Privacy Policy

We use minimal cookies and you have full control over your preferences.

In addition to — and independently of — Google Analytics, we run our own first-party measurement pipeline. It uses no third-party advertising identifiers and works in two modes:

• _iai_v — a first-party visitor cookie (random UUID) valid for 13 months. It is set only after you consent to analytics cookies, never before.
• _iai_s — a first-party session cookie (random UUID) with a rolling lifetime of about 30 minutes. Also set only with analytics consent.

Separately from those cookies, our edge servers record consent-independent, cookieless traffic events (page requests, redirects, and similar). To count unique visits without identifying anyone, these events carry a server-side hash derived from your IP address and browser signature combined with a secret and the current date: the hash rotates every 24 hours, cannot be reversed into your IP address, and is never joined across days. We rely on legitimate interest as the legal basis for this measurement — it exists for security and abuse prevention, capacity planning, and aggregate traffic statistics, and it involves no persistent identifier.

When you click an outbound retailer link, we log the click in this same first-party pipeline (product title, link type, position on the page, and — with consent — your visitor id) so we can tell which recommendations help.

If you consent to analytics, we periodically distill your recent activity (such as searches, page visits, retailer-link clicks, and kit or pre-buy interactions) into a compact interest profile: your top categories, brands, and price ranges — capped at 20 entries each, with older activity fading out over a 30-day half-life. The profile is keyed to the random _iai_v identifier, not to your name or email, and is used for one purpose: personalizing your own search conversations and pre-purchase suggestions.

Search queries are processed by the AI providers listed in the "Service Providers" section to interpret them and assemble results, and queries may be retained in our systems: consented analytics events include the search text, and generated pages derived from queries persist as public content.

If a personal detail ends up in a search-generated public page, contact privacy@inceptionai.ca and we will remove it.

When you use voice search, your microphone recording is transmitted to OpenAI for speech-to-text transcription, and the resulting text may be refined by the same AI providers that power search. Recordings are used solely to produce your transcript — we do not keep the audio, and it is not used to identify you. Article narration ("listen to this page") sends the page's text to our text-to-speech providers (ElevenLabs, OpenAI) to generate the audio.

When you attach an image to a search, it is downscaled on your device and transmitted with your request to the AI provider answering it. Images are used only to answer that request: they are not stored in your chat transcript, are not used to identify you, and are not used by us to train models.

Under the UK GDPR and Privacy and Electronic Communications Regulations (PECR), you are entitled to the following rights:

You can access, export, or delete the personal information we hold, whether or not you have an account:

• By email: write to privacy@inceptionai.ca from the address concerned (or describe the data in question) and we will respond within 30 days.
• In the mobile app: Settings → Delete account permanently deletes your account and the data tied to it, including push-notification registrations.
• Anonymous visitors: withdrawing analytics consent deletes your analytics identifiers (cookies) and your interest profile — no request needed.
• Chat history: your search conversations live in your own browser; clear your browser data (or the app's data) to erase them.

We rely on the following providers to run the service. Each receives only what its function requires:

• Vercel — hosting, CDN, and edge infrastructure (processes server logs, including IP addresses, to serve and secure requests)
• Supabase — our primary database (analytics events, interest profiles, product data, content reports, push-device registrations)
• Google Firebase — authentication for optional sign-in
• Algolia — search indexing and querying
• Google Analytics — consent-gated web analytics
• AI providers: Anthropic, Google, and OpenAI — interpret search queries and conversations, transcribe voice input (OpenAI), and generate page content
• ElevenLabs and OpenAI — text-to-speech for article narration
• Google (Gmail / Google Workspace SMTP) — transactional email delivery (for example, contact-form and job-application emails)
• Amazon — product data via the Amazon Product Advertising / Creators APIs; we send product identifiers, never your personal information

We minimize what we store and protect what remains with the following measures:

• All connections use HTTPS/TLS encryption
• Analytics identifiers are random UUIDs; server-side traffic counting uses a salted hash that rotates every 24 hours instead of storing IP addresses
• Databases are protected by row-level security; application data is accessible only to service credentials, never directly to visitors
• Interest profiles are keyed to a random identifier — not to your name or email — and are deleted on consent withdrawal
• Access to production systems is restricted and credential-protected

You maintain full control over your cookie preferences through the following methods:

1. Initial Consent Banner: Upon your first visit, a consent banner provides options to accept, decline, or customize cookie preferences.
2. Modifying Preferences: Clear your browser's local storage to reset preferences and display the consent banner again.
3. Browser Settings: You may disable cookies entirely through your browser settings, though this may affect some functionality.

The Inception apps embed the same service described throughout this policy, served from the dedicated origin app.inceptionia.com. A few practices are specific to the apps:

• Sign-in uses the native Google or Apple flows; we receive an authentication token, never your password.
• The camera / photo-library picker prepares images on your device (downscaled and re-encoded) before anything is transmitted — see "Voice and Image Search".
• Your saved items ("saved shelf") are stored locally on your device so they work offline.
• Retailer links open outside the app in your browser; what happens on the retailer's site is governed by their privacy policy.

When you report a page (from the apps or the web), we store the page URL, the reason you selected, any optional text you add, and a daily-rotating hash of your IP address used only to prevent abuse of the report form — we never store the raw IP address. If you consented to analytics, your anonymous visitor id may accompany the report. Reports are used solely for moderation.

If you use our Chrome extension, the following additional privacy practices apply. The extension operates with explicit consent and provides you with full control over your data.

Our websites and apps are general-audience shopping research tools and are not directed at children under 16. We do not knowingly collect personal information from children under 16; if you believe a child has provided us with personal information, contact privacy@inceptionai.ca and we will delete it.

We may update this privacy policy periodically to reflect changes in our practices or legal requirements. When updates occur, we will increment the cookie consent version, prompting you to review and accept the revised terms. The "Last Updated" date at the top of this policy will reflect any changes.

For questions regarding this privacy policy or our data practices, please contact us: