Privacy Policy — MyCloud MCP Connector
Last updated: 16 October 2026
1. What this policy covers
The MyCloud MCP connector lets a merchant connect an AI assistant — such as Claude or ChatGPT — to their own MyCloud OMS account, so the assistant can answer questions about that account's orders, stock arrivals and returns. The connector is read-only: it can look things up, and it cannot create, change or delete anything in MyCloud OMS.
This policy covers only the connector, at https://mcp.mycloudfulfillment.com.
The MyCloud website and the MyCloud OMS web application are covered by the
MyCloud Privacy Policy.
2. Who is responsible
This connector is operated by E-Empowerment Company Limited, 11/6, Khlong Song Ton Nun, Lat Krabang, Bangkok 10520, Thailand — the company that publishes the MyCloud Privacy Policy.
You are the data controller. The personal data this connector reaches is the personal data in your own MyCloud OMS account, your end customers' names, telephone numbers and delivery addresses among it. You decide what is in that account and what is done with it.
MyCloud is your data processor. It reads that data on your instruction — the instruction being the question you ask in your own AI conversation — and does nothing with it that you have not asked for. It is not used for advertising, for profiling, or to train any AI model.
The records we hold to make the connection work are listed in section 3: your sign-in email, the encrypted MyCloud OMS token, the shop list and the audit trail. They exist so that we can provide the connector to you, and section 8 says how long each one is kept.
3. Personal data we collect
When you connect your AI assistant
| Data | Where it comes from | Do we store it? |
|---|---|---|
| Your MyCloud OMS sign-in email | You type it on our sign-in page | Yes, in plain text |
| Your MyCloud OMS password | You type it on our sign-in page | No. It is passed once to MyCloud OMS to sign you in, and is never written to our database or to any log |
| A MyCloud OMS refresh token for your member account | Issued to us by MyCloud OMS when you sign in | Yes, encrypted |
| The list of shops your member account belongs to (shop id and shop name) | MyCloud OMS | Yes |
| The identity of the AI application that connected, and its registration details | The AI application | Yes |
| The access and refresh tokens we issue to that AI application | Generated by us | Only as a SHA-256 fingerprint. The tokens themselves are never written down |
When you use it
- An audit record of every request: the name of the tool called, the shop it was for, the arguments you asked with, whether it succeeded, and how long it took.
- Those arguments contain text you typed. If you search by customer name, that customer's name appears in our audit record.
- A record of each call we make to MyCloud OMS: the method, the path, the response status and the shop. No request or response bodies.
- Connection metadata, including your IP address, recorded by our hosting provider.
We do not use cookies, and we run no analytics or tracking of any kind on our pages.
4. What we never store
- Your MyCloud OMS password.
- Any order, customer, stock or shipment record from MyCloud OMS. These are read from MyCloud OMS when you ask a question, used to compose the answer, and not written to our database.
- Export files. A download link carries the filters you asked for, not the file. The file is rebuilt from MyCloud OMS each time the link is opened, and no copy is kept.
- Your conversation with the AI. We do not read, request or store chat history, conversation summaries, assistant memory or files you uploaded to the AI application.
5. Why we use it
- To sign you in to MyCloud OMS, and to keep the connection working without asking for your password again.
- To determine which shops a request is allowed to read. This is decided by MyCloud OMS on every request.
- To answer the questions you ask through your AI assistant.
- To keep an audit trail of what was read and for which shop. The connector reads records about other people's goods and money, so this is not optional.
- To investigate faults and respond to support requests.
We do not use any of this data for advertising or profiling, and we do not use it to train any AI model.
6. What is sent to your AI provider
To answer a question, the connector sends its answer to the AI application you connected. That application runs on the AI provider's own infrastructure, outside Thailand.
The answer contains the MyCloud OMS data you asked for. Depending on the question, that can include personal data about your end customers:
- Looking up a single sales order returns the recipient's name, telephone number, delivery address and postcode.
- A spreadsheet export includes, for every order in the range: Shipping Name, Shipping Address, Shipping Postcode, Shipping Phone, Shipping Email and Shipping Country.
This happens only in response to a question asked in your own AI conversation, and only for shops your MyCloud member account belongs to.
