Privacy Policy

This Privacy Policy ("Policy") describes how Quigglys LLC, a Texas limited liability company ("Company," "we," "us," or "our"), collects, uses, discloses, and protects information when you use the GroceryShop.ai website, browser companion extension, and all related services (collectively, the "Service"). By using the Service, you consent to the practices described in this Policy. If you do not agree, please discontinue use of the Service.

Account information: When you create an account, we collect your name, email address, and authentication credentials (managed by our authentication provider, Clerk). Household and shopping data: We collect shopping lists, meal plans, budget preferences, store selections, dietary preferences, and trip history that you provide to use the Service. Product and pricing data: We collect product catalog data, pricing, availability, and digital offer information from retailer APIs on your behalf during active shopping trips. Usage analytics: We collect anonymized product events (e.g., trip created, basket approved) with hashed household identifiers — no personally identifiable information is stored in analytics tables. Billing information: Payment processing is handled by Stripe, Inc. We do not store credit card numbers, bank account details, or other payment instrument data on our servers. Browser companion data: The extension collects page classification data (e.g., product page, cart page, deals page) on explicitly selected retailer domains during an active paired session. Session pairing grants are short-lived and stored in browser session storage only.

The Service never collects, stores, or transmits: (a) retailer account passwords or login credentials; (b) one-time verification codes or CAPTCHA responses; (c) payment card numbers, bank account numbers, or financial account credentials; (d) Social Security numbers or government-issued identification; (e) precise geolocation data (we use ZIP code or city only); (f) browsing history outside of explicitly selected retailer domains during an active shopping trip; or (g) data from login, multi-factor authentication, checkout, or payment pages, which are hard-coded exclusion zones in the browser companion.

We use collected information to: (a) provide, operate, and improve the Service, including AI-powered shopping recommendations, price comparisons, and savings identification; (b) process subscriptions and billing through Stripe; (c) communicate with you about your account, transactions, and Service updates; (d) monitor and analyze usage patterns to improve performance and user experience; (e) detect, prevent, and address fraud, abuse, and security issues; and (f) comply with legal obligations. We do not sell, rent, or trade your personal information or grocery shopping data to third parties for advertising, marketing, or any other purpose.

The Service uses third-party AI model providers (currently OpenAI) to generate shopping recommendations, product suggestions, and savings analysis. When processing your requests, we send shopping list context and store information to the AI provider. We do not send your name, email, retailer credentials, payment information, or other personally identifiable information to AI providers. Our AI provider agreements require zero data retention of prompts and completions. AI-generated content may contain inaccuracies and should be verified before acting on it.

We use first-party anonymized product event analytics (hashed household identifiers, no PII, no grocery item details) to understand Service usage patterns and improve the product. Public-site analytics (if enabled) are limited to approved public page paths only — workspace, account, billing, shopping, and retailer routes are permanently excluded. No grocery items, prices, savings amounts, household details, or personally identifiable information are ever sent to analytics providers.

We share information only as follows: Service providers: Clerk (authentication), Stripe (payment processing), Neon (database hosting), Vercel (application hosting), and OpenAI (AI inference) — each receives only the minimum data necessary to provide their service. Retailer APIs: We access retailer data through official APIs using your authorized session, limited to product catalog, pricing, and offer information for your selected store. Legal requirements: We may disclose information if required by law, legal process, or government request, or to protect the rights, property, or safety of Quigglys LLC, our users, or the public. We do not share data with data brokers, advertising networks, or social media platforms.

We implement industry-standard security measures including: encryption in transit (TLS/HTTPS) and at rest; secure authentication via Clerk with support for multi-factor authentication; role-based access controls; hashed identifiers in analytics tables; automatic expiration of session pairing grants; server-side rate limiting; and regular security reviews. While we strive to protect your information, no method of electronic transmission or storage is 100% secure. See our Security page for additional details.

We retain your account and shopping data for as long as your account is active or as needed to provide the Service. Session pairing credentials expire automatically (maximum 8 hours). Analytics events are retained for operational analysis and are not linked to your identity. You may request deletion of your account and associated data by contacting support@groceryshop.ai. Upon receiving a verified deletion request, we will delete or anonymize your personal data within 30 days, except where retention is required for legal, fraud-prevention, or financial record-keeping obligations.

Depending on your jurisdiction, you may have the right to: (a) access the personal information we hold about you; (b) correct inaccurate information; (c) request deletion of your information; (d) object to or restrict certain processing; (e) data portability; and (f) withdraw consent where processing is based on consent. To exercise these rights, contact support@groceryshop.ai. Texas residents: Under the Texas Data Privacy and Security Act (TDPSA), you have additional rights regarding your personal data, including the right to know, correct, delete, and opt out of the sale of personal data. We do not sell personal data.

The Service is not directed to children under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact support@groceryshop.ai.

We may update this Policy from time to time. Material changes will be communicated by posting the updated Policy on the Service with a revised "Last updated" date and, where required, by email notification. Your continued use of the Service after the effective date of any modification constitutes acceptance of the modified Policy.

If you have questions or concerns about this Privacy Policy or our data practices, contact us at: Quigglys LLC, support@groceryshop.ai.