Privacy Policy
Last updated: October 8, 2026
This policy explains what Future Products LLC ("Heard", "we", "us") collects when you use the Heard service at shopheard.ai and heard-shop.vercel.app (the "Service"), why, who else handles it, and what choices you have. It is written to be read. If anything is unclear, write to contact@shopheard.ai.
The short version
- Heard keeps a text transcript of each conversation, not the audio.
- Audio is streamed to our speech provider to be understood, and we do not store it.
- We record what was shown to you and what you liked, opened, zoomed, or clicked, so we can make search better.
- We use PostHog to count page visits and a limited set of shopping actions. We do not send conversation text to PostHog or record sessions there.
- We keep no account, no name, no email, no payment details, and we do not use advertising trackers.
- A random identifier in your browser links your sessions together.
- We do not sell your information or share it for advertising.
- Email contact@shopheard.ai to have your data deleted.
1. What we collect
What you say and type. When you tap the microphone, your voice is streamed to our speech provider (OpenAI) so the assistant can understand and answer you. We store the resulting transcript: what you said, as text, and what the assistant said back. We also store anything you type. We do not store the audio, and we do not create a voiceprint or use your voice to identify you.
What you saw and did. For each session we record the products shown to you (title, store, price, image link, and catalog attributes as they appeared at the time), your answers to style questions, and your interactions: hearts and un-hearts, zooms, product details you opened, "load more", undo, start over, and clicks through to a store. Each of these is tied to the set of results that was on screen.
About your visit. When your browser sends events to us, our hosting provider (Vercel) derives an approximate location from your IP address. We store the country, region, and city, the time zone, your device type, operating system, browser, screen size, the referring page, and the browser's user-agent string. We do not store your IP address in our records.
Website analytics. When you visit, PostHog receives page views and limited shopping actions: searches and refinements (without the words you used), likes and un-likes, clicks through to stores, loading more results, and starting over. For product actions, we may send the product identifier and its position in the results. PostHog also receives standard web request information, such as your IP address, page URL, referrer, browser, and device details. We disable automatic interaction capture and session recording, and do not send transcripts, voice audio, typed requests, or search terms to PostHog.
Identifiers we set in your browser. Heard uses local storage, not cookies, for:
- a random anonymous identifier, generated the first time you visit, which links your sessions together so we can see whether people come back and, later, learn your taste across visits; and
- the identifier of the microphone you last used, so we can pick the same one next time; and
- a separate anonymous identifier used by PostHog to count visits and shopping actions across visits.
These identifiers do not contain your name or email, and we do not share them for advertising.
IP address, briefly. Your IP address is used in memory and in a short-lived cache (for up to ten minutes) to enforce rate limits that protect the Service from abuse, and it may appear in our hosting provider's standard server logs. It is not written to our session records.
Things we deliberately do not collect. There is no sign-up, so we have no name, email, or password for you. Heard never asks for or takes payment card numbers, shipping addresses, or government identifiers. Buying happens on the store's own website, and we do not see what you buy there, whether a purchase completed, or anything you enter on the store's site.
2. Why we collect it
We use this information to:
- run the Service: turn your speech into a request, search the catalog, and show results;
- remember your taste within a session and, over time, across sessions in the same browser;
- understand what works and what does not, fix problems, and improve how Heard searches, ranks, and talks;
- protect the Service against abuse and keep it available; and
- meet legal obligations and enforce our Terms of Service.
We do not use it to advertise to you, to build a profile of you for use anywhere else, or to make decisions with legal or similarly significant effects on you.
For readers in the European Economic Area or United Kingdom, where the law asks us to name a legal basis: we process your speech and your session records on the basis of your consent (given when you tap the microphone, and withdrawable by stopping); we process session records, interaction data, visit information, and rate-limit data on the basis of our legitimate interests in operating, securing, and improving an early-stage product; and we may process data to comply with legal obligations.
3. Who else handles your data
We rely on a small number of providers, each of which processes only what it needs for its part. They act as our service providers (processors) under contracts that restrict them to providing their services to us. As of the date of this policy, our AI providers' API terms do not allow them to use your data to train their models.
