CommerceAI Privacy Policy
Last updated: Oct 15, 2026
1. Introduction
1.1 Overview. This Privacy Policy explains how [Marvelous Technology, Inc. ("CommerceAI", "we", "us") collects, uses, and shares personal information when you visit our website, create a developer account, or use the CommerceAI API, MCP server, developer console, and related services (the "Services"). It applies to our business customers and their personnel ("Customers") and their End Users (defined below), and to prospective customers and visitors to our website. By using the Services you acknowledge the practices described in this Policy. Capitalized terms not defined here have the meanings given in our Terms of Use.
1.2 Your End Users. Our Services are used by businesses to power AI agents that help their own users shop ("End Users"). We do not have a direct relationship with End Users. Section 3 explains how we handle data that Customers send to us about End Users, and where End Users should direct privacy requests.
1.3 Updates. We may update this Policy from time to time. We will post the updated version with a new "last updated" date, and for material changes will notify Customers by email or through the developer console before the changes take effect. Your continued use of the Services after the effective date means you accept the updated Policy.
2. Information We Collect
2.1 Information You Provide. When you create an account or contact us, we collect your name, work email address, company name and address, job title, password, and the contents of your communications with us. When you buy Credits, our payment processor (currently Stripe) collects your payment-card or bank details; we receive a payment confirmation, the last four digits of the card, and billing address, but not the full card number.
2.2 Information Collected Automatically. When you use the Services, we collect: (a) API and MCP usage logs, including your developer ID, a hashed form of your API key, request IDs, timestamps, IP addresses, outcome codes, Credits charged, latency, and error information; (b) developer-console and website activity, including pages viewed, features used, browser type, device and operating-system information, referring URLs, and approximate location derived from IP address; and (c) information collected through cookies and similar technologies as described in Section 6.
2.3 Information from Other Sources. We may receive information about you or your company from our payment processor, from identity and fraud-prevention vendors, from publicly available business sources (such as your company website or business registries), and from partners who refer you to us.
3. End User Data Sent Through the Services
3.1 Our Role. The Services we provide are set forth in CommerceAI’s Terms of Service. When a Customer's AI agent sends a request to the Services, the request may include Customer Input such as a shopping query, product identifiers, filters, or conversational context. Our Services are designed to work without personal information about End Users, and our Terms of Use require Customers to send only what is necessary and not to send sensitive data. If Customer Input nevertheless includes personal information about an End User, we process it only on the Customer's behalf and instructions as a "service provider" or "processor" under applicable privacy law.
3.2 What We Do With It. We use Customer Input to generate the requested Output, to secure and debug the Services, to detect fraud and abuse, and to bill Customers. We may use de-identified and aggregated query data to understand shopping trends and improve the Services, including catalog coverage, ranking, and relevance. We do not use Customer Input or Output to train or fine-tune AI models without the Customer's written consent, and we do not sell End User information or share it for advertising.
3.3 End User Requests. If you are an End User of an AI agent that uses our Services, the business that operates that agent controls your data. Please direct requests to access, correct, or delete your information to that business. If you contact us directly, we will refer your request to the relevant Customer where we can identify it.
4. How We Use Personal Information
We use the information described in Section 2 to: (a) provide, operate, and maintain the Services, including authenticating requests and maintaining the credit ledger; (b) process payments and manage your account; (c) provide support and respond to your inquiries; (d) monitor, secure, and debug the Services and detect and prevent fraud, abuse, and violations of our Terms; (e) analyze usage and improve the Services and our catalog; (f) send service notices, security alerts, and information about changes to our Terms or this Policy; (g) with your consent where required, send marketing communications about our products, which you can opt out of at any time; (h) comply with legal obligations and enforce our agreements; and (i) for any other purpose we describe at the time of collection.
