Privacy Policy for ProductPair

Effective Date: July 13, 2026

ProductPair.ai (“ProductPair,” “we,” “our,” or “us”) provides an Instagram-powered product-discovery application for Shopify merchants.

This Privacy Policy explains how we collect, use, disclose, and protect information through:

• the ProductPair Shopify application;

• ProductPair storefront widgets and product-recommendation experiences;

• our websites, including ProductPair.ai;

• merchant dashboards, support channels, and related services; and

• any other ProductPair service that links to this Privacy Policy.

Together, these are referred to as the “Services.”

ProductPair is an independent service and is not sponsored, endorsed, administered by, or affiliated with Instagram or Meta.

1. How ProductPair Works

A Shopify merchant may install ProductPair and configure customer personas, product groups, widget settings, and other storefront preferences.

A shopper can then enter a public Instagram username into a participating merchant’s ProductPair widget. ProductPair analyzes available public profile signals, matches those signals to personas configured for that merchant, and generates product recommendations and a personalized explanation.

ProductPair does not require shoppers to sign in to Instagram or provide an Instagram password. We do not request access to private Instagram accounts, private messages, login credentials, or non-public account information.

A shopper may sometimes enter the username of another person, such as someone for whom they are shopping. You should only submit a username where you have a legitimate reason and authorization to do so. ProductPair’s results are intended only for lightweight product discovery and should not be treated as factual assessments of a person’s identity, personality, beliefs, health, financial status, or other sensitive characteristics.

2. Information We Collect

The information we collect depends on how you interact with the Services.

A. Merchant and Shopify Account Information

When a merchant installs or uses ProductPair, we may receive or collect:

• Shopify store name, domain, and store identifiers;

• merchant administrator and installation information;

• Shopify authentication and session information;

• app configuration, installation status, and granted permissions;

• merchant-created or automatically generated personas;

• product, collection, inventory, variant, and catalogue information;

• widget appearance, messaging, and configuration settings;

• billing status and ProductPair usage information;

• support communications and contact information; and

• app activity, error logs, and diagnostic information.

We receive this information directly from merchants, from Shopify, or through the merchant’s use of ProductPair.

B. Instagram Username and Public Profile Information

When a username is submitted through a ProductPair widget, we may collect and process:

• the submitted Instagram username;

• public display name and biography;

• public profile image;

• public account and profile metadata;

• public post captions;

• publicly available post images or related image labels;

• emojis, keywords, and other visible public profile signals; and

• technical information about whether sufficient public information was available.

The precise public information available may differ by account and by the third-party service used to retrieve it.

ProductPair does not intentionally collect private Instagram content, Instagram passwords, private messages, private follower information, or information available only by logging into an Instagram account.

C. Recommendation and Persona Information

We may create and store information generated through the recommendation process, including:

• matched merchant persona;

• recommendation scores or matching signals;

• generated product recommendations;

• personalized recommendation blurbs;

• identifiers for a recommendation session or run;

• whether a recommendation was served from a temporary cache; and

• whether products were viewed, clicked, recommended, or added to a cart.

These results are generated for product discovery. They are probabilistic and may not accurately describe the person associated with a submitted username.

D. Storefront Activity and Attribution Information

When someone interacts with ProductPair on a merchant’s storefront, we may collect:

• ProductPair session or visitor identifiers;

• recommendation-run identifiers;

• widget opens and interactions;

• persona matches;

• product impressions and clicks;

• products recommended;

• verified add-to-cart activity;

• referring page or storefront;

• timestamps; and

• limited cart context used to connect ProductPair activity with a later purchase.

ProductPair may use Shopify storefront cookies, browser local storage, session storage, or similar technologies to maintain the widget experience, restore the widget after a page reload, prevent duplicate processing, and measure ProductPair-attributed activity.

