Poileasaidh Prìobhaideachd

Cleachdaidh sinn beagan bhriosgaidean agus tha làn-smachd agad air do roghainnean.

In addition to — and independently of — Google Analytics, we run our own first-party measurement pipeline. It uses no third-party advertising identifiers and works in two modes:

• _iai_v — a first-party visitor cookie (random UUID) valid for 13 months. It is set only after you consent to analytics cookies, never before.
• _iai_s — a first-party session cookie (random UUID) with a rolling lifetime of about 30 minutes. Also set only with analytics consent.

Separately from those cookies, our edge servers record consent-independent, cookieless traffic events (page requests, redirects, and similar). To count unique visits without identifying anyone, these events carry a server-side hash derived from your IP address and browser signature combined with a secret and the current date: the hash rotates every 24 hours, cannot be reversed into your IP address, and is never joined across days. We rely on legitimate interest as the legal basis for this measurement — it exists for security and abuse prevention, capacity planning, and aggregate traffic statistics, and it involves no persistent identifier.

When you click an outbound retailer link, we log the click in this same first-party pipeline (product title, link type, position on the page, and — with consent — your visitor id) so we can tell which recommendations help.

If you consent to analytics, we periodically distill your recent activity (such as searches, page visits, retailer-link clicks, and kit or pre-buy interactions) into a compact interest profile: your top categories, brands, and price ranges — capped at 20 entries each, with older activity fading out over a 30-day half-life. The profile is keyed to the random _iai_v identifier, not to your name or email, and is used for one purpose: personalizing your own search conversations and pre-purchase suggestions.

Search queries are processed by the AI providers listed in the "Service Providers" section to interpret them and assemble results, and queries may be retained in our systems: consented analytics events include the search text, and generated pages derived from queries persist as public content.

If a personal detail ends up in a search-generated public page, contact privacy@inceptionai.ca and we will remove it.

When you use voice search, your microphone recording is transmitted to OpenAI for speech-to-text transcription, and the resulting text may be refined by the same AI providers that power search. Recordings are used solely to produce your transcript — we do not keep the audio, and it is not used to identify you. Article narration ("listen to this page") sends the page's text to our text-to-speech providers (ElevenLabs, OpenAI) to generate the audio.

When you attach an image to a search, it is downscaled on your device and transmitted with your request to the AI provider answering it. Images are used only to answer that request: they are not stored in your chat transcript, are not used to identify you, and are not used by us to train models.

Fo UK GDPR agus Riaghailtean PECR, tha na còraichean a leanas agad:

You can access, export, or delete the personal information we hold, whether or not you have an account:

• By email: write to privacy@inceptionai.ca from the address concerned (or describe the data in question) and we will respond within 30 days.
• In the mobile app: Settings → Delete account permanently deletes your account and the data tied to it, including push-notification registrations.
• Anonymous visitors: withdrawing analytics consent deletes your analytics identifiers (cookies) and your interest profile — no request needed.
• Chat history: your search conversations live in your own browser; clear your browser data (or the app's data) to erase them.

We rely on the following providers to run the service. Each receives only what its function requires:

• Vercel — hosting, CDN, and edge infrastructure (processes server logs, including IP addresses, to serve and secure requests)
• Supabase — our primary database (analytics events, interest profiles, product data, content reports, push-device registrations)
• Google Firebase — authentication for optional sign-in
• Algolia — search indexing and querying
• Google Analytics — consent-gated web analytics
• AI providers: Anthropic, Google, and OpenAI — interpret search queries and conversations, transcribe voice input (OpenAI), and generate page content
• ElevenLabs and OpenAI — text-to-speech for article narration
• Google (Gmail / Google Workspace SMTP) — transactional email delivery (for example, contact-form and job-application emails)
• Amazon — product data via the Amazon Product Advertising / Creators APIs; we send product identifiers, never your personal information

We minimize what we store and protect what remains with the following measures:

• All connections use HTTPS/TLS encryption
• Analytics identifiers are random UUIDs; server-side traffic counting uses a salted hash that rotates every 24 hours instead of storing IP addresses
• Databases are protected by row-level security; application data is accessible only to service credentials, never directly to visitors
• Interest profiles are keyed to a random identifier — not to your name or email — and are deleted on consent withdrawal
• Access to production systems is restricted and credential-protected

Tha làn-smachd agad air do roghainnean briosgaidean tro na dòighean a leanas:

1. Brat Aonta Tùsail: Air a' chiad turas agad, bheir brat aonta roghainnean dhut gus briosgaidean a ghabhail ris, a dhiùltadh, no a ghnàthachadh.
2. Atharrachadh Roghainnean: Glan stòradh ionadail do bhrabhsair gus roghainnean ath-shuidheachadh agus am brat aonta a shealltainn a-rithist.
3. Roghainnean Brabhsair: Faodaidh tu briosgaidean a chur dheth gu tur tro roghainnean do bhrabhsair, ged a dh'fhaodadh seo buaidh a thoirt air cuid de ghnìomhachd.

The Inception apps embed the same service described throughout this policy, served from the dedicated origin app.inceptionia.com. A few practices are specific to the apps:

• Sign-in uses the native Google or Apple flows; we receive an authentication token, never your password.
• The camera / photo-library picker prepares images on your device (downscaled and re-encoded) before anything is transmitted — see "Voice and Image Search".
• Your saved items ("saved shelf") are stored locally on your device so they work offline.
• Retailer links open outside the app in your browser; what happens on the retailer's site is governed by their privacy policy.

When you report a page (from the apps or the web), we store the page URL, the reason you selected, any optional text you add, and a daily-rotating hash of your IP address used only to prevent abuse of the report form — we never store the raw IP address. If you consented to analytics, your anonymous visitor id may accompany the report. Reports are used solely for moderation.

Ma chleachdas tu an leudachan Chrome againn, tha na cleachdaidhean prìobhaideachd a bharrachd a leanas a' buntainn. Tha an leudachan ag obair le cead soilleir agus a' toirt làn-smachd dhut air do dhàta.

Our websites and apps are general-audience shopping research tools and are not directed at children under 16. We do not knowingly collect personal information from children under 16; if you believe a child has provided us with personal information, contact privacy@inceptionai.ca and we will delete it.

Dh'fhaodadh gun ùraich sinn am poileasaidh prìobhaideachd seo bho àm gu àm gus atharrachaidhean nar cleachdaidhean no riatanasan laghail a nochdadh. Nuair a thig ùrachaidhean, àrdaichidh sinn tionndadh aonta briosgaidean, a' toirt cuireadh dhut na cumhachan ùraichte a leughadh agus a ghabhail ris.

Airson ceistean mun phoileasaidh prìobhaideachd seo no ar cleachdaidhean dàta, cuir fios thugainn: