Last Updated: 2026-04-25
This privacy policy describes how Almosafer Company for Travel and Tourism ("Almosafer", "we", "us", or "our") handles data when you use our hotel and flight search tools via the Almosafer Model Context Protocol (MCP) server. The server exposes tools that an MCP-compatible AI assistant (the "AI host") can invoke on your behalf when you ask about travel. We are committed to protecting your privacy and being transparent about our data practices.
Independence. Almosafer is an independent third-party MCP server provider. We are not affiliated with, endorsed by, or operated by any AI host. The AI host you use has its own privacy policy that governs how it collects and processes your conversation, including any tool inputs it forwards to us and any results we return that become part of your conversation context. Please consult your AI host's privacy policy for details of its processing.
No AI/ML training. We do not use your queries, tool inputs, tool results, or any data passed through our MCP server to train artificial intelligence or machine learning models, and we do not provide this data to any third party for AI/ML training purposes.
This policy supplements our main Privacy Policy. In case of conflict, this MCP-specific policy controls for data processed via the MCP server; the main Almosafer Privacy Policy applies to all other interactions with Almosafer products.
View Full Almosafer Privacy Policy
The Almosafer MCP server exposes the following tools, which the AI host may call on your behalf when you ask a travel-related question:
search_hotels)The main tool that searches for hotels based on your criteria.
| Field | Required | Purpose |
|---|---|---|
prompt |
Required | Your original question, passed through verbatim - used only to detect language preference (Arabic/English) for displaying results. Not sent to analytics, not shared with third parties, and not used for AI/ML training. Retained in server logs for at most 7 days for debugging, then automatically deleted. |
location |
Required | Destination city/area (e.g., "Dubai, United Arab Emirates") - used to search hotels in the specified location |
checkIn |
Required | Check-in date (YYYY-MM-DD format) - used to check hotel availability |
checkOut |
Required | Check-out date (YYYY-MM-DD format) - used to check hotel availability |
rooms |
Optional | Room configuration including adults count, children count, and children ages - used for room allocation and pricing. Default: 1 room with 2 adults. |
filters |
Optional | Search filters including meal plan, free cancellation, star rating range, price range, and property type (Hotel, Resort, Apartment, Hotel Apartment, Vacation Stay, Serviced Apartment) - used to narrow search results |
sortBy |
Optional | Sort order for results - "priceAsc" for cheapest first, "priceDesc" for most expensive first. Default is best match ranking. |
search_flights)Searches for flights between two airports based on your criteria.
| Field | Required | Purpose |
|---|---|---|
prompt |
Required | Your original question, passed through verbatim - used only to detect language preference (Arabic/English) for displaying results. Not sent to analytics, not shared with third parties, and not used for AI/ML training. Retained in server logs for at most 7 days for debugging, then automatically deleted. |
origin |
Required | Origin airport IATA code (e.g., "RUH") - used to search flights from this airport |
destination |
Required | Destination airport IATA code (e.g., "DXB") - used to search flights to this airport |
departureDate |
Required | Departure date (YYYY-MM-DD format) - used to check flight availability |
returnDate |
Optional | Return date for round-trip flights (YYYY-MM-DD format) |
cabin |
Optional | Cabin class (Economy, Business, or First) - default: Economy |
passengers |
Optional | Passenger configuration including adults, children, and infants count. Default: 1 adult. |
filters |
Optional | Search filters including direct flights only, airline preference, outbound departure time range, arrival time range (when the traveler lands at their final destination), and checked-baggage requirement - used to narrow search results |
sortBy |
Optional | Sort order - "cheapest" for lowest price first, "shortest" for shortest duration first. Default is cheapest. |
We send anonymized usage events to a third-party analytics provider (see Section 4.3 for the current sub-processor) so we can understand search quality and popular destinations. Here is exactly what data is sent for each event:
Sent when a hotel search successfully returns results.
| Field | Example | Purpose |
|---|---|---|
location |
"Dubai, UAE" | Popular destinations analysis |
check_in, check_out |
"2026-04-15" | Booking pattern analysis |
results_count |
8 | Search quality monitoring |
pos |
"SA" | Regional usage |
currency |
"SAR" | Currency preference |
locale |
"en" | Language preference |
platform |
"desktop" | Device type |
Sent when a hotel search fails. Contains: location, dates, pos, locale, platform.
