Privacy

When you create an account, we keep:

• Your email address. If you sign up with an email and a password, the password goes to our sign-in provider, Supabase, which stores only a scrambled form of it (a hash). We never see or store it in plain form.
• Your Google name, email and picture, if you sign in with Google. Google tells us those, and nothing from your Google account beyond them.
• That you agreed to the Terms: your email address, which version, the time, the IP address and browser details you agreed from, and how you signed in, so we can show what was agreed.
• Your report history: which reports you ran and when, and how many free reports you have left.

We use these to sign you in, to keep your reports together, to count your free reports, to stop abuse, and to email you about your account, such as confirming your email address or resetting your password. If you press “Tell me when more are available”, we keep that request with your account and may email you about it. We don’t send newsletters or marketing, and we don’t sell your personal information or share it for advertising.

The product link, photo or screenshot you give us. Location and camera details in a photo are removed before it goes anywhere.

We use your IP address to limit how many reports can be run in an hour and in a day. For that, we keep it only in the server’s memory, never in a report or a file. The one place we store an IP address is the record of your agreement to the Terms, above.

Our host, Vercel, and our sign-in provider, Supabase, keep their own basic server logs, such as the time of a request, the page asked for and the IP address it came from.

We use only the cookies that keep you signed in. We use no analytics, ads or tracking cookies. While a report runs, your browser keeps its link and ID in the open tab, so a reload can find the report; it’s gone when the tab closes.

To know how many people use the site, we count visits ourselves, without cookies. For each day we keep only totals: which page was opened, as one of a few names such as “home page” or “a report” (never which report), the name of the site that linked to us, such as google.com (or that none did), and how many page views and visits that made. We keep no IP address, no browser details and nothing that could tell one person from another. Your IP address is used only to limit how many page views one address can send, in the server’s memory as above. To tell a visit from a page view, your browser keeps a small note in the open tab, which is gone when the tab closes. Nothing is counted if your browser sends Do Not Track or Global Privacy Control.

• Supabase handles sign-in and holds your account, your agreement to the Terms and your report history. Reports can be stored there too.
• Google signs you in, if you choose Google, and so learns that you use Product AI.
• Resend sends our account emails, so it receives your email address and the message.

• Vercel hosts the site. While a report runs, your picture sits at a temporary public web address with a random name, so the search services can open it.
• Google looks for pages showing the same picture, through Cloud Vision and Google Lens.
• SerpApi runs the Google Lens and Yandex searches for us, using that temporary address.
• Yandex looks for the same picture.
• Anthropic’s AI reads the picture to work out what the product is, and compares it with supplier listings. A deeper search, below, does the same with the small copy of your photo kept in the report.

If you paste a link instead, we read that page and those services receive the product’s photos from it. How we read pages.

None of them receives your name, your email or anything else from your account.

To look for the product at suppliers, we send search words to CJ and AliExpress. We can also send them to Google (through SerpApi), though that search is usually off. They don’t receive your picture, but the words can come from the AI’s description of it.

If you paste a store’s link, review services (Judge.me, Okendo, Yotpo and Loox) can receive the store’s and the product’s IDs, so we can read the product’s recent reviews. The same goes for a store a deeper search finds. They receive nothing about you.

When a report doesn’t prove a match, a computer we run may search further, if it’s switched on. It sends search words from the report to search sites, social media and supplier sites, such as DuckDuckGo, YouTube, CJ, 1688, AliExpress and Alibaba, and opens the public pages they lead to, including Instagram and TikTok posts and the stores they link to. It also reads the public data of the stores it finds, such as their product lists, best sellers and reviews. How we read pages.

If your picture shows a store’s web address or name, or an Instagram or TikTok account, it can look for that store or open that account directly.

Those sites receive the words and that computer’s IP address, and nothing else about you. They don’t receive your picture. The words can come from the AI’s description of it, from words printed on it and from the titles of pages the report found.

To start the search, the report’s random ID goes through a notification service, ntfy.sh, to that computer, in a message signed so that only our site can start one. Its browser starts each search from an empty profile, and that profile is deleted when the search ends.

Your full-size picture, and any parts cut out of it, are deleted when the report finishes. If a run crashes, a daily clean-up deletes what’s left.

The report is kept for 30 days and then deleted. It holds a small copy of each photo you added (480 pixels), the product details, the results and the AI’s description of the product. What a deeper search finds is saved with it and deleted with it. A report holds nothing from your account.

Search results and AI answers can stay in temporary storage, on our servers and on the computer that runs the deeper search, for up to 30 days, so a repeat search doesn’t cost twice. That computer deletes what has passed its time when its search program starts and once a day after that, and a copy of the report it worked on goes the same way.

Two small records last longer. Our readings of CJ’s order counter stay for up to a year after the latest one, because a sales rate needs readings days apart. They name a CJ product and no customer. Our log of paid searches, which holds their search words and the old temporary addresses of pictures, stays for up to 70 days.

Your account, and the list of reports you ran, stay until you delete the account. The record that you agreed to the Terms is kept after that: your email address, the Terms version, the time, the IP address, your browser details and how you signed in. We keep it so we can show what was agreed if there is ever a dispute, and we don’t use it for anything else.

Google, SerpApi, Yandex, Anthropic, Supabase, Resend and Vercel handle what they receive under their own terms, so we can’t promise that every copy is gone.

Anyone with its link, without signing in, for about 30 days. The link is random, and we ask search engines not to list it. A report doesn’t show who ran it. Our example reports are public.

Product photos on this site, on reports and on the home page, load directly from the sites that host them, so those sites can see the IP address of whoever opens the page.

You can delete your account on your account page, or ask us to. That deletes your sign-in details and your report history. The record that you agreed to the Terms is kept, as set out above. Reports you ran stay readable by their link until their 30 days are up, unless you ask us to remove them sooner.

You can also ask us for a copy of what we hold about you, or to correct it.

Please don’t upload photos of people without their permission, or anything showing customer data or other private details.

What the AI says about a product can be wrong. Check anything you rely on before you act on it.

Product AI is for people 18 or older. We don’t knowingly collect anything from anyone younger. If we learn that an account belongs to someone under 18, we delete it.

Product AI is run from the United States, and is meant for people there. Some of the services above store or handle data in other countries: Yandex, for example, and the supplier sites in China.

We protect what we hold with care, such as keeping keys on the server only and stripping them from every report, but no service can promise perfect security.

If we change this policy, the date above changes with it. If a change matters to how we use your account details, we tell you before it applies.

To have a report removed, or to ask about your data, email us at support@productai.shop and include the report’s link. We’ll remove it within a few days.

If a report or an example shows your store or your photo and you want it taken down, email us at support@productai.shop with the link and what you’d like removed. We’ll reply within a few days.