What the AI provider does with the answer is governed by that provider's own terms and privacy policy, not by this one:
- Anthropic PBC (United States) — anthropic.com/legal/privacy
- OpenAI (United States) — openai.com/policies/privacy-policy
Taking this out of Thailand. The destination country's personal data protection standards may not be ones the Personal Data Protection Act B.E. 2562 (2019) regards as adequate. The transfer is made on the basis of your consent under section 28 of that Act: having been told that here, you give it by connecting an AI application and asking it a question. Nothing is sent unless you ask something that needs it.
You may withdraw that consent at any time by disconnecting the connector, which stops any further transfer. Withdrawing does not undo a transfer already made.
7. Who else receives data
| Recipient | Where | What they receive |
|---|---|---|
| The AI provider you chose (Anthropic or OpenAI) | United States | The answers to your questions, as described in section 6 |
| Render (hosting and database) | Singapore region | Everything listed in section 3, and connection metadata including IP address |
| MyCloud OMS | Thailand | The source system. The connector reads from it on your behalf |
We do not sell personal data, and we share it with no one else.
8. How long we keep it
This section describes what the connector does today.
| What | How long |
|---|---|
| Your connection: email, encrypted OMS token, shop list | Until the connection is revoked |
| A revoked connection | The record is kept and marked revoked, as an audit trail. It is not deleted |
| An access token we issued to your AI application | Stops working 30 days after it was issued. The fingerprint row is not deleted when it expires |
| A refresh token we issued to your AI application | No expiry. It works until the connection is revoked |
| A connection you stop using | If MyCloud OMS stops accepting the token it issued to us — which happens after a long period without use — the connection stops working and you are asked to sign in again |
| An authorization you started but never finished | Stops being usable 10 minutes after it was started. The record itself, including the encrypted MyCloud OMS token, is not deleted automatically today |
| A download link | 7 days. Nothing is stored — the link carries filters, and is also refused immediately if the connection is revoked or you lose access to the shop |
| Audit records and server logs | Up to 30 days. They are written to our hosting provider's log stream, and no separate copy is kept by us |
Stated plainly, because it is true today: expired records are not removed on a schedule. Rows that have stopped being usable remain in the database.
9. How we protect it
- The MyCloud OMS refresh token is encrypted before it is written to the database. The encryption key is held in the server environment and is never stored in the database.
- Tokens we issue are stored only as SHA-256 fingerprints, so a copy of the database cannot be replayed against us.
- Your password is never written to the database or to any log.
- All traffic is over HTTPS.
- Which shops a request may read is decided by MyCloud OMS on every single request, not by anything stored here. A shop your member account does not belong to is refused.
10. Your controls
- Disconnecting in your AI application stops that application from calling us. On its own, it does not remove the connection stored here.
- To have the connection and the stored MyCloud OMS token removed, email cto@mycloudfulfillment.com. We will action it within 30 days.
- Authorizing again from the same AI application replaces your previous connection. The old one stops working immediately.
11. Your rights
Under the Personal Data Protection Act B.E. 2562 (2019) a data subject may request access to their personal data, a copy of it, correction of it, erasure, restriction of its use, or object to its use; may withdraw consent; and may lodge a complaint with the Personal Data Protection Committee.
For the personal data inside your MyCloud OMS account, you are the controller and those requests are yours to answer. Where one reaches us instead, we pass it to you rather than answering it ourselves, because the records are yours and not ours to disclose or delete.
For the records we hold in order to operate the connection — the ones listed in section 3 — email cto@mycloudfulfillment.com. Section 10 covers removing the connection and the stored MyCloud OMS token.
If you are an end customer whose name, address or telephone number appears in a merchant's MyCloud OMS records: those records belong to that merchant, who is their controller. Please contact the merchant you ordered from. We cannot answer a request about them on that merchant's behalf.
12. Changes to this policy
Changes are published on this page, with the date at the top updated. If a change materially affects what is sent to your AI provider, we will say so on this page.
13. Contact
Privacy and data protection: cto@mycloudfulfillment.com
Support: teetat.k@mycloudfulfillment.com
E-Empowerment Company Limited
11/6, Khlong Song Ton Nun, Lat Krabang, Bangkok 10520, Thailand