# Co-Shopper for Agents — Privacy Notice

Effective 2026-10-04.

Co-Shopper for Agents is a free fashion search service for AI agents, run by TasteGraph Inc. It is a standalone service, separate from the Co-Shopper app: the app's privacy policy doesn't apply to it, and it has no access to app accounts or to data people share with the app.

This notice is section 8 of our terms of use, which agents receive with their API key. It applies from the moment an agent asks for an API key at https://api.coshopper.me/agent/v1/keys.

This section is the privacy notice for Co-Shopper for Agents.

- **What we collect:**
  - your agent email address, when you ask for an API key: we email your
    API key to it;
  - your IP address and user agent;
  - the content of your requests and our responses, with the email
    addresses, phone numbers and health terms we recognize removed before
    storage (since October 2, 2026);
  - the invite code or referral code sent with an API key request, which
    tells us which agent passed Co-Shopper on, or that an invite came from
    our team;
  - clicks on our links, with the IP address and user agent of the browser
    that opens one.
- **Why:**
  - to email you your API key and identify your calls by it;
  - to run and improve the service;
  - to attribute retailer commissions to clicks on our links;
  - to prevent abuse;
  - to contact you about your use of the service.
- **Deletion:** on request we delete your agent email and your API keys,
  and unlink your records. Write to privacy@tastegraph.ai.
- **Who processes it:**
  - Amazon Web Services, for hosting;
  - Together AI, which runs the AI models behind styling and is configured
    not to store your data;
  - OpenAI, which turns search queries into embeddings, including the
    queries styling writes from a brief for each piece of an outfit;
  - Google, which hosts our email: your replies to our emails, what you
    write to our tastegraph.ai addresses, and the invites we send to
    addresses on our waitlist;
  - Resend, which delivers our emails: your API key, the email saying an
    invite you made was used, our notices of changes, and the email that
    says sign-up is invite-only right now. Resend keeps its own record of
    each email (the recipient, the content and the delivery status) for a
    limited period under its own terms.

  We list any new processor here before we use it.

- **Our links:** when someone opens one of our product links, the retailer
  and its affiliate network receive that visit and our link's token.
- **Invites:** when an API key is issued with an invite an agent made, we
  email that agent that it was used: the invite's code and when it was
  made, never who used it.
- **Waitlist:** when an address is put on our waitlist, we collect it and
  whether it is an agent's or a person's, only to send it an invite. We
  keep it until we're asked to delete it: write to privacy@tastegraph.ai.
- **We don't sell this data.**

Contact: privacy@tastegraph.ai for your data, support@tastegraph.ai for anything else. TasteGraph Inc. runs Co-Shopper for Agents.