Privacy Policy

1. Scope and controller

Palm Tree AI LLC, a Florida limited liability company (“Palm Tree AI,” “we,” “us,” or “our”), operates The Surf Shop, an AI-assisted surf-shopping service at thesurfshop.ai. Palm Tree AI is the controller of personal information covered by this policy. This policy explains what we collect, why we use it, how we disclose it, and the choices available to you.

This policy covers the Service and our related emails and support. A brand’s site, Shopify Checkout, Stripe Checkout, Google sign-in, and other linked services have their own privacy policies.

2. Information we collect

• Account and contact data: email address, user ID, authentication method, and basic profile details supplied by Google if you choose Google sign-in.
• Conversation data: messages and instructions you send, the recent conversation context needed to respond, AI responses, and feedback.
• Shopping data: searches, budget, sizes, style and brand preferences, inferred preference facts, selected products and variants, stash or cart contents, merchant checkout status, and referral attribution.
• Subscription data: selected plan, subscription and trial status, renewal and cancellation dates, Stripe customer and subscription identifiers, payment status, and the version and time of your legal acceptance. Stripe collects payment-card details directly.
• Device and usage data: IP address, browser and device information, approximate location inferred from IP, pages and features used, timestamps, diagnostic logs, selected product events, cookie identifiers, and rate-limit information.
• Communications: waitlist submissions, support requests, email delivery and engagement information, and opt-out choices.

We collect this information from you, automatically from your browser, from service providers, and from merchants or commerce platforms when they return catalog, cart, or checkout information. Please do not put sensitive personal information into shopping chat.

3. How we use information

We use information to:

• provide, personalize, and remember your shopping experience;
• generate AI responses and product recommendations;
• retrieve current catalog facts, create carts or checkout sessions, and hand you off to merchants;
• create and manage accounts, Pro trials, subscriptions, billing, cancellation, and support;
• send transactional messages and marketing only where allowed, with an unsubscribe option;
• measure selected feature usage, debug, secure, prevent abuse, enforce terms, and improve the Service; and
• comply with law, protect rights and safety, and establish or defend legal claims.

Where law requires a legal basis, we rely on performing our contract with you, our legitimate interests in operating and securing the Service, consent where requested, and legal obligations. You may withdraw consent at any time, without affecting processing already performed.

4. AI processing and memory

The Service sends your message, necessary recent conversation context, product facts, and system instructions to commercial AI APIs to generate a response. OpenAI is the primary provider for recommendation turns; Anthropic supports selected conversational, parsing, and summarization tasks. Those providers may retain API inputs and outputs for limited abuse-monitoring periods under their commercial terms. They do not use our API inputs to train their general models by default.

Full chat history is stored in your browser so the conversation persists on that device. When account memory is enabled, we store limited structured preference facts—such as a preferred size, budget, or style—rather than a server-side copy of the entire transcript. Those facts are used to personalize later recommendations. You can clear local browser data or ask us to delete account data.

We may process merchant catalog content through commercial AI services at inference time to organize it, create descriptive shopping metadata, and provide recommendations. We do not use Shopify or merchant data to train or fine-tune a general-purpose AI model, and we require providers handling that content not to train on our API inputs.

5. Shopify, merchants, UCP, and checkout data

We retrieve catalog information through merchant storefronts and commerce interfaces, including Shopify UCP services. This can include product titles, images, descriptions, variants, prices, availability, merchant identity, and checkout links. Merchant-provided live facts control when they conflict with older or inferred information.

When you ask us to create or prefill a merchant checkout, we may send the merchant and Shopify the selected items, quantities, localization context, a checkout identifier, attribution data, your IP address where required for authenticated UCP calls, and—if available and useful to prefill checkout— your email address. We do not send your Surf Shop chat transcript, preference profile, or unrelated stash items. The merchant remains the merchant of record and collects shipping, payment, and other purchase information under its own privacy policy.

We use merchant data only to operate, secure, and improve the shopping Service—not for competitive benchmarking or to build a general-purpose AI model. We do not sell merchant or buyer data.

6. How we disclose information

We disclose information only as reasonably necessary:

• Service providers: to operate AI, hosting, authentication, databases, analytics, rate limiting, email, and payments under contracts and instructions.
• Merchants and commerce platforms: when you request product data, a cart, checkout, or merchant-site handoff.
• Legal and safety: when reasonably necessary to comply with law, valid process, prevent fraud or abuse, protect rights or safety, or enforce our terms.
• Business transfers: in diligence or a merger, financing, acquisition, reorganization, or sale, subject to appropriate confidentiality and notice required by law.
• At your direction: when you ask us to share information or otherwise consent.