E. Order, Refund, and Commerce Information

Where permitted by the merchant’s Shopify permissions, ProductPair may process limited order and refund information needed to provide attribution, performance reporting, and performance-based billing, including:

• Shopify order, refund, product, variant, and line-item identifiers;

• order and refund timestamps;

• product quantities and product revenue;

• currency;

• whether an order line was attributed to ProductPair;

• direct or assisted attribution classification;

• commissionable attributed revenue;

• refund adjustments; and

• billing-event status and identifiers.

ProductPair does not need a shopper’s full payment-card number and does not process card payments directly. Checkout and payment processing are handled by Shopify and the merchant’s payment providers.

ProductPair seeks to use only the order information reasonably necessary to determine whether a purchase resulted from a ProductPair interaction, calculate net retained attributed revenue, reverse attribution after eligible refunds, and report performance to the merchant.

F. Device, Usage, and Technical Information

We and our service providers may automatically collect:

• IP address;

• browser and device type;

• operating system;

• referring URL;

• pages or screens viewed;

• timestamps and interaction data;

• application logs;

• network and performance information; and

• error, security, and diagnostic information.

G. Communications

When you contact us, request support, join a beta program, or otherwise communicate with us, we may collect your name, email address, company or store information, message content, and any other information you choose to provide.

3. How We Use Information

We may use information to:

• provide and operate the ProductPair Services;

• analyze public profile signals submitted through a widget;

• match submitted profiles to merchant-defined personas;

• generate personalized product recommendations and blurbs;

• retrieve and display relevant Shopify products;

• maintain storefront sessions and restore widget state;

• verify add-to-cart activity;

• connect ProductPair activity with completed purchases;

• calculate direct and assisted attribution;

• calculate ProductPair-attributed revenue and related fees;

• process proportional reversals following eligible refunds;

• provide merchant dashboards, reports, and performance insights;

• administer Shopify App Pricing and billing events;

• cache profile signals and recommendation results to improve speed and reliability;

• prevent duplicate events, attribution, billing, or refund processing;

• troubleshoot errors and monitor service performance;

• detect, investigate, and prevent misuse, fraud, security incidents, or unlawful activity;

• provide customer support and respond to requests;

• improve recommendation quality, reliability, and usability;

• comply with legal, regulatory, contractual, and Shopify platform requirements; and

• protect ProductPair, merchants, shoppers, and others.

We do not use ProductPair recommendations to make decisions that produce legal or similarly significant effects concerning employment, credit, housing, education, insurance, healthcare, or access to essential services.

4. Legal Bases for Processing

Depending on where you are located and the context in which information is processed, we may rely on one or more of the following legal bases:

• your consent;

• performance of a contract with a merchant or user;

• our legitimate interests in operating, securing, improving, and measuring the Services;

• a merchant’s legitimate interests in providing product discovery and understanding ProductPair-attributed commerce;

• compliance with legal obligations; and

• protection of our rights or the rights and safety of others.

Where ProductPair processes shopper information on behalf of a Shopify merchant, the merchant may determine the purposes for which the storefront experience is offered and may act as the controller or organization responsible for that information. ProductPair may act as the merchant’s service provider or processor for those activities.

ProductPair may separately determine how information is processed for its own app administration, security, billing, support, legal compliance, and service-improvement purposes.

5. Temporary Caching and Retention

ProductPair may temporarily cache public Instagram profile signals and completed recommendation results to improve response times and avoid repeatedly retrieving or generating the same information.

These recommendation and profile-signal caches are generally configured to expire after approximately 24 hours. Cached information may be deleted sooner or retained for a different period where required for security, troubleshooting, legal compliance, or technical operations.

Other records may be retained for longer periods where reasonably necessary, including:

• merchant account and configuration information while the app remains installed;

• attribution, order, refund, commission, and billing records needed for reporting, reconciliation, dispute handling, tax, accounting, and legal obligations;

• security and diagnostic logs;

• support correspondence; and

• records needed to honour privacy requests or demonstrate compliance.

When information is no longer reasonably necessary, we may delete it, anonymize it, or aggregate it, subject to applicable law and technical limitations.

