Privacy Policy

1. Introduction

Welcome to SimplyShop AI, operated by ERP Systems, LLC ("we," "our," or "us"). SimplyShop AI is a shopping-research service that finds offers, prices, and promo codes for the items on your shopping lists. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and mobile application (collectively, the "Service"). By using the Service, you agree to the practices described in this policy.

2. Information We Collect

2.1 Account information. When you create an account, we collect:

• Email address
• Password (stored as a secure hash, never in plain text)
• Display name (optional)

2.2 Third-party sign-in. If you sign in with Google or Apple, we receive your name and email address from the provider and a unique provider identifier to link your account. We never receive or store your password from these providers.

2.3 Shopping lists and preferences. The item names, preferences (brand, price caps, quality, quantity, specs), and any barcode/photo-identified product details you add to your lists.

2.4 Location. A city and ZIP code you optionally enter to bias research toward region-correct prices and local pickup options. We do not collect GPS location on the web; the mobile app only uses location you provide.

2.5 Payment information. When you buy credit packs, payment is processed by Apple (iOS), Google Play (Android), or Stripe (web). We receive transaction identifiers and purchase status — never your card details. We store credit grants and purchase records for wallet accounting.

2.6 Support requests. If you contact support, we store your name, email, optional phone, subject, category, message, the request's IP address, and an automated fraud-prevention score.

2.7 Device and session information. Device type and browser, IP address (session security and fraud prevention), and — on mobile, with your permission — a push notification token. On our website, our advertising and analytics providers set their own cookie identifiers to measure ad performance (see section 7). We do not collect the advertising identifier built into your phone (Apple IDFA / Google Advertising ID).

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Run AI research on the items you submit: item names and preferences (with your optional region) are sent to third-party AI research and verification providers to find and verify offers — never your name, email, or account identity
• Process credit purchases and maintain your wallet balance
• Send transactional notifications (research complete, purchase confirmations)
• Respond to support requests
• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations

We do not sell, trade, or rent your personal information to third parties for their marketing purposes.

4. Third-Party Services

We share data with the following services that help us operate the platform:

• Google Sign-In / Apple Sign-In: Authentication. Receive your login request.
• Stripe: Payment processing (web). Receives your email and payment details. stripe.com/privacy
• Apple App Store / Google Play: Payment processing on mobile. Manage your purchases under their own policies.
• AI research and verification providers: Receive the item names, preferences, and optional region for the items you submit for research — no account identity is attached.
• Google Analytics and Google Ads: Measure how our marketing works — which pages you visit, and whether a visit that started from one of our ads led to creating an account or buying a credit pack. Receives a randomly generated identifier and standard web request data, never your name, email, or the contents of your shopping lists. policies.google.com/privacy
• Meta (Facebook) Pixel: Measures the results of our advertising on Facebook and Instagram in the same way. When you create an account we send Meta a one-way scrambled (hashed) form of your email so it can match the signup to an ad — Meta cannot read your email address from it, and we never send your shopping lists. facebook.com/privacy/policy
• Google reCAPTCHA Enterprise: Fraud prevention on the contact form. Receives interaction data to distinguish humans from bots.
• Expo Push Notifications: Delivers mobile push notifications. Receives your device push token and notification content.
• Email delivery: Transactional email (verification codes, receipts, support replies) is sent through a third-party email delivery provider.
• Infrastructure: Cloud infrastructure. All data is stored on servers in the United States.

5. Data Retention

• Account data: retained while your account is active. After a deletion request, removed after a 30-day grace period during which you can cancel the deletion.
• Shopping lists and research results: retained while your account is active so you can revisit them.
• Payment and credit records: retained as required by law for tax and audit purposes.
• Support requests: retained while we work on them and for a reasonable period afterward.
• Session data (IP, device info): deleted when you log out or the session expires.

6. Data Security

We implement the following measures to protect your information:

• All data transmitted over HTTPS with TLS 1.2 or higher
• Passwords stored using industry-standard hashing
• Authentication tokens stored securely (device keychain on mobile)
• Rate limiting and CORS protection on all API endpoints

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Cookies and Tracking

On our website, we use local storage to maintain your login session and remember preferences such as theme. Google reCAPTCHA may set cookies for fraud prevention on the contact form.

We also use advertising and analytics cookies from Google Analytics, Google Ads, and the Meta (Facebook) Pixel to measure our marketing — specifically, to tell whether a visit that began with one of our ads ended in a signup or a purchase. These providers may recognize your browser on other sites they operate or serve ads on. We do not use them to build a profile of your shopping interests, we never send them the contents of your lists or your researched items, and we do not sell or share your personal information for anyone else's advertising.

We honor Global Privacy Control. If your browser or an extension sends the GPC signal, we do not load the Google or Meta advertising tags at all on your visit — they are never contacted, not merely told to hold back. You can turn GPC on in browsers that support it natively (such as Firefox and Brave) or by installing an extension that sends it.

You can also opt out at any time using your browser's tracking protection, an ad blocker, or Google's Analytics opt-out add-on, or by emailing us at support@simplyshop.ai. Blocking them has no effect on your account, your credits, or the research we do for you.

8. Your Rights and Choices

Account deletion: You can request deletion of your account and associated data from your account settings or by contacting support@simplyshop.ai. A 30-day grace period applies, after which your account and data are permanently deleted.

Data access: You can view and update your information in your account settings.

Push notifications: You can disable them at any time in your device settings.

Data portability: To request a copy of your data, contact us at support@simplyshop.ai.

9. Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the rights described below. We extend the same choices to everyone, regardless of where you live.

Categories of personal information we have collected in the past 12 months:

• Identifiers — email address, display name, account and device identifiers, IP address.
• Commercial information — the items on your shopping lists, credit purchases and your credit balance.
• Internet or network activity — pages viewed on our site, and whether a visit began with one of our ads.
• Coarse geolocation — only the city and ZIP code you choose to enter. We do not collect precise GPS location on the web.

We collect these for the purposes in section 3, from you directly and from the analytics providers in section 4. We do not collect sensitive personal information as California defines it, we do not knowingly collect information from anyone under 16, and we have not sold personal information in the past 12 months.

Do Not Sell or Share My Personal Information. We do not sell your personal information for money, ever. However, California defines "sharing" broadly enough that our use of the Google and Meta advertising cookies described in sections 4 and 7 — which is how we measure whether an ad worked — may count as sharing for cross-context behavioral advertising. You can opt out in either of these ways, and both are honored:

• Turn on Global Privacy Control in your browser or via an extension. When we see that signal we do not load the advertising tags at all — the request is never made.
• Email support@simplyshop.ai with "Do Not Sell or Share" in the subject line and we will apply the opt-out to your account.

Your other rights:

• Know and access — what we have collected about you, and a copy of it.
• Delete — your account and associated data (see section 8).
• Correct — inaccurate personal information, from your account settings or by asking us.
• No discrimination — exercising any of these rights never changes your price, your credits, or the quality of research you receive.

To exercise any of these rights, email support@simplyshop.ai. We will verify your request against the email address on your account and respond within 45 days. You may use an authorized agent; we will ask for written proof of their authority.

10. Children's Privacy

SimplyShop AI is not directed at children under 13, and we do not knowingly collect personal information from children under 13. Users must be at least 18 years old to create an account. If you believe a child has provided us personal information, contact us at support@simplyshop.ai and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post material changes on this page and update the "Last updated" date. Continued use of the Service after changes are posted constitutes acceptance.

12. Contact Us

If you have questions about this Privacy Policy, your data, or how to exercise your rights, contact us at support@simplyshop.ai.