We do not sell personal information. We also do not share personal information for cross-context behavioral advertising or use sensitive data to infer characteristics about you.

7. Key providers and recipients

The providers below may process limited data for the stated purpose. This list is intended to make our actual stack visible; a provider’s linked policy also applies to its own processing.

• OpenAI

  Primary AI inference for shopping conversations and recommendations. API inputs are not used to train OpenAI models by default.

• Anthropic

  AI inference for selected chat, summarization, and query-processing tasks. Commercial API inputs and outputs are generally retained for up to 30 days unless a different arrangement or legal/safety exception applies.

• Supabase

  Account authentication, database, and secure storage for account-linked preferences, stash, and subscription records.

• Stripe

  Pro checkout, payment processing, subscription management, and records of subscription consent. We do not receive full card numbers.

• Shopify and participating merchants

  Live catalog, cart, and merchant checkout services, including UCP. They receive checkout information as described below and act under their own privacy policies.

• PostHog

  Limited product analytics. Autocapture and session replay are disabled; we send selected events rather than chat text, keystrokes, or screen recordings.

• Vercel

  Application hosting, network delivery, and operational logs.

• Resend

  Transactional and requested email delivery, such as confirmation, waitlist, welcome, and billing-related messages.

• Google

  Optional Google sign-in. We receive basic account information needed to authenticate you.

• Upstash

  Rate limiting, abuse prevention, and service-usage budget controls using limited network and request metadata.

8. Cookies, local storage, and analytics

We use cookies and similar browser storage for authentication, security, preferences, chat history, stash and cart state, legal-flow continuity, and limited analytics. PostHog autocapture and session replay are disabled. We do not intentionally send chat text, keystrokes, payment details, or screen recordings to PostHog.

You can clear browser data in browser settings, but doing so may sign you out and erase local chat, cart, stash, and preference state. Browser privacy signals such as Global Privacy Control are honored where legally required. Because we do not sell or share data for behavioral advertising, there is no sale or targeted-ad sharing to opt out of through such a signal.

9. Retention

We keep information only as long as reasonably necessary for the purposes above. Browser-stored data remains until you clear it, sign out where the Service clears it, or browser controls remove it. Account, preference, stash, and subscription records generally remain while your account is active; we then delete or de-identify them after a valid deletion request, subject to security, backup, fraud, payment, tax, dispute, and legal-retention needs.

AI providers may retain API inputs and outputs under their commercial retention rules; standard API abuse-monitoring retention is generally up to 30 days for OpenAI and Anthropic, with exceptions for safety, legal obligations, or separately configured controls. Stripe and merchants keep transaction records under their own policies and legal duties. Aggregated or de-identified information may be kept where it cannot reasonably identify you.

10. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to a small online service, including encrypted transport, managed authentication, access controls, scoped service credentials, checkout through payment and merchant providers, rate limiting, and avoiding sensitive data in analytics. No system is perfectly secure; please use a unique password and contact us if you suspect unauthorized access.

11. Your choices and privacy rights

Depending on where you live, you may have rights to know or access personal information, obtain a portable copy, correct it, delete it, restrict or object to processing, withdraw consent, opt out of certain sales/sharing or profiling, and appeal a denied request. We do not discriminate for exercising privacy rights. An authorized agent may submit a request where local law allows.

To exercise a right, delete an account, or appeal, email hello@thesurfshop.ai. We may verify your identity and authority before acting. You can cancel Pro in the billing portal, unsubscribe from marketing through the email link, and clear local data through your browser.

12. International processing

Palm Tree AI is based in the United States, and providers may process information in the United States and other countries. Where required, we use recognized transfer mechanisms and safeguards. Your local law may give you additional rights despite a transfer.

13. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal information. Where a higher digital-consent age applies, a young person must have any required parent or guardian permission. If you believe a child provided information contrary to this section, contact us so we can investigate and delete it.

14. Changes to this policy

We may update this policy as the Service and law change. We will post the new effective date and give additional notice where a change is material or law requires it. If we need consent for a new use, we will request it before that use.

15. Contact