Uninstalling ProductPair does not necessarily cause every record to be deleted immediately. Certain records may need to be retained for billing reconciliation, refunds, fraud prevention, dispute resolution, legal compliance, or Shopify-required privacy workflows.

6. How We Disclose Information

We may disclose information in the following circumstances.

A. Shopify Merchants

The merchant operating the storefront may receive information about ProductPair activity on its store, including:

• persona matches;

• profile-run activity;

• recommended products;

• add-to-cart activity;

• attributed orders and products;

• attributed revenue;

• refund adjustments; and

• ProductPair fees.

The merchant does not necessarily receive all raw public Instagram information processed during matching.

B. Shopify

We disclose and receive information through Shopify as needed to:

• install and authenticate the app;

• retrieve store and product information;

• process storefront requests;

• attribute orders and refunds;

• respond to Shopify privacy webhooks;

• confirm pricing or billing status; and

• submit Shopify App Events used for performance-based billing.

Shopify independently processes information under its own terms and privacy policies.

C. Service Providers

We may engage service providers that assist with:

• cloud hosting and infrastructure;

• databases and storage;

• public social-profile retrieval;

• artificial-intelligence processing;

• image analysis;

• application monitoring and logging;

• email and customer support;

• security;

• analytics; and

• billing and commerce operations.

These providers may process information only as reasonably necessary to provide their services to us, subject to appropriate contractual, confidentiality, and security obligations.

ProductPair’s current technical service categories may include Shopify, cloud-hosting providers, artificial-intelligence model providers, public social-data retrieval providers, and image-analysis providers. Providers may change as the Services evolve.

D. Legal and Safety Reasons

We may disclose information where we reasonably believe disclosure is necessary to:

• comply with applicable law, regulation, subpoena, court order, or legal process;

• respond to lawful requests from government authorities;

• enforce agreements or protect our legal rights;

• investigate fraud, abuse, security incidents, or violations of law; or

• protect the rights, property, or safety of ProductPair, merchants, shoppers, service providers, or others.

E. Business Transactions

Information may be transferred as part of a proposed or completed merger, financing, acquisition, reorganization, sale of assets, insolvency proceeding, or similar business transaction, subject to appropriate confidentiality and legal protections.

7. No Sale of Personal Information

ProductPair does not sell personal information for money.

We also do not use or disclose personal information for cross-context behavioural advertising as those terms are defined under applicable United States state privacy laws.

ProductPair’s performance-based fee is based on purchases attributed to the ProductPair widget. It is not payment for selling a shopper’s personal information.

8. Cookies and Similar Technologies

ProductPair may use cookies, local storage, session storage, and similar technologies to:

• identify a ProductPair storefront session;

• maintain widget state;

• restore recommendations after a page reload;

• connect recommendation activity with cart and order activity;

• prevent duplicate processing;

• remember limited settings;

• secure the Services; and

• understand technical performance.

A Shopify merchant may separately use its own cookies, pixels, analytics, or advertising technologies. Those technologies are controlled by the merchant and are governed by the merchant’s privacy policy.

You may be able to manage cookies through your browser or through consent controls provided by the Shopify merchant. Blocking essential storage technologies may prevent parts of ProductPair from functioning properly.

9. Artificial Intelligence and Automated Personalization

ProductPair uses automated systems and artificial-intelligence services to interpret available public profile signals and produce persona matches, recommendation explanations, and product suggestions.

These outputs:

• are generated probabilistically;

• may be incomplete, inaccurate, or unexpected;

• should not be treated as verified statements about a person;

• are not intended to infer sensitive personal characteristics; and

• are used only to support product discovery and related merchant analytics.

ProductPair seeks to calibrate recommendations to the amount and quality of public information available. Where a profile contains little public information, recommendations may be broader and less specific.

Information submitted to our artificial-intelligence service providers may be processed under contractual and technical controls established with those providers.

