Privacy Policy

1. Who we are and what this policy covers

Maqami LLC (“MAQAMI”, “we”, “us”) is a Delaware limited liability company. We are the controller of the personal data described in this policy, which applies to:

• maqami.co — our informational website (destinations, hotels, guides);
• book.maqami.co — our booking website, where you can create an account, book and pay. It runs on the travel-booking technology of our partner Nuitee (LiteAPI);
• The Maqami Travel app (the “AI App”) — our Model Context Protocol (MCP) server at mcp.maqami.co, which AI assistants such as ChatGPT, Claude and others can connect to so they can search, price and manage travel for you.

This policy does not cover the AI assistant you use. The provider of that assistant (for example OpenAI for ChatGPT) decides how your conversations, account and files are handled under its own privacy policy. We receive only the specific information the assistant sends to our tools, as described below.

2. The Maqami Travel app for ChatGPT and other AI assistants

2.1 What the AI App receives

The AI App does not require you to sign in and does not receive your AI-assistant account, name, contacts, files or conversation history. Each time the assistant uses one of our tools, it sends us only the inputs listed for that tool below, together with standard technical request data (see 2.3). We do not request, reconstruct or infer your chat history, and we do not request your precise location. Map coordinates that appear in some search tools describe the destination you are searching, not where you are.

2.2 Tool inputs and outputs

All 41 tools fall into the groups below. Each tool’s exact inputs are also shown to your AI assistant in the tool’s description.

Personal data in tool inputs. Most tools receive no personal data at all. The only personal data the AI App can receive is: (a) the email address and/or last name you used when booking, when you ask to look up, change or cancel your own booking; (b) corrected booking-holder details (name, email, optional phone number and an optional note to the hotel) when you ask to amend a booking; and (c) optional guest nationality or market, used only because suppliers can price by market. Children’s ages may be sent to price rooms correctly; children’s names are never requested.

2.3 Data the AI App never collects

No AI App tool has a field for, asks for, or is designed to receive:

• payment card numbers, security codes or other information covered by the Payment Card Industry Data Security Standard (PCI DSS), or bank details;
• passport, national ID, social security, tax or other government identification numbers;
• health, medical, biometric or genetic information, or other special-category data;
• passwords, one-time codes, API keys or other access credentials;
• your precise location (such as GPS coordinates or a home address).

Payment and any traveler details that a supplier legally requires (for example passport details for some international flights) are entered only by you, directly on our secure checkout website after you open the checkout link. Please do not type such information into an AI chat; our tools cannot accept it, and if it is ever included in free text sent to a tool, we do not intentionally store it.

2.4 Technical and usage data

When an AI assistant calls our tools, our infrastructure also processes:

• Network data: the connecting IP address, used transiently to protect the service (rate limits and abuse prevention) and to derive approximate country and city and the name of the network operator. For hosted assistants, the connecting address is usually the assistant provider’s server, not your device;
• Client data: the name and version of the AI app or client making the request and its user-agent string, and the MCP session identifier;
• Usage data: which tool was used, when, whether it succeeded, response time, and the travel parameters of searches and price checks (destination, dates, number of rooms and guests, nationality or market, currency, airline, cabin), the wording of a hotel or airport search and the opening words of a question asked about a hotel (shortened to at most 100 characters), plus result counts, lowest prices, hotel and offer identifiers and whether a checkout link was created;
• Pseudonymous identifiers: a random-looking identifier created by one-way hashing of the network and client data, used to count sessions and returning clients without identifying who you are.

These usage events are sent to Google Analytics so that we can measure how the AI App is used and improve it. They never include names, email addresses, phone numbers, booking-holder details or notes to hotels. Because search wording is recorded in shortened form, please do not include personal details in a hotel description or question.

2.5 How we use AI App data

• to perform the action you asked for: searching, pricing, locking a rate, creating a checkout link, or finding, changing or cancelling your booking;
• to verify that a booking belongs to the person asking before showing, changing or cancelling it;
• to keep the service secure, prevent fraud and abuse, and enforce fair-use rate limits;
• to measure usage, fix errors and improve our tools and travel offering, using pseudonymous and aggregated data.

We do not use AI App data for advertising, we do not build behavioral profiles of individuals, and we do not sell it.

2.6 Your choices in the AI App

• You decide what to share. Searches work without any personal data; booking look-ups only run when you provide your booking details.
• Changes and cancellations are carried out only when you ask for them. Your AI assistant may ask you to confirm before an action that cannot be undone.
• You can disconnect or remove the Maqami Travel app from your AI assistant at any time in that assistant’s settings.
• You can ask us to delete AI App analytics data related to you or to exclude you from analytics by emailing info@maqami.co. Because this data is pseudonymous, please tell us roughly when you used the app and which assistant you used so we can locate it.
• Your AI assistant’s own data controls (such as chat history and memory settings) are managed in that assistant, under its provider’s policy.

3. Information we collect on our websites

• Account data (book.maqami.co): name, email address, phone number, password (stored by our booking platform in protected form) and preferences.
• Booking and traveler data: names of the booking holder and travelers, contact details, travel dates, special requests and, only where an airline, supplier or destination legally requires it, date of birth and passport or travel-document details. These are entered by you on our checkout pages, never through the AI App.
• Payment data: card payments are handled directly by PCI DSS-compliant payment processors (such as Stripe). We do not see or store full card numbers or security codes; we receive only limited details such as the card brand, last four digits, payment status and billing country.
• Communications: messages you send us and our replies.
• Technical and usage data: IP address, approximate location, browser and device type, pages viewed, searches made on our sites, referring pages and cookie identifiers (see section 8).

