Privacy Policy

Vistoya ("Vistoya," "we," or "us") operates vistoya.com and the Vistoya marketplace and MCP server. This policy explains the information we collect, why we use it, who receives it, and how long we retain it. For privacy questions or requests, contact [email protected].

If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us.

This Privacy Policy applies to our online activities, including vistoya.com, the Vistoya marketplace, and our APIs and MCP server. It does not cover information collected offline unless we tell you otherwise.

Consent

By using our website, you hereby consent to our Privacy Policy and agree to its terms.

Information we collect

The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.

If you contact us directly, we may receive additional information about you such as your name, email address, phone number, the contents of the message and/or attachments you may send us, and any other information you may choose to provide.

When you register for an Account, we may ask for your contact information, including items such as name, brand/company name, email address, and phone number.

How we use your information

We use the information we collect in various ways, including to:

• Provide, operate, and maintain our website
• Improve, personalize, and expand our website
• Understand and analyze how you use our website
• Develop new products, services, features, and functionality
• Communicate with you, either directly or through one of our partners, including for customer service, to provide you with updates and other information relating to the website, and for marketing and promotional purposes
• Send you emails
• Find and prevent fraud

Server logs

Our service logs may contain IP addresses, browser or client user-agents, request times, paths, response status, and security or diagnostic details. MCP product-search records can also include search text, filters, product identifiers, and session identifiers, as described below. We use these records to operate and secure the service, investigate abuse or failures, and understand marketplace usage. Depending on the record, activity may be associated with a Vistoya account or session.

Cookies, analytics, and advertising

The earlier references on this page to Google DoubleClick DART and X advertising cookies were template text and did not describe Vistoya's tracking practices. Vistoya uses first-party cookies and browser storage for sign-in, security, and saved preferences. On vistoya.com, analytics tags may measure page views, searches, product-list views, product selections, and account or commerce events. Some account conversion events may be sent to X/Twitter. Vistoya may also send server-side retailer click-out events to Google Analytics, Meta, and TikTok for measurement; when an event is associated with a signed-in Vistoya account, it may include hashed account identifiers. The cookie notice stores your choice in your browser, but that choice does not currently prevent all analytics or conversion processing. You can restrict browser storage through your browser settings, although some site features may then stop working.

Third-party services and retailer links

OpenAI processes ChatGPT conversations and MCP requests under its own terms and privacy policy. Vistoya's hosting, database, and service providers process information to operate and secure the marketplace. If you follow a product link to a retailer, that retailer receives your visit and handles it under its own privacy policy. Vistoya does not control how those third parties process information they receive directly.

CCPA Privacy Rights (Do Not Sell My Personal Information)

Under the CCPA, among other rights, California consumers have the right to:

Request that a business that collects a consumer's personal data disclose the categories and specific pieces of personal data that a business has collected about consumers.

Request that a business delete any personal data about the consumer that a business has collected.

Request that a business that sells a consumer's personal data, not sell the consumer's personal data.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.

GDPR Data Protection Rights

We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

The right to access – You have the right to request copies of your personal data. We may charge you a small fee for this service.

The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete the information you believe is incomplete.

The right to erasure – You have the right to request that we erase your personal data, under certain conditions.

The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.

The right to object to processing – You have the right to object to our processing of your personal data, under certain conditions.

The right to data portability – You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.

Marketplace Data

Vistoya operates a product marketplace that aggregates and displays product listings from third-party retailers ("Stores"). In connection with the marketplace, we collect and process the following data:

• Product data: Product names, descriptions, images, prices, URLs, and classification metadata (categories, styles, occasions) sourced from publicly available Store catalogs.
• Store data: Store names, logos, website URLs, and catalog metadata necessary to operate and display Store listings on the platform.
• Search and browsing data: Search queries, filter selections, and product interactions on the marketplace to improve search relevance and recommendations.

Product and Store data is sourced from publicly available information and is used solely to operate the Vistoya marketplace. We do not sell this data to third parties. Stores may request removal of their listings by contacting us at [email protected].

Model Context Protocol (MCP) Server

Vistoya provides an MCP server that lets ChatGPT and other compatible assistants search the Vistoya marketplace. When you use the server, the assistant sends Vistoya the tool request needed to answer you. This can include your search text, filters, country selection, or a product identifier.

• Catalog data returned: Product listings, store information, search results, and filter metadata sourced from retailer catalogs and Vistoya's classification system. Responses contain catalog data, not your Vistoya account profile.
• Request and usage data recorded: The time and type of request, search text or product identifier, filters, products returned, MCP session identifier, and session call counters. Where available, we also record the request IP address, browser or client user-agent, client-reported name/version/title, and connection country. If a session has been linked to a Vistoya account, an account identifier may be associated with its product-impression events.
• Purpose: We use this information to provide search results, secure and rate-limit the service, troubleshoot failures, understand product usage, and improve search and recommendations.
• Recipients: The assistant provider processes your conversation and the tool results under its own policy. Vistoya's service providers process request data to host, store, and secure the service. If you follow a retailer link, the retailer receives your visit. Vistoya does not receive your ChatGPT account profile as a standard MCP request field.

Data Retention

We retain data for the following periods:

• Account data: Retained for as long as your account is active. Upon account deletion, personal data is removed within 30 days, except where retention is required by law.
• Marketplace product and store data: Retained for as long as the Store listing is active on the platform. Removed upon Store request or when a Store is delisted.
• MCP session counters: Stored in short-lived session state and expire after inactivity, up to six days after the last active request.
• MCP/API request and product-impression records:These records are used for security, service operation, and product analytics. The current application does not apply an automatic deletion period to these records, so they may be retained without a fixed automatic time limit. Service providers may separately retain infrastructure logs under their own policies.
• Third-party analytics and conversion data:Retention is governed by the relevant provider's settings and privacy policy.

Children's Information

Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity.

vistoya does not knowingly collect any Personal Identifiable Information from children under the age of 13. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.