Privacy Policy
Last updated: 28 October 2026
Draft v0.1 — published under early access; will be reviewed before paid plans or account features launch.
This policy explains what personal data ShopAIReady processes when you visit shopaiready.com or use the ShopAIReady MCP server at mcp.shopaiready.com from an AI assistant such as Claude, and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Who is responsible (controller)
José Covas Education Academy, Lda, Portugal
Avenida Engenheiro Duarte Pacheco, Torre 1, Piso 2, Esc. 10, 1070-101 Lisboa, Portugal
NIPC: 519093500
Email: [email protected] · Support: [email protected]
2. Short version
- No sign-up, no cookies, no analytics or advertising trackers.
- The tools only read public web pages and product feeds whose URL you (through your AI assistant) give us. We never write to your store, Google Merchant Center or OpenAI account.
- Fetched content is processed in memory to produce the result and is not stored.
- We keep minimal technical request logs for up to 30 days. We do not sell data and do not use it to train AI models.
3. What we process and why
| Context | Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Website | Technical connection data (IP address, browser user-agent, requested page) processed by our hosting provider to deliver pages and protect against abuse. We set no cookies and run no analytics. | Deliver and secure the site | Legitimate interest (6(1)(f)) |
| MCP tool calls | The inputs your AI assistant sends when it uses a tool: store, product page or feed URLs, the list of issues passed to draft_supplemental_feed, and an optional seller name. The public content we fetch from those URLs. | Produce the requested audit, validation or CSV | Performance of the service you request (6(1)(b)) / legitimate interest (6(1)(f)) |
| Request logs | Timestamp, tool name, MCP method, response status, duration and the name of the MCP client (e.g. "claude-ai"). We do not log your IP address, the URLs you check or the results. | Reliability, debugging, usage statistics per tool | Legitimate interest (6(1)(f)) |
| Rate limiting | Your IP address, used only transiently as a counter key in memory to limit requests per minute. | Prevent abuse and keep the free service available | Legitimate interest (6(1)(f)) |
| Support | Your email address and the content of your message to [email protected] (forwarded to our company mailbox). | Answer your request | Pre-contractual / contractual (6(1)(b)), legitimate interest (6(1)(f)) |
As with the website, Cloudflare processes connection data (including your IP address) to deliver and secure the MCP server.
Public pages and feeds you ask us to check may themselves contain personal data (for example a sole trader's name). We process such content only transiently to produce the result and do not store it.
Not active yet: user accounts, Google Merchant Center connection (OAuth, read-only scope; tokens would be stored encrypted and deleted when you disconnect) and paid plans (payments via Paddle as merchant of record). We will update this policy before any of these features is enabled.
4. What we never do
We do not sell or rent personal data, do not use it for advertising or profiling, and do not use your inputs, fetched content or results to train AI models.
5. Retention
- Fetched page/feed content and tool results: not stored (in memory only for the duration of the request).
- Request logs: up to 30 days, then deleted.
- Rate-limit counters: about one minute.
- Support emails: as long as needed to handle your request and for up to 24 months afterwards, unless a longer period is required by law.
6. Recipients and processors
- Cloudflare, Inc. — hosting of the website and MCP server (Workers/Pages), DNS, network security and email routing. Cloudflare acts as our processor.
- Paddle — merchant of record for payments, only once paid plans launch (not active today).
- Your AI assistant provider (e.g. Anthropic for Claude) is not our processor: it sends tool inputs to us and receives the results at your request, and processes your conversation under its own terms and privacy policy.
We may disclose data where required by law or to protect our rights.
7. International transfers
Cloudflare operates a global network and may process data outside the European Economic Area. Such transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
8. Your rights
You have the right to access, rectify, erase, restrict and object to the processing of your personal data, and to data portability, within the limits of the GDPR. Write to [email protected]. Because we do not keep accounts or log IP addresses, we may not be able to link log entries to you. You may also lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or the authority of your country of residence.
9. Children
ShopAIReady is a business tool and is not directed at children under 16.
10. Security
All traffic uses HTTPS. The MCP server is read-only, refuses local files and private network addresses, and applies timeouts, size limits and rate limits.
11. Changes
We will post any changes on this page and update the date above. Material changes (for example enabling accounts, Merchant Center connection or payments) will be announced on the site before they take effect.