1Scope
This policy covers the Fandaqah PMS MCP connector: what happens to data when a Fandaqah user connects it to Claude and asks a question about their hotel's PMS data. It does not cover Fandaqah's PMS product or website generally, and it does not cover Anthropic's own handling of data once it reaches Claude — see Section 3.
2Data this connector touches
The connector does not collect new data. It reads existing records from your hotel's Fandaqah PMS database, scoped to the hotels your account has been granted, in response to a question asked in Claude.
| Category | Examples | Source |
|---|---|---|
| Operational data | Reservations, room status, occupancy, rates, invoices | Your PMS records |
| Guest personal data | Name, email, phone, date of birth, nationality | Your PMS's guest & reservation records |
| Your account data | Username, email, hotel access grants | Your organization's identity provider |
| Usage metadata | Which tool was called, for which hotel, and the outcome | Generated by the connector when you ask a question |
Usage metadata does not include the data returned by a query — only that a query happened, by whom, for which hotel, and whether it was allowed. See Section 5.
3Anthropic & Claude's role
When a question needs PMS data, Claude calls this connector, and the data it returns becomes part of that conversation — the same as any other tool result Claude reads to answer you. That means Anthropic processes that data as part of running the conversation.
Fandaqah does not control how Anthropic subsequently handles data within a conversation — that is governed by Anthropic's own privacy policy, which you should review alongside this one.
4Data minimization
Guest email, phone number, and date of birth are masked on every response, automatically, with no setting anywhere to turn it off — including for administrators. Full detail is in the connector documentation. In short:
- Email and phone are shown only in a masked form (e.g.
m***[email protected],********4491). - Date of birth is reduced to the year.
- National ID numbers are never returned by any tool.
- Guest names are the deliberate exception — a front desk answering "who's arriving today" needs the name — and are never shown across hotel boundaries.
5Retention
The connector itself stores nothing from your questions or Claude's answers — it has no database of its own. Two things do get written:
- Your PMS data continues to be retained exactly as it already is under Fandaqah's existing PMS retention practice. Connecting Claude does not change how long anything is kept.
- Usage metadata (Section 2) is written to a rolling log, capped by size rather than a fixed calendar period — older entries are dropped once the log fills, rather than being kept indefinitely. It never contains the data a query returned, only that the query happened.
6Security measures
Sign-in uses OAuth 2.1 with PKCE through your organization's identity provider; every request is checked against your account's hotel grants before any data is read; all traffic is encrypted in transit. Full detail is in the connector documentation.
7Your rights
Under the Saudi Personal Data Protection Law, you may request access to, correction of, or deletion of your personal data, and object to or restrict certain processing. For data held in the PMS itself, these requests go through your organization's Fandaqah account administrator; for anything specific to this connector, contact us directly.
8Changes & contact
We'll update the effective date above if this policy changes in any way that affects what data the connector touches or who receives it. Questions or requests: [email protected].