Privacy

How Blue Pillow handles personal data for the B2A agents site.

Last updated: 2026-11-01

The B2A agents site, the B2A API and the Blue Pillow Hotels & Stays MCP server (including the ChatGPT and Claude apps built on it) are operated by Blue Pillow S.p.A., the data controller for the processing described here. This notice covers that agent-facing service; the full privacy policy applicable to all Blue Pillow services is published on the human site.

Contact: info@bluepillow.com, for questions and for any request about your data.

What we collect

• Anonymous API keys. When an agent calls POST /v1/keys (or the get_anonymous_key MCP tool) we generate a random opaque key. No email, account, or other identifier is required. The key is the only credential bound to the caller.
• Request metadata. We log the requested path, response status, latency, and the anonymous key id (not the key itself). We do not log request bodies that would identify an end-user.
• Search parameters. For travel tools we log the functional parameters the agent provides: the destination or zone searched (including the free-text place query), stay dates, party composition (adults, children and their ages), filters (budget cap, rating, radius), and which property was looked up, together with the returned result counts and prices. These are trip parameters used to measure usage and improve coverage; they are stored with the anonymous key id, never with an account or contact details. We receive only the arguments the AI assistant passes to the tools, never the conversation itself. Retained for up to 90 days, then deleted automatically.
• Client identification at key issuance. When a key is created we store the optional label and agent values declared by the client, and the User-Agent string of the issuing client (e.g. “python-httpx”, “Claude-User”). This identifies the agent software, not a person. In the ChatGPT app the key tool takes no input: our server sets these values itself (agent gpt, label mcp-gpt- followed by the app’s server version), so the user supplies neither.
• IP address. Used transiently, in-process, for two purposes: a salted daily hash for abuse-prevention and rate-limit enforcement, and a country-level lookup that stores only the two-letter country code (request provenance). The raw address is not retained or forwarded.
• Aggregated usage analytics. Anonymous, key-scoped usage events (endpoint called, tool name, latency, status, the search parameters above, and the derived country code) may be forwarded server-side to Google Analytics 4 to measure adoption. These events carry a hashed key identifier, never an IP address, cookie, or cross-site identifier.

What the tools return

The MCP server (including the ChatGPT and Claude apps built on it), the WebMCP tools in our web pages and the B2A REST API return data about places to stay, shaped by the request the AI assistant sends (place, dates, guests, filters), and never account, contact or payment details:

• Property data. The Blue Pillow property id (prop_…, a reference to the listing used for follow-up requests), name, type, brand or chain, location (address, city, coordinates of the property), amenities and other features, description, photos, star rating, the booking sites that list it, and aggregate guest ratings (score, number of ratings and of review texts, per booking site).
• Prices and availability. Live per-operator quotes for the requested stay (amount per night and total, currency, refundable and breakfast flags, discount, rooms left), the availability status and the time the prices were retrieved.
• Guest reviews (on request). Returned only when the agent asks for reviews of a property: texts of reviews published by guests on booking sites, with their score, date, language and the site they come from, plus how many texts exist. The texts are already published on the booking site they come from, and we pass them on as published, without editing them (the short text summary may shorten them); they contain what their authors chose to write publicly. We return no field identifying the reviewer (no name, profile or contact).
• Booking links. Links to the property page on bluepillow.com and to the operator’s booking page, through a Blue Pillow redirect that records the click. A booking link must open the operator’s page with the selected offer already filled in, so it carries:
  • the stay parameters of the request: check-in and check-out dates, number of adults and children (and the children’s ages, where the operator uses them), number of rooms, language, country and currency;
  • the operator’s own parameters, often nested inside an encoded redirect address: the affiliate code that identifies Blue Pillow as the referring partner, the operator’s ids of the property, room, rate or offer, the quoted price, and the search or session tokens the operator issued for that offer. They identify Blue Pillow and the selected offer, not the user. Blue Pillow’s part ends with the redirect to the operator’s site: booking, payment and whatever the operator collects from then on (cookies, account) are governed by the operator’s terms and privacy policy;
  • Blue Pillow attribution parameters (utm_*):
    • links returned through MCP carry a short code of the channel and server version (for example utm_content=gp100 in the ChatGPT app), the same for every user of that channel: on every MCP server, never the key, a hash of it or any identifier of the user;
    • links returned by the REST API and by the WebMCP tools carry a hashed identifier of the anonymous key (utm_content), the same one used for “Aggregated usage analytics” above.
• Destinations. Names, ids, type, coordinates and place hierarchy of matching places, with the number of properties there.
• Search details. Result counts, a paging cursor (an opaque reference to the next page of the same search) and short notes on how a search was widened or narrowed.
• Your anonymous key, returned once by get_anonymous_key (or POST /v1/keys) together with its rate limits.

MCP and WebMCP responses carry no request or debugging identifiers. REST API responses and REST error messages also carry a request identifier and a few diagnostic fields (for example how many operators were queried and how duplicate listings were merged), to help developers report problems.

What we don’t collect

• No account, email, or personal identifier tied to the anonymous key.
• The agents site itself sets no tracking cookies by default. Web analytics (Google Tag Manager / GA4) load only where configured and run under Google Consent Mode v2 with all storage denied by default until consent is granted via the consent prompt. See the cookie notice.

Why we use it

• To run the service: answer searches, quote prices and build booking links.
• To keep it available and fair: per-key rate limits and abuse prevention.
• To measure and improve it: usage counts, coverage of destinations and properties, and which booking links are followed.

Who receives it

• Booking operators. When you open a booking link, you are sent through a Blue Pillow redirect to the operator’s site (for example Booking.com, Expedia, Agoda). The operator receives the visit with the parameters in the link (the stay parameters, its own affiliate, offer and session parameters, and the utm_* attribution); from then on its own privacy policy applies. To quote live prices, Blue Pillow also queries operators with the stay parameters of the request, without any identifier of the key or of the user.
• The AI assistant you use. Tool results go back to the assistant that called the tools (for example ChatGPT, operated by OpenAI, or Claude, operated by Anthropic), which uses them to answer you; its own privacy policy applies to your conversation.
• Google Analytics 4, for the aggregated usage events described above.
• Infrastructure providers acting on our behalf: Microsoft Azure (hosting) and Atlas (cloud database).

We do not sell this data or share it for advertising.

How long we keep it

Your choices

• No account is needed, and the service asks for no name, email or payment details.
• You can stop using a key at any time, and ask us to delete it (with the client identification stored with it) by writing to info@bluepillow.com.
• Where data protection law applies (for example the GDPR), you can ask for access, correction, deletion or restriction of your data, object to its processing, and lodge a complaint with your data protection authority.
• Web analytics on this site run only with your consent, see the cookie notice.

Full policy

For the complete Blue Pillow privacy notice — including data subject rights, international transfers, and contact for data requests — see the human site policy at bluepillow.com/privacy.