Mervia Shopping AI Privacy Policy

Effective Date: March 27, 2026

This Privacy Policy explains how Mervia Shopping AI ("Mervia," "we," "us," or "our") collects, uses, and protects your information when you use our ChatGPT-powered shopping assistant (the "Service"). We are committed to protecting your privacy and handling your data with transparency.

Our Service is not directed to individuals under the age of thirteen (13). We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at support@mervia.ai.

1. Information We Collect

We collect information to provide and improve the Service. The types of information we collect include:

a) Chat Messages and Conversation Data

We collect the content of your chat messages when you interact with our AI shopping assistant through the ChatGPT app. This includes your queries, product preferences, and shopping intent. Conversations are stored as chat threads to maintain context within a session and across follow-up interactions.

b) Session and Interaction Data

We collect information about how you interact with the Service, including:

  • Server-generated session identifiers used to maintain conversation continuity across tool calls
  • Messages sent and received within a conversation
  • Product link clicks and product image views
  • Products viewed, recommended, and explored in detail during your session

Note: Because the Service operates within the ChatGPT platform, your interactions are routed through ChatGPT's infrastructure. We do not directly collect your IP address, browser type, or other device-level technical information. Any such data that ChatGPT may collect is governed by OpenAI's privacy policy.

c) Click Tracking and Purchase Attribution

When you click on a product link within the Service, we redirect your click through our event tracking service (event.mervia.ai) before forwarding you to the retailer's website. This redirect generates a unique, anonymous click token that records:

  • Which product was clicked
  • The originating conversation session (anonymous session identifier only)
  • The timestamp of the click

This data is used to measure the effectiveness of our recommendations and to attribute purchases to the conversations that led to them. Click tokens are anonymous and are not linked to your personal identity or ChatGPT account. You are always redirected to the retailer's actual product page, and the redirect happens transparently within the normal link-click experience.

d) Shopping Preference Profile (In-Session Only)

During a conversation, our AI assistant may build a temporary shopping preference profile to improve recommendations within that session. This profile may include:

  • Budget preferences (e.g., budget-friendly, mid-range, premium)
  • Shopping scenario (e.g., furnishing a new home, replacing an item, gift shopping)
  • Style and space preferences (e.g., modern, outdoor, compact)

This profile is stored in server memory only for the duration of the active session (up to 30 minutes of inactivity) and is automatically deleted when the session expires. It is not persisted to any database and cannot be retrieved after the session ends.

e) Shopping Journey Data (Planned)

We plan to collect anonymous, session-level data that tracks your journey from the ChatGPT app to the stores whose products you browse, including actions you take on those sites (such as add-to-cart, checkout initiation, and purchase completion) and purchase information (such as order confirmation and transaction amounts). This data helps us improve the relevance of our recommendations and the overall shopping experience. It will be associated with anonymous session identifiers only and will not be linked to your personal identity. This feature has not yet been implemented but will be introduced in a future update.

f) Anonymous Session Data for Service Improvement

We collect and retain anonymized session data — including conversation patterns, query types, product interaction sequences, and shopping outcomes — to improve the quality of our recommendations and the overall shopping experience. All session data used for this purpose is stripped of personally identifiable information before analysis. Individual users cannot be identified from this data.

2. How We Use Your Information

We use the information we collect for the following purposes:

a) To Provide and Maintain the Service

To operate, maintain, and deliver the AI shopping assistant, including product search, recommendations, and conversational shopping experiences.

b) To Process and Respond to Your Queries

Your chat messages and conversation context are processed by third-party AI providers (see Section 3) to generate relevant, accurate shopping responses and recommendations. When you request detailed product information, we may use AI to generate personalized insights explaining why a product fits your stated needs based on the current conversation context.

c) To Improve the Service

To understand and analyze how the Service is used, identify issues, and develop new features. We use aggregated interaction data (click patterns, session duration) and anonymized session data (see Section 1f) to improve our recommendation quality, product knowledge, and conversational experience.

d) To Measure Recommendation Effectiveness

We use click tracking data (see Section 1c) to understand which product recommendations are most helpful to users, and to measure conversion rates from recommendation to retailer visit. This helps us improve the relevance and quality of future recommendations.

