Who is responsible
RedCommerce operates MyShoppingPal and is responsible for the data processing described here. This policy covers our website and shopping plugin.
OpenAI operates ChatGPT under its own privacy policy. Retailers also have their own policies.
Information we process
Shopping requests
We receive the shopping request, selected products, filters, and other context sent to our tools by ChatGPT. This can include your country, region, language, and technical user and conversation identifiers.
This does not give us automatic access to your entire ChatGPT history. Please avoid including personal or sensitive details in shopping requests.
Shopping state
We keep recent choices in server memory so follow-up requests can update the same search. That memory state expires after two hours without use or when the service restarts. We also save some shopping choices, selected products, and questions in a protected database so earlier result cards can work after a restart. These saved results expire after 90 days without use.
Usage records
We record the time, tool used, market, country and region, language, product or category, result status, offer count, and retailer names. We transform user and conversation identifiers with a secret salt before saving them.
These identifiers are pseudonymous: they can link activity without directly showing your identity. They are not treated as fully anonymous.
When a search finds no offers, we may save up to 120 characters of the request to understand missing coverage. We do not save city names or coordinates in these usage records.
Retailer clicks
Opening a retailer link records the time, product, retailer, destination URL, source, price when available, and a random click identifier. It can also record a conversation reference, referring page, and browser user-agent header.
Support and technical information
If you contact us, we receive your email address, message, and any attachments. Our systems process network details, including IP addresses, to deliver requests. Error diagnostics can contain technical request details.
Why we use this information
We use shopping requests and temporary state to provide the service you ask for. We use support messages to respond to your request.
We use limited usage and click records to understand missing products, measure referral activity, keep the service working, and investigate errors or misuse. Our legal basis for this operational use is our legitimate interest in running and improving the service. You may object to processing based on that interest.
Where necessary, we also process information to meet legal obligations or deal with legal claims. We do not use these records to make decisions about your eligibility for credit, employment, insurance, or similar services.
How long records stay
- Shopping state in memory expires after two hours of inactivity and clears on restart. Saved result cards expire after 90 days without use; expired database records are removed when another result is saved.
- Usage log files older than 90 days are removed when the daily cleanup runs with new activity.
- Retailer-click records are kept for up to 90 days.
- Search caches are reused for seven days when no link is found, or 30 days when a link is found. Expired cache entries may remain until replaced or manually removed.
- Support correspondence is kept for up to 24 months after a request is closed, unless needed for a legal obligation or an ongoing dispute.
Product specifications, retailer offers, and price history are product records. They are retained to maintain the catalogue and do not need a shopper identity.
Technical diagnostics are retained as needed to investigate service problems. Information needed for a specific legal obligation or dispute may be kept longer for that purpose.
Where processing happens
Our current Hostinger VPS is in Germany. OpenAI, search providers, and retailers may process information in other countries, including outside the European Economic Area.
The safeguards required for an international transfer depend on the provider and destination. Contact us for details about the providers and transfer arrangements used for your request.
Saved lists and shared links
When you use bookmarks, we store list names, product and variant identifiers, product names, images, and the time you saved each product. We use a private access token to retrieve your lists. For plugin lists, we may also use a hashed ChatGPT user identifier when ChatGPT provides one.
Sharing creates a separate copy containing the list name, products, checked retailer offers and links. Anyone with the shared link can view that copy. Keep personal details out of list names. Changing a private list does not change a previously shared copy.
Saved lists, access records and shared copies currently have no automatic deletion schedule. Shared links remain accessible until revoked. Contact us to request deletion of stored data or removal of a shared link. Clearing browser data or disconnecting ChatGPT does not itself delete server-held lists.
The live website chat
When you send a question in the website chat, we send your question and up to four recent exchanges to nexos.ai to use the DeepSeek model. The model turns your request into search criteria. MyShoppingPal supplies checked product offers from its catalogue. This website chat is separate from ChatGPT and does not send your messages to OpenAI.
We keep the chat context in server memory for up to 30 minutes after your last request. It clears on a restart. Your browser keeps the chat identifier only while the page is open. We do not save website chat transcripts to a database or application log.
Cloudflare Turnstile checks requests for bots. Cloudflare receives network and browser information, and we send your IP address with the security token for verification. We keep a daily salted hash of your network address and request counts to limit misuse and model costs. These counters are replaced on the next request after the UTC date changes. The live website chat does not run paid Serper searches.
nexos.ai, its model providers, and Cloudflare process information under their own service and privacy terms and may process it outside the European Economic Area. Please do not include sensitive or personal information in shopping questions. Contact us for details about these providers.
Your choices and rights
Depending on applicable law, you can request access, correction, deletion, restriction, or a copy of your data. You can also object to processing based on legitimate interests.
Contact admin@redcommerce.nl. We may need limited information to locate a record and check that the request is yours. We do not receive your email address from ChatGPT merely because you use the plugin.
You can stop using the plugin or remove its connection in ChatGPT. Removing a connection does not itself erase records already held by us.
You can complain to the Dutch Data Protection Authority or your local data protection authority.
Changes to this policy
We will update this page if our practices change. The date at the top identifies this version. A new use requiring your consent will not rely on this notice alone.