), please refer to the SecretBox Terms of Use.
7. Changes to this policy
Any material change to this policy will be reflected by a new version number visible at the top of this page and notified through an update at this URL. The current version on this page prevails.
8. Contact
Any question regarding this privacy policy may be addressed to:
- Privacy / DPO: info@api-and-you.com
- Technical support: contact@console-secretbox.fr