10. Public Information and Third-Party Platforms

Although ProductPair processes information that is publicly available, public availability does not mean that information is unrestricted or cannot constitute personal information under applicable law.

Instagram, Shopify, and other third-party services are governed by their own terms and privacy practices. ProductPair is not responsible for the privacy, security, availability, or accuracy of those third-party services.

Changes made by a third-party platform may affect what information ProductPair can retrieve or how the Services function.

11. Data Security

We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include:

• authenticated merchant access;

• access controls;

• encryption in transit;

• restricted production tools;

• request and webhook verification;

• data minimization;

• event idempotency protections;

• logging and monitoring; and

• limiting service-provider access to information needed for their functions.

No system, transmission method, or storage platform is completely secure. We therefore cannot guarantee absolute security.

12. International Processing

ProductPair is based in Canada. We and our service providers may process and store information in Canada, the United States, and other countries.

As a result, information may be subject to the laws of jurisdictions that differ from those in your home province, state, or country. Government authorities in those jurisdictions may have lawful access to information under local law.

Where required, we use appropriate contractual or other safeguards for international transfers of personal information.

13. Your Privacy Rights

Depending on applicable law, you may have the right to:

• request access to personal information we hold about you;

• request correction of inaccurate or incomplete information;

• request deletion of certain information;

• withdraw consent where processing is based on consent;

• object to or restrict certain processing;

• request a portable copy of certain information;

• ask for information about how your information has been used or disclosed; and

• submit a complaint to an applicable privacy or data-protection authority.

These rights are not absolute and may be subject to legal exceptions. We may need to verify your identity before completing a request.

Because ProductPair often receives only an Instagram username, storefront session identifier, or Shopify commerce identifier, we may need additional information to locate relevant records. In some circumstances, we may direct you to the Shopify merchant that operated the storefront because the merchant is responsible for the relevant shopper relationship.

To submit a request, contact hello@productpair.ai and include:

• the nature of your request;

• the Shopify store where you used ProductPair, where applicable;

• the submitted Instagram username, where relevant;

• an approximate date of interaction; and

• enough information for us to reasonably locate and verify the relevant records.

Do not send passwords, payment-card details, government identification, or other unnecessary sensitive information by email.

You may also submit certain requests directly to the Shopify merchant whose storefront you used. Shopify may forward legally required customer-data requests or deletion requests to ProductPair through Shopify’s privacy-request systems.

We will not discriminate against you for exercising a privacy right.

14. Marketing Communications

Where we send promotional emails, you may unsubscribe using the link included in the message or by contacting us.

We may still send non-promotional communications concerning an active merchant account, security, billing, support, legal notices, or changes to the Services.

15. Children’s Privacy

ProductPair is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Merchants should not knowingly use ProductPair in a manner directed primarily at children where doing so would require parental consent or other protections under applicable law.

If you believe a child has provided personal information through ProductPair, contact us at hello@productpair.ai. We will review the request and take appropriate action.

16. Merchant Responsibilities

Shopify merchants using ProductPair are responsible for:

• providing legally required notices to their shoppers;

• identifying ProductPair or personalized product discovery in their own privacy policy where appropriate;

• obtaining consent where required;

• configuring Shopify consent and customer-privacy tools appropriately;

• using ProductPair only for lawful purposes;

• responding to shopper requests for which the merchant is responsible; and

• ensuring that their use of ProductPair complies with applicable privacy, consumer-protection, marketing, and platform laws.

A merchant’s privacy practices may differ from ProductPair’s. Shoppers should review the merchant’s privacy policy in addition to this Privacy Policy.

17. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes to the Services, service providers, technology, legal requirements, or business practices.

The “Effective Date” at the top indicates when this Privacy Policy was most recently revised. Where required, we will provide additional notice of material changes through our website, merchant application, email, or another appropriate method.

18. Contact Us

Questions, concerns, complaints, and privacy requests may be directed to:

ProductPair.ai
Toronto, Ontario, Canada
Email: hello@productpair.ai