ShopGPT

    Privacy Policy

    Last updated: October 21, 2026

    Introduction

    This Privacy Policy describes how ShopGPT, a sole proprietorship ("ShopGPT", "we", "us", or "our"), collects, uses, and discloses your information when you use our service, and the privacy rights that protect you.

    ShopGPT is an AI-powered shopping search tool. You type what you're looking for in plain language; we search public product listings across dozens of retail marketplaces worldwide and use AI to grade the deals. By using the Service you agree to the collection and use of information in accordance with this policy.

    Definitions

    • •Account — a unique account created for you to use the Service.
    • •Company (referred to as either "the Company", "We", "Us" or "Our" in this Policy) — ShopGPT, a sole proprietorship.
    • •Service — the ShopGPT website and search application at shopgpt.dev.
    • •Personal Data — any information relating to an identified or identifiable individual.
    • •Usage Data — data collected automatically from your use of the Service or its infrastructure.
    • •Service Providers — third parties that process data on our behalf, including Z.ai (GLM models: AI deal analysis and the shopping-assistant chat), Supabase (authentication and database), Hetzner (backend server hosting, Germany), Cloudflare (frontend hosting and network), our residential-proxy provider (used to fetch marketplace pages), a currency-rate API (price conversion), and — if and when paid plans launch — Paddle.com as our payment processor and Merchant of Record.
    • •Fallback AI providers — when our primary AI provider is unavailable or rate-limited, a request may instead be served by DeepSeek, Groq, Google (Gemini), or OpenRouter.
    • •You — the individual or entity using the Service.

    Information We Collect

    Account information

    • •Email address
    • •Name and profile picture (only if you sign in with Google)
    • •Your plan, credit balance, and subscription status

    Search & usage data

    • •Search queries you enter, the marketplaces you select, and your chosen search depth
    • •Per-search metering records: the query, marketplaces, pages scraped, credits charged, number of products returned, AI token counts, our own AI/proxy cost for the run, and response latency. We record this to understand what the Service costs us to run and to set fair pricing.
    • •Saved searches: when a search completes we store a snapshot of it on our servers — the query, your settings, the product results, the AI summary, and the per-marketplace briefs — so you can reopen it instantly and for free from your search history. Snapshots are private to your account and kept until you delete them or your account.
    • •Cached search results, stored temporarily to speed up repeat searches and expiring automatically after about 12 hours
    • •Messages you send to the shopping-assistant chat, which are transmitted to our server and to our AI provider in order to generate a reply
    • •Standard server and network logs. Our web server and Cloudflare record ordinary access-log data — IP address, browser user-agent, and the request made — as a normal part of serving and protecting the site.

    Payment information

    Paid plans are not yet available; every account is currently on the free tier and no payment details are collected. When paid plans launch, payment will be processed by Paddle.com as our Merchant of Record. Paddle will collect and process your billing and payment details under its own privacy policy; we will never see or store your full card details.

    We do not sell your personal data, we do not run advertising or third-party analytics or tracking pixels, and we do not buy or sell products ourselves — ShopGPT links you out to the marketplace to complete any purchase.

    Cookies & Local Storage

    We use minimal cookies and your browser's local storage. We do not use advertising or analytics cookies:

    Authentication (Supabase)

    Keeps you signed in. Managed by Supabase Auth.

    Preferences & local data (localStorage)

    Theme choice, search depth, shopping-assistant chat transcript, product-comparison selections, and a cached currency-rate table. This copy stays on your device — clearing your browser storage removes it. Note that chat messages themselves are still sent to our server and AI provider when you send them, because that is how a reply is generated.

    How We Use Your Information

    • •To run searches: fetch listings from the marketplaces and generate the AI deal analysis.
    • •To manage your account: authentication, plan, and credit balance.
    • •For AI processing: your search data and chat messages are sent to our AI provider to produce the analysis and assistant replies.
    • •To measure cost and set pricing: token counts, latency, and per-run cost are aggregated so plan prices reflect what the Service actually costs to operate.
    • •To process payments: via our payment processor, once paid plans are available.
    • •To improve the Service: diagnose issues and understand usage trends.
    • •To contact you: about security, account, or important service notices.

    AI Processing & International Transfers

    What we send. To generate deal analysis and assistant replies we send the AI provider your search query, the public product listings we retrieved, and your chat messages. We do not send your name, email address, account identifier, or any payment information. These calls are made by our own server, so the AI provider never sees your IP address, your browser, or your device, and has no way to link a request back to you.

