Shop with OpenMerchant Privacy Notice

This notice explains how OpenMerchant Inc (“OpenMerchant,” “we,” “us,” or “our”) handles personal information when you shop through the Shop with OpenMerchant connectors and plugins in AI apps such as ChatGPT and Claude (the “Shop connectors”). It supplements the OpenMerchant Privacy Policy, which also applies. Where this notice is more specific about the Shop connectors, this notice controls.

1. What the Shop connectors do

The Shop connectors let an AI app search products from merchants that sell through OpenMerchant and from other merchants' public catalogs, compare them, request quotes, build a cart, and check out. You can search without an account. Signing in to an OpenMerchant shopping profile is optional: it lets the AI app reuse details you saved and pay with a card from your OpenMerchant wallet after you confirm the total. Each merchant is the seller of the items you buy from it.

2. Personal information we collect

Category	What it includes	Source
Shopping requests	Search terms, product and variant identifiers, quantities, and the contents of quotes, carts, checkouts, and orders	The AI app, from your conversation
Contact and delivery details	Name, email, phone number, shipping, billing, and pickup addresses, and delivery and merchant preferences	You, through the AI app or your OpenMerchant profile. In ChatGPT, addresses are entered only on your OpenMerchant profile
Account and connection details, if you sign in	Your OpenMerchant account identifier and email, the AI apps you connected, the permissions you approved, and when they were used	You and the AI app's sign-in
Birth date, only with your separate consent	The birth date saved in your profile, for a quote or purchase that requires it	You
Payment information, if you sign in	For saved cards, the card brand, last four digits, and expiry; payment approvals, spending limits you set, payment tokens limited to one checkout, and payment status. Card numbers are entered only on OpenMerchant's secure wallet page and are processed by Stripe.	You and Stripe
Approximate location	The coarse location an AI app shares with its requests. ChatGPT sends a city, region, country, time zone, and coordinates; we use only the country, the region, and a ZIP code estimated from the coordinates	The AI app's request
Technical information	The IP address and user agent of the request the AI app sends, and the country and region derived from that IP address	The AI app's request

The AI app decides what it sends from your conversation. We don't ask for your conversation history, and we never ask for card numbers or security codes in it.

3. How we use it

We use this information to:

1. Answer the AI app's requests: find products, show prices, availability, and discounts, request quotes, and build carts and checkouts;
2. Show the prices and availability for where you're shopping from, and estimate shipping and tax before you choose a delivery address, using the approximate location the AI app shares;
3. Complete a purchase you confirm: pass the order to the merchant and pay with the payment method you chose;
4. Reuse the details you saved, so you aren't asked for them again;
5. Show merchants how shoppers find their products, and credit the search that led to a sale;
6. Protect the service: prevent fraud and abuse, enforce rate limits and discount limits, and diagnose errors; and
7. Provide support, keep required records, and meet legal obligations.

We don't sell your personal information, use it for targeted advertising, or use it to train general-purpose AI models.

4. Who receives it

• The merchant you buy from or ask for a quote: the items, your contact and delivery details, your approximate location (country, region, and estimated ZIP code), and the payment status needed to quote, fulfill, and support your order. Merchants also see the search terms that returned their products in their discovery reports, and the IP address and user agent of the AI app's requests in their request logs. For order information, the merchant's own privacy notice also applies.
• Other catalogs we search for you, such as Shopify's product catalog and merchants' public catalogs: your search terms and your approximate location (country, region, and estimated ZIP code), but not your contact or payment details.
• Stripe: card details you enter on the wallet page, payment tokens, and the transaction details needed to process payments and prevent fraud. See Stripe's Privacy Policy.
• The AI app you use, such as ChatGPT (OpenAI) or Claude (Anthropic): the results of the requests it makes, including saved details you allowed it to read when you signed in. The AI app's own privacy policy governs what it does with them.
• Service providers that host and operate the service for us under confidentiality and security obligations, and recipients required by law, as described in Section 6 of the OpenMerchant Privacy Policy.

5. How long we keep it

• AI app sign-ins: an AI app's access token expires after one hour. Its sign-in ends 90 days after you approve it, or sooner when you disconnect it.
• Carts and checkouts: a cart expires after 24 hours and an unpaid checkout after 6 hours. Records of quotes, checkouts, orders, and payments are kept for as long as needed for fulfillment, refunds, disputes, fraud prevention, and tax and accounting obligations.
• Request logs: our request logs and merchants' request logs, including IP addresses and user agents, are deleted after 30 days. Application logs are deleted after 90 days.
• Approximate location: we don't store the city, time zone, or coordinates an AI app shares. The country, region, and estimated ZIP code stay with the quote, cart, or checkout they priced, and in request logs for 30 days.
• Discovery reports: the private request details behind a merchant's discovery report, such as the AI app's user agent, are removed after 90 days. The search terms and the derived country and region remain in the merchant's report.
• Discount limits: if you give your email or phone number for a quote, the hashed form used to enforce a discount's limits is deleted 90 days after the discount ends.
• Saved profile details and cards: kept until you remove them or delete your account.

6. Your choices and controls

• Search without an account, and sign in only if you want your saved details reused or want to pay with a saved card. In ChatGPT, delivery also needs sign-in: orders ship only to an address saved on your OpenMerchant profile.
• When you connect an AI app, you approve the permissions it receives. Reading your birth date needs a separate consent.
• Nothing is paid until you confirm the total. A saved-card payment can also ask you to approve it or authenticate your card on OpenMerchant's secure page.
• Disconnect an AI app at any time under Connected apps in your OpenMerchant profile, or in the AI app. Disconnecting revokes its access.
• View, change, or remove your saved cards, addresses, and contact details in your OpenMerchant profile, and revoke spending limits you set.
• Delete your account from your profile. We then remove your saved cards, revoke connected apps and sessions, and close the account, keeping only the records we must retain.
• For access, correction, deletion, or other privacy requests, email support@openmerchant.dev. For an order, the merchant you bought from can also help.

7. Children

The Shop connectors are not directed to children. See Section 12 of the OpenMerchant Privacy Policy.

8. Changes and contact

We publish changes to this notice with a new effective date. Questions and requests: support@openmerchant.dev

OpenMerchant Inc
Attn: Privacy
United States