Privacy notice
Privacy notice for SkyBuyFly in AI assistants
This notice covers the SkyBuyFly MCP server, which AI assistants such as ChatGPT, Claude, Cursor, VS Code and Gemini CLI use to search SkyBuyFly's duty-free price comparison. It describes what the software does today. The server's address is:
https://skybuyfly.pitchai.net/mcp
In short: the server needs no sign-in, sets no cookies, does no analytics, tracking or advertising, and does not sell data. It receives only what your assistant puts into a SkyBuyFly tool call, such as search text or a barcode. Web server logs with IP addresses are deleted after about 15 days.
Who is responsible
PitchAI operates SkyBuyFly and this server and is responsible for the data described here. Contact us at info@pitchai.net or through the contact form (topic "Privacy question").
What your assistant sends us
Your assistant decides when to use a SkyBuyFly tool. A tool call contains only the tool's inputs: search text, product IDs, barcodes, airport codes, a text to filter the airport list by, a currency and, for a live check, how many seconds to wait. We do not receive your conversation, your name, your account with the AI service, or files you share with the assistant. Because search text is logged (see Logs), please do not put personal details into a product search.
How we use it
We use the inputs only to answer the tool call. The server looks up the answer in the SkyBuyFly API on the same server (skybuyfly.pitchai.net/api); the search text, product ID or barcode is part of that request's address. These requests carry a Do Not Track signal (DNT: 1), so the SkyBuyFly website records no analytics for them. Answers from the API are kept in the server's memory for up to 10 minutes so that repeated questions are answered faster. The tool results contain product information, prices and links to SkyBuyFly pages, and no information about you.
Live price checks
When your assistant asks for live prices, SkyBuyFly fetches the product page from each airport shop's website to confirm the current price. The shop sees a request from SkyBuyFly's server, not from you or your assistant.
No accounts, cookies or tracking
The server has no accounts and no sign-in. It sets no cookies, runs no analytics or tracking, shows no advertising, builds no profiles and does not sell or share data for marketing.
Logs
- Web server. Our web server logs each request to the MCP server with the requesting IP address, the time, the requested address (such as
/mcp), the response status and size, the referring page, the client software (user agent) and how long the answer took. When a request is refused because an address sends too many, the web server's error log also notes that address. With ChatGPT, Claude on the web and similar services, the requesting address is normally the AI service's server, not your device. With a client that runs on your computer, such as Claude Code, VS Code, Cursor or Gemini CLI, the request comes from your computer, so the logged address is yours. - Requests to the SkyBuyFly API. The same web server logs the server's own requests to the SkyBuyFly API, with SkyBuyFly's own server address; their requested address contains the search text, product ID or barcode.
- The MCP server. The server writes one line per tool call: the tool name, the outcome, the duration, the status codes of the SkyBuyFly API, the type of client (such as ChatGPT, Claude or Cursor, derived from the user agent) and, for a product search or an airport list filter, the first 200 characters of that text. If a call fails unexpectedly, it also writes the error and its technical trace. It does not write IP addresses.
- Rate limits. To limit the number of calls per minute, the server counts calls per requesting address in its memory. These counters are not written to disk and are cleared over time and whenever the server restarts.
- Totals. The server keeps running totals of calls per tool, outcome and client type. They contain no addresses and no search text.
We use logs for security and troubleshooting. Web server logs are rotated each day that has entries and the 14 most recent rotations are kept, so their lines are normally deleted after about 15 days. The MCP server's own log is rotated by size (30 MB), which removes the oldest lines.
Who receives data
- Hetzner hosts our servers in Helsinki, Finland.
- Airport shops receive requests from SkyBuyFly's server during live checks. These requests contain no personal data.
- Your AI service (for example OpenAI for ChatGPT, Anthropic for Claude, Google for Gemini) processes your conversation and the tool results under its own privacy policy. SkyBuyFly has no access to your conversation.
Why we may process it
We process tool inputs to provide the answers your assistant asks for, and logs to run and secure the service (legitimate interest).
Your rights
You can ask for access to, correction or deletion of your data, a copy of it, or restriction of its use, and you can object to processing. Because the server has no accounts and logs contain no names, we can usually find log lines only if you tell us the time of your request and the IP address it came from. Contact info@pitchai.net or use the contact form. You can also complain to a data protection authority, such as the Dutch Autoriteit Persoonsgegevens.
More information
For the SkyBuyFly website and the iOS and Android apps, see the full SkyBuyFly privacy policy. How the assistant integration works is described on SkyBuyFly for AI assistants. We will update this notice when the software changes, and change the date above.