    Who processes it. Our primary AI provider is Z.ai (the GLM models), operated by Jingsheng Hengxing Technology Pte. Ltd. of Singapore, which states that customer data is generally processed in Singapore. If it is unavailable or rate-limited, a request may instead be served by DeepSeek, which processes and stores data in China, or by Groq, Google, or OpenRouter, which operate primarily from the United States. Each provider handles the data under its own privacy policy and uses it to return a response.

    Cross-border transfer. This means the text of your searches and chat messages may be processed outside your own country, including outside the EEA and the UK, in jurisdictions that have not received an EU adequacy decision. As with any AI assistant, it's worth keeping personal or financial details out of what you type.

    Everything else stays with us in the EU. Your account, credit balance, saved searches, and cached results live in our own infrastructure — backend server in Germany, database and authentication with Supabase — with Cloudflare serving the frontend from its global network. None of that is sent to an AI provider.

    Where Your Data Lives

    • •Your browser: theme, search depth, chat transcript, comparison picks, and cached currency rates live in localStorage on your device.
    • •Our database (Supabase / PostgreSQL): account info, credit balance, per-run metering records, saved-search snapshots, and short-lived cached search results. Encrypted in transit and at rest, and isolated per user by row-level security.
    • •Our backend server (Hetzner, Germany): processes searches in memory and writes standard access and application logs. It does not keep its own copy of your results.
    • •Chat metering: we record how expensive each assistant reply was — rounds, tool calls, token counts, cost — but not the text of your messages.

    Data Retention & Deletion

    We keep personal data only as long as needed to provide the Service. Cached search results expire automatically after about 12 hours. Saved-search snapshots are kept until you delete them, because their purpose is to let you reopen a past search.

    You can:

    • •Delete any saved search from your search history in the app.
    • •Clear your browser's local storage to remove theme, chat, and comparison data.
    • •Request account deletion, which removes your server-stored data — including saved searches — within 30 days (except where retention is legally required).
    • •Contact us for a data export or deletion request at [email protected].

    Security

    • •All traffic encrypted in transit via TLS/HTTPS.
    • •Authentication and session management handled by Supabase Auth (JWT); database access restricted with row-level security, so saved searches and account records are readable only by their owner.
    • •Server-only secrets (database service-role key, AI provider keys) are never exposed to the browser.
    • •Internal metering tables are service-role only and are not readable by any user account.

    No method of transmission or storage is 100% secure; while we use commercially reasonable measures, we cannot guarantee absolute security.

    Links to Other Websites & Marketplaces

    ShopGPT is not affiliated with, endorsed by, or sponsored by any of the marketplaces it searches, and none of them sponsor or endorse ShopGPT. We surface publicly available listing information and link you to the marketplace to view or buy. When you follow those links you are subject to that marketplace's own privacy policy and terms. Marketplace names and logos belong to their respective owners.

    We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services. We strongly advise You to review the Privacy Policy of every site You visit.

    Children's Privacy

    The Service is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us data, please contact us and we will delete it.

    Your Rights (GDPR / EEA Users)

    If you are in the European Economic Area, you have the right to:

    • •Access copies of your personal data.
    • •Rectify inaccurate data.
    • •Erase your data.
    • •Restrict or object to processing.
    • •Data portability.

    See AI Processing & International Transfers above for where AI processing takes place. To exercise any of these rights, email [email protected].

    Your Rights Under CCPA (California Users)

    If You are a California resident, You have the following rights under the California Consumer Privacy Act (CCPA):

    • •Right to Know: You can request information about the categories and specific pieces of personal information We have collected.
    • •Right to Delete: You can request deletion of Your personal information.
    • •Right to Opt-Out: You can opt-out of the sale of Your personal information. Note: We do not sell personal information.
    • •Right to Non-Discrimination: We will not discriminate against You for exercising Your privacy rights.

    To exercise any of these rights, email [email protected].

    Changes to This Policy

    We may update this Privacy Policy from time to time. We will post the new policy on this page and update the "Last updated" date. Continued use of the Service after changes take effect constitutes acceptance.

    Contact Us

    If you have any questions about this Privacy Policy, You can contact us:

    © 2026 ShopGPT. All rights reserved.