Privacy Policy
Last updated:
This policy explains what personal data products.ai collects, why we need it, and what you can do about it. The short version: this website runs without analytics or advertising cookies, we collect as little as we can, and you can ask us about any of it at [email protected].
We wrote it in plain English on purpose. If something is still unclear, email us and we will explain it.
1. Who we are
products.ai is a trade name of Birds B.V., a Dutch private limited company. Birds B.V. is the controller of your personal data. That means we decide why and how your data is used, and we are the ones who answer for it under the General Data Protection Regulation (GDPR).
- Birds B.V., trading as products.ai
- Herengracht 420, Amsterdam, the Netherlands
- Chamber of Commerce (KvK) number 97885800
- VAT number NL868275360B01
- Privacy contact: [email protected]
2. What this policy covers
This policy covers the products.ai website and the services we offer through it:
- This website, including the Resources articles and the sign-up page.
- products.ai chat, a paid subscription ($15 a month or $125 a year) in which you ask Pio, our shopping assistant, what to buy.
- Access to our data in your AI (MCP) and in your product (API), which we provide by request.
Chat accounts are not live yet. The sign-up page is a preview: it checks what you type and stores none of it. The parts of this policy about accounts, payments and conversations apply from the day accounts open, and we will update this page before then.
This policy does not cover the websites of shops or affiliate networks you reach through our links. Once you are on their site, their privacy policy applies. We also run the products.ai price comparison for the Netherlands at products.ai/nl, which has its own privacy policy.
3. Personal data we collect
What we collect depends on what you do. If you only read this website, it is very little.
When you browse this website
Every browser sends some technical data when it asks for a page: your IP address, the page you asked for, the time, and your browser and device type. We need it to deliver the page at all.
Our servers keep this data in standard server logs, which we use to keep the site running and to spot attacks.
Most pages set no cookies at all. Only the sign-up page uses a session (section 5). Its contents are encrypted and stay in your browser: we keep no session record on our server.
The pages, fonts and images on this site are served by our own server. We do not load Google Fonts, analytics tools, tracking pixels or social media widgets, so opening a page here does not tell an advertising company that you visited.
When you click through to a shop
We record the click: which product, which shop and when, with your IP address in hashed form. Section 6 explains how that works and why.
When you email us
The business access form on our home page does not send anything through this site. It opens your own email app with a message to [email protected] already filled in (your work email, company or project, what you are interested in and, if you add it, what you are building). Nothing reaches us until you press send in your email app. We then receive whatever you send, like any other email.
The same goes for email you send to [email protected]: we receive your email address, your name if it is in the message, and what you write.
When you use products.ai chat (once accounts open)
- Account data: your name, email address and password. We store the password only in hashed form, so nobody at products.ai can read it.
- Plan and billing status: which plan you have, when it renews, and whether payments went through.
- Your questions and conversation history: what you ask Pio and what Pio answers, including any details you give about budget, use or preferences.
A payment provider, which we will name here before accounts open, handles the payment itself. We do not receive your full card or bank details.
Pio does not need anything about your health, religion, political views or other sensitive topics to find you a good pair of headphones. Please leave that kind of information out of your questions.
4. How we use it and our legal bases
We use your data only to run products.ai, and the GDPR requires a legal basis for each use. Here is what we do and the basis we rely on.
| What we do | Data we use | Legal basis |
|---|---|---|
| Deliver the website and keep it secure | Server logs, cookies | Legitimate interest: a working, safe website |
| Count clicks to shops, attribute commission and stop click fraud | Click record with hashed IP address | Legitimate interest: getting paid fairly for referrals and keeping fake clicks out |
| Reply to your emails and access requests | Your email and what you tell us | Legitimate interest, or steps you ask for before a contract (API and MCP access) |
| Run your chat account and answer your questions | Account data, questions, conversation history | Performance of our contract with you |
| Bill your subscription | Plan and billing status | Performance of our contract with you |
| Keep financial records | Invoices and payment records | Legal obligation under Dutch tax law |
Where we rely on legitimate interest, we may only do so when your privacy does not outweigh our interest, and you can object at any time (section 11).
We do not sell your personal data, and we do not use it to show you advertising or to build an advertising profile.
Pio's recommendations are made automatically, but they are suggestions you are free to ignore. They have no legal effect on you and do not decide anything about you, so they are not automated decisions in the sense of Article 22 of the GDPR.
5. Cookies
Our pages set no cookies unless you use the sign-up form or choose a language. There are no analytics, advertising or social media cookies. The cookies below are either needed for the form to work or store a choice you made yourself, so the law does not require your consent for them.
| Cookie | What it does | How long it lasts |
|---|---|---|
Language choice (locale) |
Remembers the language you picked in the language menu or the language suggestion, so products.ai opens in it next time | One year |
| Session cookies (sign-up page only) | Keep the sign-up form together between sending it and seeing the result | About two hours after your last page view |
| Security (CSRF) token (sign-up page only) | Stops another website from submitting a form on this site in your name | About two hours after your last page view |
If you close the language suggestion, your browser also notes that in its local storage, so we don’t ask again. That note never leaves your browser.
You can block or delete cookies in your browser settings. The pages will still load, but some features may stop working.
Shops and affiliate networks can set their own cookies once you arrive on their website. Section 6 covers that.