5. How We Share Personal Information
We share personal information with: (a) service providers that host our infrastructure, process payments, provide analytics, customer-support, email, and security tooling, and, for AI-generated Output, operate the AI models we use, in each case bound by contract to use the information only to provide services to us; (b) our product-catalog data providers, but only in aggregated form (such as request volumes by category) as required by our license agreements, and never in a form that identifies an End User; (c) professional advisors, such as lawyers, auditors, and insurers; (d) law enforcement, regulators, or other parties when we believe disclosure is required by law, legal process, or to protect the rights, safety, or property of CommerceAI, our Customers, End Users, or the public; (e) a successor or acquirer in connection with a merger, financing, reorganization, or sale of all or part of our business, subject to this Policy; and (f) others with your direction or consent.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
6. Cookies and Analytics
Our website and developer console use cookies and similar technologies for authentication, security, remembering your preferences, and understanding how our site is used. We use first-party cookies and a limited set of third-party analytics tools. We do not use cookies for targeted advertising. You can control cookies through your browser or device settings. Please note that blocking cookies or other automatic data collection technologies may negatively impact your experience using the Services; for example, disabling essential cookies may prevent you from signing in to the developer console.
7. Data Retention
We keep account information for as long as your account is open and for a reasonable period afterward to resolve disputes, enforce our agreements, and comply with legal and tax obligations. API and MCP usage logs containing request metadata are kept for up to 24 months for security, billing, and analytics. Credit-ledger records are retained for as long as required for accounting purposes. We retain request content from Customer Input in identifiable form for no more than 30 days, after which it is deleted or de-identified. Otherwise, the retention period may vary according to certain criteria, such as the context of the processing and our legal obligations, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products. When we no longer need personal data, we delete or de-identify it.
8. Security
We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, hashed storage of API keys, access controls, and logging. No system is completely secure, and we cannot guarantee the security of information. You are responsible for keeping your credentials and API keys confidential and for the security of your own Agent Application.
9. Your Privacy Rights and Choices
9.1 Account Information. You can review and update most account information in the developer console, and can close your account at any time.
9.2 Marketing. You can opt out of marketing emails by using the unsubscribe link in the email or contacting us. We will still send service and transactional messages.
9.3 Rights. Depending on the laws in your jurisdiction or place of residence, you may enjoy certain rights regarding your personal data, as described further below. However, please be aware that these rights are limited, and we may also decline certain requests if we have a legal basis for doing so.
Below are rights which you may have, subject to the laws in your jurisdiction or place of residence:
- the right to know certain information about our processing of your Personal Data, including the right to access your Personal Data, often in a portable format;
- the right to request deletion of your Personal Data;
- the right to update and correct your Personal Data;
- the right to withdraw your consent with respect to certain processing or certain categories of Personal Data;
- the right to opt out of the sale of Personal Data, sharing for targeted advertising, and certain profiling (which we do not engage in); and
- the right to be free from retaliation relating to the exercise of any of your privacy rights.
9.4 Exercising Rights. Certain data rights and requests (such as requests updates to your information or close your account) can be initiated from the app. To exercise a right, you may also email support@commerceai.ai. from the email address associated with your account. We will verify your identity, which may involve confirming information we hold about you, and respond within the time required by law. You may authorize an agent to act for you if you give the agent written permission and we can verify your identity. If we decline a request, you may appeal by replying to our decision; if your appeal is denied, you may contact your state attorney general.
9.5 California Notice. For California residents: in the preceding 12 months we have collected the categories of personal information described in Section 2 (identifiers, commercial information, internet activity, professional information, and inferences drawn for analytics), from the sources and for the purposes described in Sections 2 and 4, and disclosed them for business purposes to the categories of recipients described in Section 5. We have not sold or shared personal information in the preceding 12 months, and we have no actual knowledge that we sell or share the personal information of anyone under 16.
10. Children
The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
11. Data Location
You acknowledge that CommerceAI is a company based in the United States. We process and store personal data in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction.
12. Contact Us
Questions or requests about this Policy can be sent to support@commerceai.ai.