Privacy Policy
BasketBridge is operated by FCOMS UK CIC, a community interest company registered in England and Wales (company number 15086338), registered office Office 2, 2nd Floor, 309 High Street, West Bromwich, England, B70 8LX. We are the controller for the data described here. Contact: support@basketbridge.io.
BasketBridge lets AI assistants search online stores and hand you a cart link. We have no shopper accounts, never handle shoppers' payments, set no cookies, and keep nothing that tells us who a shopper is.
1. What we process and how long we keep it
Where it comes from. We only receive what your AI assistant sends when it uses BasketBridge (search words, store, country, chosen products and quantities), plus the request details Cloudflare passes to us (IP address, user agent, country). Your assistant app decides what to send, and its own privacy policy covers the rest of your conversation. We never see your chat.
| Data | Why | Kept |
|---|---|---|
| Your assistant's request: search words, store, country, chosen products | To ask the store for products and build the cart link | Only in memory while the request runs. Search words are never logged or stored |
| Your IP address and browser or app user agent | To derive your country and a daily visitor count (next row) | Only in memory while the request runs. Never stored |
| A daily visitor hash: the first 8 bytes of SHA-256(daily random salt + IP address + user agent) | To estimate how many different clients use the service each day | The salt is kept for 24 hours and then deleted, so a hash cannot be linked to another day or traced back to an IP address. Hashes are stored with the usage counters below |
| Usage counters: event type, tool, outcome, assistant app name (for example "Claude" or "Cursor"), country, store domain, link type, visitor hash | To run, secure and improve the service, and to count cart links opened by people | 90 days in Cloudflare Analytics Engine, then deleted. Daily and hourly totals without any visitor hash are kept indefinitely |
| Error logs | To find and fix faults | Request logging is switched off, so these logs hold no IP addresses, headers or search words; only our own error messages. Cloudflare keeps them for up to 7 days |
| Developer accounts (only if you sign up for an API key): name, email, company, key usage | To provide the account | While the account is open, then deleted within 90 days of closure |
| Emails you send us | To answer you | As long as needed to deal with your message, and no more than 24 months |
2. Legal basis
Running, securing and measuring the service: our legitimate interests (UK GDPR and EU GDPR Article 6(1)(f)). We chose the daily-salted hash so that we can count usage without being able to recognise anyone. Developer accounts: performance of a contract (Article 6(1)(b)).
3. Who else is involved
Cloudflare, Inc. hosts BasketBridge and stores the data above as our processor. Its network is global, so data may be processed outside the UK and EEA under Cloudflare's data processing addendum and standard contractual clauses.
Stores. When your assistant searches a store, the store sees a request from BasketBridge with your search words and country, not your IP address. When you don't name a store, the same request goes to Shopify's Global Catalog, which searches across stores. When you open a cart link you are on the store's own website, and its privacy policy applies.
Referral networks. If a link is marked as a referral link, opening it passes through an affiliate network's redirect, which may set its own cookies. See Disclosures.
We do not sell personal data or use it for advertising.
Cart links carry utm_source=basketbridge&utm_medium=agent, which tells the store the visit came from BasketBridge. They contain nothing that identifies you.
4. Storage and security
Everything is stored on Cloudflare: usage counters in Analytics Engine, developer accounts in a D1 database. API keys are stored only as hashes, and credentials for the stores and networks we use are encrypted (AES-256-GCM). All traffic is HTTPS. We make no decisions about anyone by automated means that have legal or similarly significant effects.
5. Your choices
- You decide whether to open a cart link; nothing is bought until you pay on the store's own checkout.
- You can turn BasketBridge off or remove it in your assistant's app or connector settings at any time.
- There is no shopper account, so there is nothing to close or delete.
6. Children
BasketBridge is a general shopping tool. We don't knowingly collect personal data from children, and we hold nothing that identifies any shopper. Purchases happen on the stores' own websites, which apply their own age rules.
7. Your rights
You can ask for access to, correction or erasure of personal data, object to processing, or restrict it. Email support@basketbridge.io; we reply within one month. Because we cannot link a daily hash to a person, we usually hold nothing we can identify as yours, and we will tell you if so. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
8. Changes
We will post any change here with a new effective date.