Privacy policy

DRAFT — covers Australia (Privacy Act 1988 / APPs), the UK & EU (UK GDPR / GDPR basics) and the US. Not legal advice; have it checked before going live. Replace every [TODO].

Short version: no accounts, no tracking cookies, no selling your data. What you type is sent to an AI service to generate suggestions. Your region choice is saved only in your own browser.

Who we are

[TODO: owner / business name, ABN, contact email]. We're the "data controller" for the purposes of the UK GDPR and EU GDPR.

What we collect and why

• What you type into the search box — sent to our server and to Cloudflare Workers AI, which runs an open AI model (Google's Gemma) on Cloudflare's own servers, to generate suggestions. Please don't type personal details (names, addresses, health information). We don't store searches in a database. Repeat questions may be cached briefly (up to 24 hours) without any link to you, to save cost.
• Technical data — like any website, our host (Cloudflare) processes your IP address and browser details to deliver the site and stop abuse. We use your IP address briefly in memory to limit how many searches one visitor can do per day. We don't store it with your searches.
• Your region setting — stored in your browser's local storage on your device (not a cookie, never sent to us except as part of a search). Clear it any time from your browser settings.

Legal basis (UK/EU): legitimate interests — running a free, secure product-suggestion service — and, for search text, performing the service you asked for.

Cookies

This site sets no cookies and uses no analytics or advertising trackers. [TODO: update if analytics or ads are added — UK/EU visitors may then need a consent banner.]

When you click through to eBay or Amazon, those sites set their own cookies (including affiliate cookies so they can credit us for referrals). Their privacy policies apply there.

Who we share data with

• Cloudflare, Inc. — website hosting and security.
• Cloudflare, Inc. (Workers AI) — generates suggestions from your search text. Cloudflare lists the model we use as "zero data retention" and doesn't use it to train models. [TODO: update if the AI provider changes.]

These providers may process data outside your country (for example in the US). Where UK/EU law requires it, they rely on recognised transfer safeguards such as Standard Contractual Clauses. We never sell your personal information.

How long we keep it

Search text: not stored by us beyond short-lived caching (up to 24 hours). Rate-limit data: in memory, cleared at least daily. Provider logs: per the provider's own retention policy.

Your rights

Depending on where you live, you can ask to access, correct or delete personal information we hold about you, object to processing, or complain to a regulator — the OAIC (Australia), ICO (UK), your local EU data protection authority, the Office of the Privacy Commissioner (NZ / Canada). In practice we hold almost nothing that identifies you, but email us at [TODO: contact email] and we'll help.

Children

This site isn't aimed at children under 13, and we don't knowingly collect their information.

US visitors

We don't sell or "share" personal information for cross-context behavioural advertising as those terms are used in US state privacy laws.

Changes

If this policy changes we'll update the date below.

Last updated: [TODO: date]