Sent when you click "View on Almosafer" to view a hotel.
| Field | Example | Purpose |
|---|---|---|
hotel_id |
12345 | Identify which hotel was clicked |
hotel_name |
"Hilton Dubai" | Hotel identification |
price |
450 | Price point analysis |
location |
"Dubai" | Destination analysis |
Sent when you click "Show All Results" to view more hotels on Almosafer.
| Field | Example | Purpose |
|---|---|---|
location |
"Dubai" | Destination analysis |
check_in, check_out |
"2026-04-15" | Booking pattern analysis |
rooms_count |
1 | Room configuration |
Sent when a flight search successfully returns results.
| Field | Example | Purpose |
|---|---|---|
origin, destination |
"RUH", "DXB" | Popular routes analysis |
departure_date, return_date |
"2026-04-15" | Booking pattern analysis |
cabin |
"Economy" | Cabin class preference |
results_count |
10 | Search quality monitoring |
is_round_trip |
true | Trip type analysis |
pos, currency, locale, platform |
"SA", "SAR", "en", "desktop" | Regional usage and device type |
Sent when a flight search fails. Contains: origin, destination, dates, cabin, pos, locale, platform.
Sent when you click to view a flight itinerary on Almosafer.
| Field | Example | Purpose |
|---|---|---|
itinerary_id |
"abc123" | Identify which flight was clicked |
total |
450 | Price point analysis |
currency |
"SAR" | Currency context |
airline |
"SV" | Airline preference |
Sent when you click "Show All" to view more flights on Almosafer.
| Field | Example | Purpose |
|---|---|---|
origin, destination |
"RUH", "DXB" | Route analysis |
departure_date |
"2026-04-15" | Date analysis |
When the AI host invokes one of our tools on your behalf, it passes along limited context so we can localize the response. Different AI hosts deliver this context through different mechanisms; in all cases the categories of data we receive and the way we use them are the same:
X-GeoIP-Country-Code, CF-IPCountry).Accept-Language HTTP header on the transport request.We also record an opaque identifier indicating which AI host invoked the tool so we can monitor service health and usage per surface. No conversation content is shared with us beyond the tool inputs listed in Section 2.
Any data we return from a tool call (the structured result and the plain-text summary) is delivered back to the AI host and becomes part of your AI conversation. From that point on, that data is handled under the AI host's privacy policy, not ours. Please consult your AI host's privacy policy for details of its retention and processing.
We rely on the following sub-processors to deliver our service. The list below is current as of the "Last Updated" date at the top of this policy and may be updated from time to time; the latest version is always published on this page.
| Recipient | Data Shared | Purpose | Location |
|---|---|---|---|
| Almosafer API | Location/airports, dates, room/passenger configuration, filters | Fetch hotel and flight availability and pricing | Ireland (EU) |
| Analytics provider | Anonymized events (Section 3) | Business analytics | EU Region |
| Logging / monitoring provider | Server logs (no personal data) | Service monitoring | EU Region |
Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following lawful bases:
Your data may be transferred to and processed in countries outside Saudi Arabia, including the European Union. When we transfer data internationally, we ensure appropriate safeguards are in place, including:
prompt field): Retained for at most 7 days for debugging and monitoring, then automatically deleted.The Almosafer MCP server itself does not set cookies on your device. Our analytics sub-processor (Section 4.3) may set anonymous identifiers within the AI host's iframe sandbox so it can deduplicate events; these identifiers are not joined to any personal data and are not used for cross-site tracking or advertising.
This service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data through our service, please contact us using the details in Section 14 and we will delete it.
You can stop sending data to our MCP server at any time by disconnecting our service from your AI host (the exact steps are documented by your AI host). Once disconnected, the AI host will no longer invoke our tools and no further data will be processed on our side. Anonymized analytics and server logs already collected before disconnection are retained for the periods described in Section 7 and then automatically deleted.
Under applicable data protection laws (including GDPR and Saudi PDPL), you have the right to:
To exercise any of these rights, please contact our Data Protection Officer.
We may update this privacy policy from time to time. The "Last Updated" date at the top indicates when changes were last made. Continued use of the service after updates constitutes acceptance of the revised policy.
Email: dpo@almosafer.com
Address:
Almosafer Company for Travel and Tourism
Seera Group Building
Imam Saud bin Abdulaziz St
Riyadh, 11391
Saudi Arabia
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the relevant supervisory authority: