Effective date: 8 April 2026
This page describes the data-handling practices of the Mink Viking Experience Model Context Protocol (MCP) server at https://mink.is/wp-json/mink-mcp/v1/mcp. It supplements the general Mink Viking Experience privacy statement with MCP-server-specific disclosures required for directory listings (Anthropic Connectors Directory, ChatGPT Apps, and similar curated platforms).
Summary
The Mink MCP server is a public read-only interface to business information (booking availability, pricing, hours, FAQ). It does not require accounts, does not collect personal data, does not store the content of requests, and does not share user information with any third party.
What the server collects
- IP address — used solely for per-IP rate limiting (60 requests per minute per IP on the MCP endpoint; 10 registrations per hour, 30 authorize requests per minute, and 20 token requests per minute on the OAuth endpoints). The IP is stored as a salted hash inside a WordPress transient that automatically expires within the rate-limit window (60 seconds to 1 hour depending on the endpoint). The IP is not written to any log file or database and is not used for any other purpose.
- Request headers and JSON-RPC payload — parsed in memory to route the request to the correct tool or resource handler. They are not persisted.
- OAuth 2.1 client registrations (optional) — if a client calls
POST /wp-json/mink-mcp/v1/register, the server stores the client name, redirect URIs, scope, and a hash of the client secret in a dedicated database table (wp_mink_mcp_oauth_clients). This information is provided by the integrator (usually another service or tool) and is not associated with any end user. - OAuth authorization codes and access tokens — stored as opaque random strings in WordPress transients with automatic expiry. Authorization codes expire after 10 minutes; access tokens expire after 1 year. Tokens are stored as ephemeral session identifiers only — they do not contain or grant access to any personal data, because the server exposes only public business information.
The server does not collect names, email addresses, phone numbers, locations, cookies, browser fingerprints, or any content generated by end users of AI agents that connect to it.
What the server returns
The server exposes only data that is already publicly available on mink.is: session availability (drawn from WooCommerce Appointments), pricing in seven currencies (drawn from the WCML live exchange-rate cache), business hours and location, a 164-question FAQ (82 in English, 82 in Icelandic), terms of service, and a templated prompt for AI agents planning a Reykjavik day. No personal data flows through any response.
Third-party sharing
The MCP server does not share any data with third parties. The hosting chain (Rocket.net managed WordPress + Cloudflare Enterprise CDN) processes request traffic as part of standard HTTPS delivery; neither party is provided with additional information beyond what is already described in the main Mink Viking Experience privacy statement.
Retention periods
- Rate-limit records (hashed IP buckets): 60 seconds to 1 hour, auto-expired by WordPress transient TTL.
- OAuth authorization codes: 10 minutes, auto-expired.
- OAuth access tokens: 1 year, auto-expired. Tokens can be revoked earlier by calling
POST /wp-json/mink-mcp/v1/revoke. - Registered OAuth clients: retained until the client is explicitly removed. No end-user data is associated with these records.
- Request content and payloads: not retained.
Security
- All traffic is served over HTTPS (TLS 1.2+) via Cloudflare Enterprise.
- OAuth 2.1 flows enforce PKCE with SHA-256 (S256) challenge method.
- Client secrets are stored using PHP
password_hash()with the default algorithm; plaintext secrets are returned only once at registration time and never stored. - Rate limiting is applied separately to the MCP endpoint, the OAuth registration endpoint, the authorize endpoint, and the token endpoint to prevent abuse.
- Authentication is optional — the server is public read-only. Tokens therefore grant only the same access as unauthenticated requests and are not a security boundary.
Your rights
Because the Mink MCP server does not collect personal data about end users, there is typically no personal data subject to access, correction, deletion, or portability requests in the context of the MCP endpoint itself. If you believe your personal data has nonetheless been associated with this service — for example because you registered an OAuth client on behalf of your organization and want it removed — contact mcp@serfraedingur.is and we will act on the request within 30 days.
For any personal data processed in connection with Mink Viking Experience as a business (bookings, customer support, marketing), the Mink Viking Experience privacy statement applies.
Contact
For technical questions about the MCP server, integration partnerships, or privacy requests related to the MCP endpoint:
- Email: mcp@serfraedingur.is
- Website: https://mink.is
- Architecture writeup: mink.is/from-email-to-ai-native/
For general privacy questions about Mink Viking Experience as a business, see the main privacy statement at mink.is/privacy-statement-au/.
