Effective 2 October 2026. Provider: Chanjao Longevity Co., Ltd. (บริษัท จันทร์เจ้า ลองจีวิตี้ จำกัด), trading as MySkinRecipes, 50 Ramindra 14, Bangkok 10230, Thailand. Contact: care@myskinrecipes.com, +66-2-002-7-002. This notice supplements our Shop privacy policy at https://www.myskinrecipes.com/shop/en/privacy-policy and covers https://myskinrecipes.com/mcp.
Information and purposes
We receive the tool arguments and records selected for a request, not unrestricted access to your entire conversation. Public discovery can include product queries, IDs, language, currency and filters. Connecting your existing Shop account lets us verify identity and permissions and read or change the cart, wishlists, preferences and other existing records you authorize. Existing orders, organization, support and lab or machine-service information are subject to native access rules. We use this information to fulfil requests, apply current prices and catalog restrictions, prevent duplicate actions, secure the connection and diagnose failures.
Sign in only on the first-party Shop website. Do not put passwords, OTPs, API keys, payment-card details, government identifiers or medical records in chat or attachments. We do not require these as tool arguments. Reagent and unreviewed products are outside this integration's catalog.
Recipients and international processing
OpenAI processes conversations and plugin interactions under its own terms and privacy policy. MySkinRecipes operates the Shop, account, catalog and support infrastructure. Non-English product search text may be sent to Google Cloud Translation's global service; catalog semantic retrieval runs through MySkinRecipes' catalog-search infrastructure. Account credentials and tokens are not supplied to translation prompts. The providers described in our Shop privacy policy support hosting, storage, email, diagnostics and existing business workflows. Data may be processed in Thailand and other countries where these services operate. Contact us for current processing-location and service-provider information. We do not sell personal information, as stated in the Shop policy.
Retention
MCP access tokens expire after 15 minutes, rotating refresh tokens after a 30-day window, and connection grants after up to one year. Encrypted action-outcome records expire after 90 days; expired MCP state is cleaned hourly. Common application log files rotate with 15-day retention and ordinary nginx access/error logs rotate daily with 52 retained rotations. MCP OAuth proxy access logging is disabled. Some host/container diagnostic and monitoring logs follow their separate operating retention.
The persistent product-query translation cache and native cart idempotency journals currently have no automatic expiry. They remain until operational maintenance or an applicable verified deletion process removes them. Shop orders, invoices, support records and backups have separate retention for account operation, accounting, security, legal obligations and recovery under the Shop privacy policy; the MCP's 90-day expiry does not delete those records or backup copies.
Choices and rights
You can disconnect the integration at https://myskinrecipes.com/shop/en/auth/mcp-connect?manage=1. This stops future authorized access; it does not reverse completed actions or delete every existing business record. Use ordinary account settings or contact care@myskinrecipes.com for access, correction, export or deletion requests. We verify identity and apply lawful retention exceptions. The existing Shop policy describes a 30-day account-deletion/anonymization process, with transaction and tax exceptions. For an uncertain action, consult its status/current resource and contact support before repeating it.
Security
We use HTTPS, account-scoped authorization, catalog checks and encrypted MCP connection/action storage. Technical safeguards reduce risk but cannot guarantee perfect security. MySkinRecipes is not intended for children. Changes to this notice are published here with an updated effective date.