6. Clicks to shops and affiliate links
When you follow a link from products.ai to a shop, we record the click: the product, the shop and the time. We store your IP address only as a hash, a one-way code, and never in readable form.
We do this because many of our links to shops are affiliate links. If you buy something after clicking, the shop may pay us a commission through an affiliate network such as Awin. The click record lets us count clicks, match each commission to the click it belongs to, and filter out click fraud: bots and fake clicks that shops should not have to pay for. The hash lets us see that many clicks came from the same address without keeping the address itself.
A hashed IP address can still count as personal data under the GDPR, so we treat it as personal data.
The link we send you through carries a reference to the click, so the affiliate network can tell us later that a purchase followed. It does not carry your name, email address or IP address.
Once you are on the shop's website, the shop and the affiliate network may set their own cookies, for example to remember that you came from products.ai. They decide how that data is used, and their own privacy policies apply. Commission never decides which product Pio picks; our Terms explain how ranking works.
7. Who we share it with
We share personal data only with companies that help us run products.ai, and each gets only what it needs for its task. These processors act on our instructions and may not use your data for their own purposes.
| Processor | What they do for us | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts this website, our servers and our databases | Germany |
| AI model providers, for example OpenAI | Process your questions so Pio can write its answers (products.ai chat, once live) | United States (see section 8) |
| Payment provider, named here at launch | Takes payments for chat subscriptions | To be confirmed at launch |
Some parties are not our processors but receive data in other ways:
- Shops and affiliate networks (for example Awin) receive a visit from your browser when you click through, and act as independent controllers for what happens on their sites.
- Authorities, such as the police, a court or the tax authority, when the law requires us to hand over data.
If Birds B.V. merges or its business is sold, your data may pass to the company that continues products.ai. This policy would keep applying to it, and we would tell account holders before anything changed.
8. International transfers
We keep your data in the European Economic Area (EEA) where we can. Hetzner hosts our servers in Germany.
AI model providers such as OpenAI may process your chat questions in the United States. When personal data leaves the EEA, the GDPR requires a legal safeguard, so we only work with providers that offer one.
For a US provider, that safeguard is its certification under the EU-US Data Privacy Framework or, where it is not certified, the European Commission's Standard Contractual Clauses, with extra measures where needed.
We do not allow AI providers to use your questions to train their models. You can ask us for a copy of the safeguards we use at [email protected].
9. How long we keep it
We keep personal data only as long as we need it for the reason we collected it, or as long as the law requires. After that we delete it or make it fully anonymous.
- Server logs: 30 days.
- Session cookies (sign-up page only): in your browser only, until they expire about two hours after your last page view.
- Language choice: in your browser only, for one year.
- Click records: 24 months, long enough to settle commission and resolve disputes with shops and networks.
- Emails to us: up to two years after our last contact, unless they lead to an agreement. Then we keep them as long as the agreement runs and the law requires after it.
- Chat account data and conversation history: as long as your account is open. After you close your account, we delete them within 30 days.
- Billing records: seven years, because Dutch tax law requires it.
- Backups: deleted data can stay in our backups for up to 30 days before it is overwritten.
10. Security
We protect your data with technical and organizational measures that fit the risk. Passwords are stored hashed, and IP addresses in click records are stored hashed, so a leak of those tables would not reveal them in readable form.
- Connections to products.ai are encrypted with HTTPS.
- Our servers run in Germany with Hetzner, and only people who need access for their work have it.
- Our processors are bound by contract to keep your data secure.
No system is perfectly secure. If a data breach puts your rights at risk, we report it to the Dutch Data Protection Authority within 72 hours and tell you directly when the law requires it.
11. Your rights
The GDPR gives you control over your personal data. You have the right to:
- Access: ask what data we hold about you and get a copy.
- Rectification: have wrong or incomplete data corrected.
- Erasure: have your data deleted, unless the law requires us to keep it.
- Restriction: ask us to pause using your data, for example while we check a complaint.
- Portability: get the data you gave us in a common, machine-readable format.
- Objection: object to any use based on legitimate interest. We then stop, unless we have compelling reasons that outweigh your interests.
- Withdrawing consent: where we rely on your consent, withdraw it at any time. This does not affect what we did before.
To use any of these rights, email [email protected]. We answer within one month. If a request is complex, or you send many, we may take two more months, and we tell you why within the first month. Using your rights is free. We may ask you to confirm who you are, for example by writing from the email address on your account, so we never hand your data to someone pretending to be you.
Click records hold only a hashed IP address, so we usually cannot find them by your name or email address. If you want us to search them, tell us the IP address you used and roughly when. We can then hash it the same way and look for a match.
If you are unhappy with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the data protection authority in the EU country where you live or work. We would appreciate the chance to fix it first, so please email us too.
12. Children
products.ai is not intended for children under 16, and we do not knowingly collect their personal data. If you think a child under 16 has given us personal data, email [email protected] and we will delete it.
13. Changes to this policy
We update this policy when our services or the law change. Before chat accounts go live, for example, we will add the name of our payment provider. The date at the top of this page shows when we last changed it.
If a change affects how we use your data in a way that matters, we email account holders at least 30 days before it takes effect.
14. Contact
For any question, request or complaint about your personal data, email [email protected].
By post: Birds B.V., attn. Privacy, Herengracht 420, Amsterdam, the Netherlands.
For business access in your AI or in your product (MCP and API), email [email protected].