e) To Generate Aggregate Performance Reports

We use anonymous, aggregated data to understand how shoppers interact with the Service and the products featured in it. These aggregate reports may be shared with the stores and brands whose products appear in the Service to help them better serve customers. These reports do not contain your chat transcripts, personal identity, or any information that could be used to identify you individually.

f) Security and Compliance

To protect the security and integrity of our Service and comply with legal obligations.

g) Legal Basis for Processing

We process your personal information based on the following legal grounds: (i) the necessity to perform our contract with you — specifically, to provide the shopping assistant Service you have chosen to use; (ii) our legitimate business interests in operating, improving, and securing the Service, provided these interests are not overridden by your privacy rights; and (iii) your consent, where applicable, such as when you voluntarily submit queries and interact with the Service.

3. Third-Party Data Processing

a) OpenAI

We use OpenAI's API to power our AI shopping assistant. When you interact with the assistant, the following data is sent to OpenAI for processing:

  • Your chat messages and conversation history (recent messages for context)
  • Product information relevant to your query (names, descriptions, prices, specifications, images)
  • AI-generated responses

OpenAI processes this data according to its own API data usage policies. We use OpenAI's API tier, which means your data is not used by OpenAI to train its models.

b) Google Cloud Platform

Our Service is hosted on Google Cloud Platform (Cloud Run, Cloud SQL). All data is stored and processed within Google Cloud's infrastructure, subject to Google Cloud's security certifications and data processing terms.

c) International Data Transfers

Your information is stored and processed on servers located in the United States. If you are accessing the Service from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States. We ensure appropriate safeguards are in place for international data transfers in accordance with applicable data protection laws.

4. Data Sharing and Disclosure

a) No Selling of Personal Data

We will not sell your personal information to any third party.

b) Aggregate Data Shared with Stores and Brands

We may share summarized, anonymous data with the stores and brands whose products are featured in the Service. This may include aggregated trends such as the types of products shoppers ask about, popular categories, and — when shopping journey tracking is implemented (see Section 1e) — anonymous conversion data. This data does not include your chat transcripts, personal identity, or any information that could identify you individually.

c) Service Providers

We share data with third-party service providers that perform services on our behalf (hosting, AI processing, data analysis). These providers are contractually obligated to protect your information and use it only for the services they provide to us. Key service providers are identified in Section 3.

d) Legal Requirements

We may disclose your information if required by law, or in the good faith belief that such action is necessary to comply with a legal obligation, protect and defend the rights or property of Mervia, or protect the personal safety of users of the Service or the public.

5. Data Retention

  • Chat messages and conversation threads are retained to support ongoing conversations and service improvement. You may request deletion of your chat history by contacting us at support@mervia.ai.
  • In-session shopping preference profiles are stored in server memory only and are automatically deleted after 30 minutes of inactivity or when the session ends.
  • Click tracking tokens are retained for analytics and attribution purposes.
  • Anonymized session data used for service improvement is retained indefinitely and cannot be deleted on a per-user basis, as it is not linked to individual identities.
  • Interaction events (clicks, session data) are retained for analytics purposes.

You may request deletion of your personal data at any time by contacting us at support@mervia.ai. We will process your request within thirty (30) days, subject to any legal obligations that require us to retain certain information. Note that anonymized data that has already been processed for service improvement purposes cannot be individually deleted, as it is no longer associated with any individual.

6. Data Security

We implement security measures designed to protect your information, including:

  • Encrypted data transmission (HTTPS/TLS) for all API communications
  • Database access restricted by role-based permissions
  • Rate limiting on API endpoints to prevent abuse
  • Infrastructure hosted on Google Cloud Platform with industry-standard security controls

However, no security system is impenetrable, and we cannot guarantee the absolute security of your information.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

  • The right to access the personal information we hold about you.
  • The right to request correction of inaccurate personal information.
  • The right to request deletion of your personal information (subject to certain exceptions, including anonymized data).
  • The right to object to the processing of your personal information.
  • The right to data portability.
  • The right to opt out of shopping journey tracking (when implemented).

To exercise any of these rights, please contact us at support@mervia.ai.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date" at the top. For material changes, we will provide prominent notice through the Service. We encourage you to review this Privacy Policy periodically for any changes.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us:

By email: support@mervia.ai

By mail:
Mervia AI, Inc.
251 Little Falls Drive
Wilmington, DE 19808