4. Why we use personal data and our legal bases

We may create aggregated or de-identified information that can no longer reasonably identify you and use it for any lawful business purpose. We will not try to re-identify it.

5. Who receives personal data

We share personal data only as needed for the purposes above, with these categories of recipients:

• Travel suppliers (hotels, airlines, tour operators and their distribution systems) to provide what you booked. They use the data as independent controllers under their own privacy policies and legal obligations.
• Our travel-technology and booking partner Nuitee (LiteAPI), which provides hotel, flight and tour content, availability, booking processing and the platform behind book.maqami.co.
• Payment processors to take payments, issue refunds and prevent payment fraud.
• Infrastructure, security and communications providers such as Cloudflare (hosting, content delivery, security) and email services.
• Analytics providers such as Google Analytics and Google Tag Manager.
• Professional advisers (lawyers, accountants, auditors, insurers) under duties of confidentiality.
• Authorities and other parties when required by law, court order or lawful request, or when necessary to protect the rights, property or safety of MAQAMI, our users, suppliers or others.
• A successor or acquirer in connection with a merger, financing, acquisition or sale of all or part of our business, subject to this policy.

We do not sell personal data and do not “share” it for cross-context behavioral advertising, as those terms are defined in U.S. state privacy laws. We do not allow our service providers to use your personal data for their own advertising.

6. How long we keep data

We keep personal data only as long as needed for the purposes described, then delete or de-identify it:

We may keep data longer where the law requires it, where it is needed to resolve a dispute or enforce our agreements, or where it has been de-identified. Suppliers and partners keep the data they receive under their own retention rules.

7. Your rights and controls

Wherever you live, you can ask us to:

• confirm whether we process your personal data and give you a copy of it;
• correct inaccurate or incomplete data;
• delete your data, unless we must keep it (for example for an active booking or legal record-keeping);
• stop using your data for analytics, or restrict or object to other processing;
• receive your data in a portable format;
• stop sending you any marketing (we only send marketing where the law allows, and every message has an opt-out).

EEA, UK and Switzerland: you also have the right to withdraw consent at any time (without affecting earlier processing) and to complain to your local data protection authority.

California and other U.S. states: you have the rights to know, access, correct and delete, and to opt out of sale, sharing and targeted advertising (we do none of these). We will not discriminate against you for exercising your rights. You may use an authorized agent, and if we decline a request you may appeal by replying to our decision.

How to make a request: email info@maqami.co with the subject “Privacy request”. We may need to verify your identity, usually by confirming access to the email address on your booking or account. We respond within the time required by law, generally within 30 days.

8. Cookies and analytics

Our websites use cookies and similar technologies that are necessary for sign-in, booking, security and fraud prevention, and analytics cookies (Google Analytics, managed through Google Tag Manager) to understand how the sites are used. We do not use advertising cookies. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google’s browser add-on at tools.google.com/dlpage/gaoptout. Blocking necessary cookies may stop booking features from working. We treat Global Privacy Control signals as a request to opt out of sale and sharing; we do not sell or share personal data in any case.

9. Security

We use administrative, technical and organizational measures designed to protect personal data, including encryption in transit (HTTPS/TLS), access controls, booking-ownership checks, rate limiting, data minimization and PCI DSS-compliant payment processing. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach that affects your personal data, we will notify you and the authorities as required by law.

10. International transfers

MAQAMI is based in the United States, and our partners and suppliers operate worldwide. Your data may therefore be processed in the United States and in the countries where your travel suppliers and our service providers operate. Where the law requires it, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and equivalent UK mechanisms provided by our service providers. Data sent to a hotel or airline abroad is necessary to perform the booking you request.

11. Children

Our services are intended for a general audience and are not directed to children under 13. Bookings may be made only by adults aged 18 or over, who may include children’s ages or names as travelers when booking for a family. We do not knowingly collect personal data directly from children under 13 (or the higher age set by local law). If you believe a child has provided personal data to us, contact us and we will delete it.

12. Third-party services and AI assistants

Hotels, airlines, payment processors, AI assistant providers and other third parties that you interact with through our services process personal data under their own privacy policies and as independent controllers. We are responsible for our own processing as described in this policy. To the extent permitted by applicable law, we are not responsible for the privacy practices of those third parties, and we encourage you to read their policies. Links to other websites are provided for convenience only.

13. Relationship to our Terms of Service

This policy forms part of, and should be read with, our Terms of Service, including its provisions on limitation of liability, dispute resolution and governing law, which apply to the fullest extent permitted by applicable law. Nothing in this policy limits any right that cannot be limited under the law that applies to you.

14. Changes to this policy

We may update this policy to reflect changes to our services, our tools or the law. We will post the updated version on this page and change the “Last updated” date. If we make a material change to how we use personal data, including any new collection by the AI App, we will update this page before the change takes effect and, where required by law, notify you or ask for your consent.

15. Contact us

Privacy questions, requests or complaints: info@maqami.co
Post: Maqami LLC, 8 The Green, Ste 24763, Dover, DE 19901, United States