Privacy Policy

SecretBox – ChatGPT Integration

Last updated: February 25, 2026

1. Introduction

This Privacy Policy describes how API AND YOU processes data in connection with the SecretBox integration with ChatGPT, which enables users to search for experiential gift boxes via the MCP tool.

This integration allows ChatGPT to query our catalog of approximately 13,000 experiential gift boxes (gastronomy, stays, spa, hotels, etc.) in real time through a secure API.

We place great importance on the protection of personal data and are committed to complying with applicable regulations, including the General Data Protection Regulation (GDPR).

2. Data Controller

API AND YOU Email : info@api-and-you.com Website : https://www.api-and-you.com

3. Data Processed

As part of the ChatGPT integration, we process only:

• The user's text search query
• Necessary search filters (city, budget, tags, etc.)

We do not collect or process:

• Payment or banking information
• Passwords
• API keys
• Government-issued identifiers
• Internal identifiers (session ID, user ID, request ID)

No sensitive personal data is requested or stored as part of this integration.

4. Purpose of Processing

The data is processed exclusively to:

• Respond to search requests within the SecretBox catalog
• Provide relevant, structured, and available results
• Return up-to-date information (pricing, availability, stock)

The data is not used for commercial profiling or targeted advertising purposes. We do not sell any personal data.

5. Technical Operation

When a user submits a request:

1. ChatGPT transmits the request to our MCP tool.
2. Our backend validates and normalizes the inputs.
3. A search is performed using Elasticsearch.
4. A minimal structured dataset is returned (title, short description, price, image, product link, location, availability if applicable).

The integration is strictly read-only — no purchases, no bookings, no payments via ChatGPT.

6. Logging

To ensure proper operation, security, and maintenance of the service, we maintain limited technical logs including:

• The normalized search query
• The number of results returned
• Search completion confirmation

These logs are used exclusively for technical maintenance and monitoring, performance optimization, and abuse and fraud prevention.

These logs do not contain payment data, sensitive personal data, or internal user identifiers. They are never used for advertising, profiling, or commercial resale purposes.

7. Data Security

We implement appropriate technical and organizational measures, including:

• HTTPS-only communication
• Rate limiting (30 requests per minute) to prevent abuse
• Monitoring of abnormal usage patterns

In the event of service unavailability, no artificial results are generated and a clear error message is returned.

8. Data Retention

Search request data is retained only for the time strictly necessary for technical purposes and service security. No marketing or behavioral database is built from ChatGPT search queries.

9. Data Transfers

Data is processed exclusively within the technical infrastructure required for API operation. We do not transfer personal data to third parties for commercial purposes.

10. User Rights

In accordance with GDPR, users have the following rights: right of access, right to rectification, right to erasure, right to restriction of processing, and right to object.

Any request may be sent to : info@api-and-you.com

11. Modifications

This Privacy Policy may be updated at any time to reflect technical or regulatory changes. The updated version will always include the latest revision date at the top of this page.