Privacy

• Account: your email and sign-in identity, held by our authentication provider. Passwords are hashed; we never see them.
• Profile: display name and company name - only what you type in.
• Early access: the contact details, buyer brief or seller application, category, scale, timing and store URL you submit so the founding cohort can be reviewed.
• Searches and saved searches: the sentence you wrote, plus filters such as country, category and result limit.
• Agent runs: the query, which tools ran, the bounded arguments and results of each call, latency, tokens used, estimated cost and the model name. This powers the run timeline; the standalone build does not automatically bill that estimate.
• Negotiations: every turn - the offer, the reasoning summary, confidence, and the guardrail checks - written to an append-only hash-chained log.
• Orders: product, amount, currency and status.
• Seller data: your products, adapters and their configuration.

Access rules are enforced in the database, not just in the interface. You can read your own profile, searches, runs, orders and negotiation log. Sellers can additionally read orders placed against their own products, and their own products and adapters.

Adapter configuration - which can contain API credentials - is readable only by the seller who owns it. Other signed-in users, including other sellers, cannot read it.

Administrators of this deployment can read operational configuration and aggregate metrics, and can see runs for support purposes. There is no path for a user to grant themselves that role from the app.

• Model calls: your query and the relevant context are sent to the model provider that runs the agent, so it can answer.
• Web search: search terms are sent to the search backend when an agent uses the web-search tool.
• Seller adapters: when an agent calls a seller's adapter, the request goes to that seller's endpoint - so that seller sees what was asked for.
• Local models: if you use Ollama or LM Studio, those calls go from your browser to your own machine. That traffic never reaches us.

Negotiation turns and settlement decisions are append-only by design: each entry hashes the one before it, so tampering is detectable. That means we cannot quietly edit or delete an individual turn - if we did, the chain would visibly break. If you need a negotiation record removed, we can remove the whole session rather than rewrite it.

• We do not sell your data, and we do not run advertising.
• We do not use hidden fees, fake scarcity or countdowns - the numbers shown are the numbers.
• We do not store card details ourselves; payments in this preview are simulated, and live rails are handled by the seller's payment provider.
• We do not share your negotiation ceiling with the seller, or the seller's floor with you.

We store a session token so you stay signed in, and a small amount of local settings - such as your local-model endpoint and demo preferences - in your browser. No third-party tracking cookies are set by the app.

Account, profile, product and order records are kept while your account is open. Agent runs and searches are kept so you can review your own history and so usage can be metered. You can delete individual saved searches and listings at any time from the console.

• Export or delete your account data: ask the operator of this deployment and we will action it.
• Run a local model to keep prompts off third-party providers entirely.
• Disable an adapter to stop agents calling it, without deleting its configuration.
• Revoke a connected external assistant's access from your settings.

This service is not intended for people under 16, and we do not knowingly collect their data.

If this page changes materially, the date at the top changes with it. For a privacy question, a data export, or a deletion request, contact the operator of this deployment through the address published in your account settings.