Food Search MCP Privacy Policy

1. Basic policy on personal information protection

1. The Company complies with laws, national guidelines, and other norms on the handling of personal information.
2. The Company takes reasonable security measures to prevent leakage, loss, or damage of personal information and continuously improves its arrangements to suit its business. In the unlikely event of an incident, the Company promptly takes corrective action.
3. The Company responds promptly and sincerely to complaints and inquiries about the handling of personal information.
4. The Company reviews and continuously improves this Policy and its operation in a timely and appropriate manner in light of changes in circumstances.

2. We do not collect personal information

1. The Service has no sign-up or account creation and does not ask for names, postal addresses, dates of birth, or other information used to identify a specific individual. The public edition and trial API keys can be used without registering an email address or phone number either.
2. The Company’s policy is not to collect personal information in the Service. Even the paid-plan application page (/price/apply/) does not ask for a personal name; it asks only for the minimum needed for an application from a corporation or organization: the company or organization name, department, a contact label (a nickname or name we can use to identify the contact), a contact email address, phone number (optional), website (optional), and the requested plan and wishes. We recommend a shared team or department email address and the company’s main phone number.
3. Application details are used only to (1) confirm the application and contact the applicant (including sending the receipt notice), (2) prepare quotes, contracts, invoices and issue and manage API keys, (3) match lookups on the status page (/price/status/), and (4) prevent fraudulent applications.
4. Application details are stored with an application number in the Service’s database on its server and are sent as an email to the Company’s staff address. A receipt notice stating the application number, application type, date and time received, and the status page URL is also sent automatically to the email address given in the application (it does not repeat the company name, contact label, wishes, or other text entered). To check for fraudulent applications, the source IP address and User-Agent of the submission are stored and included in the staff email. Mail delivery logs (time, sender and recipient addresses, message ID, delivery result) remain as described in Section 3 (9).
5. Stored application details are deleted automatically 365 days after their status was last updated. Applications for which an API key was issued are kept while that API key exists, for contract management and status lookups, and are deleted 365 days after the API key is deleted. Emails and contract information received by the staff are managed under the Company’s contract and customer management procedures.
6. The status page shows the application status or the contract status (plan, whether the API key is active, billing status, remaining tokens, and the like) only when the application number or API key matches the email address used in the application. The API key and email address sent for matching are not stored.
7. The Company never sells, lends, or publishes personal information, whether for a fee or free of charge, and does not provide it to third parties except as required by law.
8. The Service does not use advertising, behavioral targeting, or external analytics services. The Service’s website sets no third-party cookies and loads no scripts from external sites.
9. Please do not include your own or another person’s personal information (name, contact details, medical history, etc.) in search conditions, instructions to AI clients, or the wishes field of an application.

Information sent through the Company’s contact form (support.imd.jp) is handled not in the Service’s systems but under the policy shown on that form.

3. Information technically recorded in operation

To provide the Service safely on the Internet, the following information is technically recorded. It does not include names or contact details (application details in Section 2 are not recorded beyond the database in Section 2 and item (9) below), and the Company does not use it to identify individuals.

A trial API key is stored in the User’s browser (localStorage) only for its issue date and is sent to the Company only when the key is used or its usage is checked. The website may use sessionStorage to keep display state.

4. Purposes of the records

The information in Section 3 is used only for the following purposes and for no other purpose:

1. providing the Service, authenticating API keys and OAuth connections, and managing usage limits;
2. investigating and recovering from failures, maintaining security, and preventing unauthorized access, excessive automated retrieval, and improper key issuance;
3. understanding usage through aggregates that do not identify individuals, and improving the quality of the Service;
4. responding as required by law.

5. External transmission and third parties

1. Search conditions are sent to the food database API (upstream server) operated by the Company in order to retrieve food data.
2. The Company does not provide the information in Section 3 to third parties, except as required by law (including lawful disclosure requests from courts, investigative authorities, and the like).
3. Paid-plan application details are sent, as described in Section 2, from the Service’s server as an email to the Company’s address, and a receipt notice is sent to the email address given in the application, encrypted (STARTTLS) when the receiving mail server supports it.
4. AI clients (ChatGPT, Claude, Gemini, etc.) and the conversations held through them are managed by each AI client’s provider and handled under that provider’s terms and privacy policy. The Service receives only the tool calls that an AI client sends to it, not the conversation text.

6. Security measures

• Communications are encrypted with HTTPS (TLS).
• API keys, tokens, and administrative secrets are stored irreversibly transformed or encrypted, and API keys themselves are not written to logs.
• Access to log files and databases is limited to a small number of administrators. The admin console uses passkeys or similar authentication and source restrictions, and administrative operations are audit-logged.
• Servers run on Linux and their software is kept up to date.

7. Disclaimer

The Service is operated on the policy of not collecting personal information, and even paid-plan applications take only the minimum information about a corporation or organization without personal names, but because of how the system is implemented, the results may differ from that policy in the following respects. The Company is not liable for the following matters except in cases of its willful misconduct or gross negligence.

1. The Company does not use the source IP addresses, User-Agents, cookie identifiers, reverse DNS hostnames, and similar data in Section 3 to identify individuals, but combined with other information they may identify a specific individual and may constitute “personal information” or “personally referable information” under law. Even then, the Company handles them within this Policy and does not sell or publish them.
2. If a User includes personal information in search conditions, instructions to AI clients, API key names, or the like, or if an AI client puts personal information from a conversation into tool arguments, it may be stored in the records in Section 3. The Company does not intend to collect it and will endeavor to delete it within a reasonable scope once identified.
3. Backups retain data for a period after the original records are deleted.
4. If an email address, phone number, contact label, or the like entered in an application identifies a specific individual (such as an email address containing a personal name), it may constitute “personal information” under law. Even then, the Company handles it within this Policy and does not sell or publish it.
5. Application emails and receipt notices travel over the Internet. If an email address is entered incorrectly, the receipt notice may reach a third party. The Company encrypts them when the receiving server supports it but does not guarantee encryption along the entire delivery path, and delivery may be delayed or fail because of mail server failures or the like.
6. The Company may disclose the information in Section 3 in response to lawful disclosure requests.
7. The Company takes reasonable security measures but does not guarantee that no leakage, loss, or damage of information will occur because of unauthorized access, cyberattacks, equipment failures, or the like.
8. The Company is not liable for the handling of information by AI client providers, carriers, or other third parties.

8. Requests for disclosure or deletion

To request disclosure, correction, suspension of use, or deletion of paid-plan application details, contact us through the form in Section 10 with your application number. Otherwise, because the Company holds no information identifying Users, it may be unable to identify your records. To request disclosure, correction, suspension of use, or deletion of the information in Section 3, contact us through the form in Section 10 with the information needed to identify the records, such as the date and time of use, your source IP address, and your API key identifier. The Company will respond within a reasonable scope in accordance with law.

9. Changes to this Policy

The Company may revise this Policy in response to changes in law, changes to the Service, and the like. A revised Policy takes effect when posted on this page (or on its stated effective date, if any). Material changes will be announced on the Service’s website.