Privacy Policy

Last updated: July 2026

1. Introduction

This Privacy Policy explains how we collect, use, process, and protect your personal data when you use the Shop Assistant AI shopping service, in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable European data protection laws.

2. Data Controller

Data Controller: Alfares s.r.o. (IČ: 27138038, DIČ: CZ27138038)

Address: Cetechovice 70, Czech Republic

Contact: [email protected] · +420 774 287 541

Data Protection Officer: [email protected]

3. Personal Data We Process

3.1 Session and Query Data

  • Session identifiers
  • Query text (natural language search requests)
  • Voice audio URLs (if provided; processed via ASR for transcription)
  • Feedback messages and selected product indices
  • Search results and choices

3.2 Technical Data

  • IP address, browser, device information
  • Logs (service, level, message, timestamp) sent to central logging

3.3 Optional User Identification

  • userId (if provided when creating a session via optional JWT auth)

4. Legal Basis for Processing

  • Contract performance: Providing the AI shopping assistant service
  • Legitimate interests: Security, fraud prevention, service improvement
  • Consent: Where applicable (e.g. optional analytics, marketing)
  • Legal obligations: Compliance with applicable law

5. How We Use Your Data

  • To operate the AI assistant (ASR, LLM, search, refinement)
  • To redirect you to merchant product pages when you choose a result
  • To improve and maintain the service
  • To comply with legal obligations and protect our rights

6. Data Sharing and Third Parties

We may share data with:

  • AI microservice: For speech-to-text (ASR) and LLM query refinement
  • External search APIs: (e.g. Serper) to perform product searches
  • Logging service: Central logging for operational logs
  • Database: Shared PostgreSQL for session and result storage

We do not sell your personal data. Third-party processors are bound by data processing agreements where required by GDPR.

7. International Transfers

If data is transferred outside the EEA, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions.

8. Data Retention

  • Anonymous session data: Kept only as long as needed to provide the shopping session and short operational troubleshooting.
  • Account session data: Available to the signed-in user until the user deletes it or requests anonymization through the account privacy controls.
  • Anonymization: Account-linked session identifiers can be detached from the account, and stored query/message/search-run text is replaced with anonymized markers while non-personal merchant result records may remain for service integrity.
  • Deletion: Signed-in users can delete their Shop Assistant session, profile, saved-search, message, result, and choice data from the account privacy endpoint.
  • Logs: Operational logs follow the central logging retention policy and should contain metadata only, not raw search text, JWTs, or secrets.

A repository-owned retention runner is available for anonymous session cleanup: npm run retention:cleanup defaults to dry-run, targets only anonymous sessions, uses an environment-configurable TTL and batch size, and requires an explicit apply confirmation before deletion. Production scheduling and deployment of that runner still require owner-approved operations wiring.

9. Your Rights (GDPR)

You have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate or incomplete data
  • Erasure: Request deletion ("right to be forgotten")
  • Restriction: Limit processing in certain cases
  • Portability: Receive your data in a structured, machine-readable format
  • Object: Object to processing based on legitimate interests
  • Withdraw consent: Where processing is based on consent

To exercise these rights, contact us at [email protected] or +420 774 287 541. You also have the right to lodge a complaint with your supervisory authority.

10. Security and Abuse Controls

We implement technical and organizational measures to protect your data, including encryption in transit and at rest, access controls, and secure infrastructure.

Search and refinement requests are rate-limited per anonymous IP address or signed-in user to reduce abuse and protect external search providers.

11. Children

Our service is not directed at children under 16. We do not knowingly collect data from children. If you believe we have collected such data, please contact us.

12. Changes

We may update this Privacy Policy. The "Last updated" date will be revised. Continued use after changes constitutes acceptance.

13. Contact

For privacy inquiries: [email protected] · +420 774 287 541

EU supervisory authority: Your local data protection authority

Cookie Preference

You can reset your stored cookie preference and choose again on the home page.