Your privacy. Clearly explained.

When I help you shop

You can look for items without creating an account. With your permission, I use your approximate location; you can enter an area instead. I send your item or shopping-list text and approximate area to the store directory. Photos are resized on your device. The existing detailed recognition service sends the resized photo to OpenAI. If that service is unavailable, a self-hosted printed-text reader can try to recover a shopping list or label on your device. That fallback does not send your photo or recognized text to an inference provider, and its draft requires review before search. Text-reader files download from KYM when needed and can be cached on your device. Experimental handwriting and object models stay in separate evaluation and do not replace live photo recognition. I don’t save shopper photos in my database or file store, and I don’t send merchant identity documents to OpenAI. OpenAI may retain API data under its own service policies; I request no stored model response.

I use a short-lived, signed browser cookie to keep a hold connected to your browser. I can save your item text and selected shop or hold reference in this browser so your visit survives closing a tab. I use it to resume your visit for up to 24 hours and discard expired references on your next visit. Photos, pickup codes and sign-in credentials aren’t saved in this visit memory. Your selected area stays in the tab. I retain visit, hold and reported purchase records for up to 30 days after they finish. I don’t collect card numbers or process payments in Agent KYM.

Evidence and learning

A small local shopping-need classifier is fitted from KYMPAY-authored examples and evaluated separately. Your searches, symptom text and individual edits are not automatically added to its training data. The printed-text fallback uses pretrained Tesseract weights. Microsoft TrOCR and RT-DETR weights are retained for separate handwriting and object-model evaluation. KYMPAY has not retrained these vision weights. Your photos and individual edits are not automatically copied into training data. Model sources and licenses are listed in the photo-reader notices. This does not retrain the underlying OpenAI model.

I can use dated structured product information from permitted public pages and connected feeds to improve which shops I suggest. A published online offer, review or social mention is not proof of stock at a physical branch. My owner can inspect source links, freshness and the limitations of those observations.

To research current product evidence, I may send item names and the suggested shops’ public area to the configured AI web-research provider. I do not send shopper identities, exact locations or merchant verification documents in this step.

I use explicit merchant hold confirmations and declines to update statistical estimates of merchant responses. These estimates concern resolved hold requests, not guaranteed stock, foot traffic or verified purchases. The learning records exclude shopper identities, photos, contact details, item text, precise shopper locations and payment details. I can retain de-identified merchant-level statistics to evaluate and improve this service. I do not use this process to train a third-party foundation model on shopper activity or copy restricted review-platform content into a permanent training database.

Your saved visit and optional phone alerts

Directions automatically saves your visit for 24 hours using an anonymous signed browser cookie and a browser reference. I don’t identify shoppers by phone number, IP address or device fingerprint. A cleared browser, a different device or an expired cookie may prevent reopening the visit. I store the selected listing reference, your item text and visit timing in my database so the outcome can be shared with a connected shop. I retain visit and reported-outcome records for up to 30 days. I don’t retain a directory listing snapshot or your route.

Phone alerts need your separate browser permission. If allowed, I store a private browser notification address for the visit, remove it after the 24-hour visit window during daily cleanup, and send generic alerts without product or location details in the push payload. I can leave a saved-visit alert, give one nearby hint while this page is visible, and ask once after 59 minutes while this page is open if the visit is still unresolved. Follow-ups for a closed page are dispatched on the next hourly server check, so they arrive later than the 59-minute eligibility time. Device connectivity and browser support can delay delivery further. iPhone and iPad alerts require a Home Screen web app. You can mute visit reminders or revoke browser permission. I don’t use SMS.

I reuse location permission already granted for your search. Location checks pause when Agent KYM is hidden, and stop when the visit ends. I compare readings on your device rather than uploading a route. Nearby is only a hint, never proof you entered or paid. A connected shop also receives a service follow-up for an unresolved visit; directory-only shops cannot receive requests until they join. Either you or the connected shop can report a purchase, and that closes the shared visit. A report is not independently verified payment. The stock-hold deadline remains separate from this later check-in.

Optional shop notifications

If you enable browser alerts, I store a private notification-service address for that browser and shop. Your browser provider delivers a generic new-request alert; I don’t send product details, identity files or customer information in its payload. You can turn alerts off from your shop or browser settings. Signing out disables this device’s subscription when the browser and connection allow it; expired subscriptions are removed. Subscription records expire after 90 days without renewal. Phone permissions, connectivity and supported browser features affect delivery.

When you introduce your shop

I collect your name, business name, shop address, country, email, phone and directory listing reference to create your shop account, contact you about requests and review your authority to represent the business. I send sign-in codes and important service updates by email. These messages are part of operating your account, not consent to marketing.