| Provider | What it does | What it receives |
|---|---|---|
| OpenAI | Real-time speech recognition, conversation, and speech synthesis | Your live audio, the transcript, and the products being discussed |
| Anthropic | Interprets requests, plans searches, and describes product photos | The text of your requests and the conversation, and product data and images |
| Typesafe AI (Jev) | When enabled, checks whether product listings match your requirements | Product listing text and requirements derived from your request; no photos or audio |
| Shopify | Product catalog search and product details | Your search queries and filters, without any identifier for you |
| Supabase | Database where session records are stored | Everything listed in Section 1 except audio and IP address |
| PostHog | Website and shopping-action analytics | Page views, selected actions, anonymous identifier, standard web request and device information; no conversation text or audio |
| Vercel | Hosting, and the approximate location derived from your IP address | All traffic to the Service, including IP address in standard server logs |
| Upstash | Short-lived cache for rate limiting and catalog results | IP-keyed counters that expire within minutes; cached search results |
| Cloudflare | Domain name services for shopheard.ai | Domain lookups |
We do not share your data with anyone else, except: with your direction (for example when you click through to a store, which then collects data under its own policy); to comply with law, a court order, or a lawful request; to protect the rights, safety, or property of Heard, our users, or others; or as part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your data until it is changed with notice to you.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
4. Where your data is kept
Our servers and our providers are located in the United States. If you use the Service from Canada, the European Economic Area, the United Kingdom, or elsewhere, your information is transferred to and processed in those countries, whose privacy laws may differ from yours. Where a transfer mechanism is required, we rely on our providers' standard contractual clauses or equivalent safeguards.
5. How long we keep it
Heard is an early-stage product, and we are using session records to learn how people search for things and to build a taste model. We currently keep session records for as long as we are actively developing the Service, and we review retention periodically. We will delete or anonymize records when they are no longer needed for these purposes, and we will delete your records at any time on request (see Section 6). Rate-limit data expires within minutes. Cached catalog data, which is not linked to you, expires within 30 days.
6. Your choices and rights
Control what is recorded. Page views are counted when you visit, and shopping actions are recorded when you take them. Voice and conversation records begin when you tap the microphone. The microphone stops when you close the tab or the session ends. Clear your browser's site data for shopheard.ai to remove the anonymous identifiers; your next visit will start fresh ones, unlinked to the old sessions.
Deletion, access, and correction. Email contact@shopheard.ai and we will delete the session records linked to your browser's anonymous identifier, or give you a copy of them. We will also address PostHog records that we can identify as yours. Because we hold no name or email for you, we need a way to find your records: tell us roughly when your sessions took place and something you said, or send us the anonymous identifier from your browser's local storage (the value stored under the key heard.anonId). PostHog uses a separate anonymous identifier, so we may ask you for that browser identifier to locate its records. We will respond within 30 days, and within 45 days for California residents, and we may ask for more detail to confirm we have found the right records. We will not treat you differently for exercising these rights.
Residents of California and other U.S. states with consumer-privacy laws have the right to know what personal information we collect and how we use and share it (this policy), to delete it, to correct it, and to opt out of sales, sharing, and targeted advertising. We do not sell or share personal information, so there is nothing to opt out of, and we treat browser signals such as Global Privacy Control as a request we already honour. You may use an authorized agent to make a request. Because we hold no account information, we identify your records as described above. The categories of personal information we collect are: identifiers (the anonymous browser identifier), internet and device activity (transcripts, interactions, and visit information), approximate geolocation (city level), and audio (transiently, not stored by us).
Residents of Canada. We collect, use, and disclose personal information with your consent and as described in this policy, in accordance with the Personal Information Protection and Electronic Documents Act and applicable provincial laws, including Quebec's Law 25. You may withdraw consent by stopping use of the Service and asking us to delete your records. You may ask us what personal information we hold about you and challenge its accuracy. The person responsible for privacy at Heard can be reached at contact@shopheard.ai. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.
Residents of the European Economic Area and United Kingdom. The Service is not directed at you, and we do not market it in your country, but if you use it you have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent at any time without affecting earlier processing. To exercise them, email contact@shopheard.ai. You also have the right to lodge a complaint with your local data-protection authority. We have not appointed a representative in the EU or UK.
7. Security
Session records are stored in a database that only our server can write to or read, using keys that are never sent to browsers. Data travels over encrypted connections. Our providers maintain their own security programmes. No system is perfectly secure, and we cannot guarantee that your information will never be accessed or disclosed without authorization. If we learn of a breach that affects you and the law requires notice, we will provide it.
8. Children
The Service is for adults. It is not directed at children, and we do not knowingly collect personal information from anyone under 13 (or under 16 where that is the applicable age). If you believe a child has used Heard, email contact@shopheard.ai and we will delete the records.
9. Do Not Track
Heard does not track you across other websites, so there is nothing for a Do Not Track signal to switch off. We do not respond to those signals except as described for Global Privacy Control in Section 6.
10. Changes to this policy
We may update this policy as the Service changes; the "Last updated" date shows when. If a change materially reduces your rights or expands what we collect, we will make reasonable efforts to tell you, for example with a notice in the Service, before it takes effect.
11. Contact
Privacy questions, access requests, and deletion requests: contact@shopheard.ai