For an optional verified badge, I ask for a photo ID and a current business licence, incorporation record or equivalent local registration connecting you to the business. You may cover unnecessary ID numbers, date of birth and home address; leave your name, photo and document validity visible. Don’t upload health cards, bank statements, payment cards, tax identifiers or unrelated personal documents. An authorized representative may include a signed authority letter with the business record. I don’t perform biometric identification or make automated identity-verification decisions.

I keep verification files private and short-lived

I encrypt these files before storing them in private object storage. Only the KYMPAY owner reviewing verification has file access; shoppers and sales agents do not. I record review access. I delete the uploaded files after a review decision. Unfinished files expire after 29 days, immediately become unavailable for review, and enter a daily deletion process designed to remove them within 30 days of upload. If a review has not finished, I may ask you to upload current documents again. You can remove a file from your shop at any time.

I keep the verification result, date and a limited audit record rather than retaining raw ID copies. Review access logs expire after 90 days. Infrastructure providers may keep backups or security logs under their own retention schedules; these are not public shop files. No system can promise absolute security. If a deletion job fails, the expired files remain inaccessible and the failure is reported for correction.

My local price research

The item review can also compare retained, dated retailer offers with verified merchant inventory without an AI call. Your chosen country determines the currency. A country-wide online offer is labelled separately from a nearby merchant listing; missing evidence remains unpriced.

I send item names and the suggested shop’s public area/country and website to OpenAI’s web-research service to compare current retail offers. I don’t send verification documents, private merchant email, your photo or your exact location to this price-research step. I briefly cache researched price facts and source references for up to ten minutes of reuse; expired cache entries enter daily cleanup. Retail prices do not prove physical stock, and estimates are labeled separately from shop-confirmed holds.

Shopping knowledge and review assessments

I learn dated product and offer facts from permitted public retailer pages and feeds. A separate review-sentiment model is trained on the UCI Sentiment Labelled Sentences dataset by Dimitrios Kotzias (2015), adapted under CC BY 4.0 (dataset source). Product terminology also uses CC0 labels and aliases from Wikidata. A compact word-list guard derived from the Carnegie Mellon Pronouncing Dictionary helps preserve valid English words during spelling checks; its copyright and redistribution notice is available. When a permitted retailer page publishes dated English review text, I process it temporarily and retain only aggregate sentiment and topic counts with their source and dates. Reviewer names, profiles and review bodies are not retained. Publisher-selected reviews can be unrepresentative and do not prove stock.

An internal backup directory retains attributed Overture Maps retail listings for sampled Canadian and US metro areas, including business websites and original social-profile links. Dataset confidence concerns business existence, not product stock, reviews, revenue or current opening hours. Backup listings require checking with the retailer. Source licences and attribution · Local OCR notices.

Daily search-quality totals count provider calls, rejected out-of-area candidates and uncertain hours. They contain no search text, shopper identity or coordinates and are retained for up to 90 days. Generalized public-domain Natural Earth boundaries help keep Canada/USA GPS searches in the right country. Near a border I may ask for a city or postal/ZIP code. This does not create a public map or retain Google Maps review content for training.

Your inventory and public shop profile

I show your business name, shop address, public business phone, relevant item names, prices and recently confirmed availability to shoppers. I don’t publish your ID, ownership documents, private sign-in email or personal name as part of your shop profile. Keep customer and employee personal information out of inventory uploads. You control item quantities and prices. Unrefreshed inventory stops qualifying as current after 24 hours; each hold still needs a physical check by the shop.

I use verification, relevant item matches, inventory freshness, distance and open status to order suggestions. Verification can improve placement for a relevant shop. It is not a guarantee of stock, safety, quality or a sale.

Services and international use

KYMPAY uses ChatGPT Sites/Cloudflare for hosting, database and private file storage, Resend for transactional email, OpenAI for shopper/product recognition, and Google Maps Platform for directory and location services. Your information may be processed outside your country, including Canada and the United States, under those providers’ arrangements. Local privacy rights and applicable laws may differ. I don’t claim that a directory listing proves licensing, ownership or regulatory approval.

Directory use is also subject to Google’s Privacy Policy and Google Maps Platform terms. AI processing is described in OpenAI’s API data policy. These links explain service-provider terms; shopping and merchant actions stay inside Agent KYM except directions.

Your choices and rights

You may decline location access, correct your item list, remove inventory, remove verification files or close your shop from its account settings. Closing the shop cancels active holds and removes the active account, inventory and uploaded files. I retain only limited security/audit information for the periods above or where a specific legal obligation requires it. For access, export, correction, restriction, an objection or a privacy complaint, email team@kympay.com. I’ll verify the request proportionately before acting. You may also contact your local privacy regulator.

I use essential cookies and aggregate rate-limit counters to secure the service, not advertising trackers. I don’t sell your personal information. Agent KYM is for general retail shopping and adult business representatives; do not upload children’s information or sensitive medical information. I’ll update this notice when the service or data use materially changes.

My service terms · Your shop