How Product Agent handles information.

1. Who we are

Product Agent is operated by Luke Mortensen, an Australian sole trader trading as Product Agent (ABN 24 738 128 250), Queensland, Australia. Contact support@productagent.app for privacy enquiries, access or correction requests, deletion requests, or complaints.

2. Information we collect

• Account data: name, email, Firebase user ID, profile image when supplied, authentication provider, verification state, account access state, workspace membership, and roles.
• Historical testing-access requests: for requests submitted before public release, name, Google Play account email, optional business or organisation name, business type, approximate monthly item volume, current or intended store channels, notes, consent, request status, source page, and notification status. Product Agent no longer accepts new testing-access requests through the website.
• Workflow content: original and processed product photos, item groups, barcode or SKU values, product identity evidence, capture settings, queue state, listing drafts, review decisions, destinations, and delivery results.
• Connected-store data: store names and identifiers, OAuth state, encrypted connector credentials, authorisation scope, selected products, delivery data, and connector diagnostics.
• Billing and entitlement data: Google Play product and order identifiers, subscription and purchase status, verification results, credit grants, reservations, usage, refunds, reversals, and reconciliation state. Product Agent does not receive your complete payment-card details from Google Play.
• Device, usage, and diagnostics: app version, platform, device and network diagnostics, security and App Check signals, crash reports, performance events, workflow telemetry, abuse-prevention metadata, IP address in server or hosting logs and rate-limiting records, and operational errors. Historical testing-access request records do not store the requester’s IP address or user-agent string.
• Communications: support emails, deletion requests, privacy complaints, security reports, historical testing-access correspondence, and commercial enquiries.
• Legal acceptance: accepted Terms and Privacy versions, server timestamp, app version, platform, authentication provider, and acceptance surface.

3. How we use information

• Authenticate users, create and secure accounts, and maintain personal or workspace scope.
• Retain and administer historical testing-access requests and related correspondence while they remain reasonably needed.
• Capture, store, process, transform, identify, review, generate, export, and deliver requested product-listing content.
• Operate connected stores and destinations with the authority granted by the user.
• Verify purchases, manage listing credits, reconcile subscriptions, prevent fraud, and provide billing support.
• Maintain queue recovery, diagnose failures, monitor reliability, enforce security controls, and improve service operation.
• Respond to support, legal, privacy, deletion, security, and commercial requests.
• Comply with law, protect rights and safety, resolve disputes, and enforce agreements.

4. Service providers and sharing

We disclose information only as reasonably needed for the requested workflow, service operation, support, security, billing, legal compliance, or a business transfer with appropriate safeguards.

• Google and Firebase: Authentication, Firestore, Cloud Storage, Cloud Functions, Hosting, App Check, Crashlytics, Google Sign-In, and Google Play billing. Historical testing-access requests remain in backend-only Firestore records while retained.
• AI and image processing: providers such as OpenAI, PhotoRoom, fal.ai, and Reve may receive selected photos, derivatives, prompts, or product context needed for the requested feature.
• Connected destinations: eBay, Shopify, WooCommerce, Square, Wix, and other destinations receive content and metadata when the user connects and selects them.
• Communications and operations: Mailgun or another configured email provider, support personnel, security providers, and professional advisers may receive limited information needed for notifications and their role.
• Legal and safety: information may be disclosed in response to valid legal process or where reasonably necessary to prevent fraud, abuse, harm, or unlawful conduct.

Product Agent does not sell personal information or customer workflow content and does not use it for cross-context behavioural advertising. Provider handling is also subject to provider contracts and privacy terms; this policy does not claim that a provider never uses data for model improvement unless a binding arrangement confirms it.

5. International processing

Product Agent’s primary Firebase Functions region is Australia, but Google, AI providers, marketplaces, and support infrastructure may process information in Australia, the United States, and other countries where they or their subprocessors operate. Privacy protections in another country may differ from Australia. We use provider terms, access controls, and other reasonable safeguards appropriate to the service and information. Where information about people in the European Economic Area, the United Kingdom, or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission standard contractual clauses, the UK International Data Transfer Addendum, or another transfer mechanism permitted under applicable law, together with the access controls and provider terms described above.

6. Security

Measures include authenticated Firebase access, App Check, server-side privileged operations, workspace-aware authorisation, encrypted transport, protected credential storage, bounded connector requests, short-lived signed asset access where appropriate, account-deletion safeguards, and restricted backend audit collections. No system is perfectly secure. Protect your device and credentials and report concerns promptly.

7. Retention

We retain information while needed to provide the selected workflow, maintain account and billing state, secure the service, support recovery, resolve disputes, comply with legal obligations, and enforce agreements. Actual periods vary with item state, plan, workspace, connected destination, support activity, backup lifecycle, and legal requirements.

• Account and workflow data is deleted or de-identified when no longer reasonably needed, subject to operational recovery and lawful retention.
• Historical testing-access requests and related correspondence are retained while follow-up, security, dispute, or legal needs remain relevant, then deleted or de-identified when no longer reasonably required.
• Google Play and financial transaction records may be retained as needed for tax, accounting, fraud prevention, chargebacks, and disputes.
• Minimal legal-acceptance audit records are retained for six years after account closure, subject to legal review and any active legal hold. They exclude photos, address, and IP address.
• Records subject to a dispute, security investigation, or legal hold may be retained until the matter and applicable retention period end.

8. Account and data deletion

Delete an account in the Android app through Account > Data & Privacy > Delete Account, or use the public Account Deletion page if you cannot access the app. Deletion removes the Firebase account and app-controlled associated data such as profile data, photos, items, listing metadata, credentials, preferences, credit state, and workspace records controlled by the account, except for narrowly retained records described above.

Deleting Product Agent does not cancel a Google Play subscription. Cancel renewals separately through Google Play.

9. Access, correction, complaints, and choices

You may request access to or correction of personal information, ask questions, request deletion, or make a privacy complaint by emailing support@productagent.app. Include enough information to identify the account and request; we may verify identity before acting. We aim to acknowledge complaints promptly and respond within 30 days.

If you are dissatisfied after giving us a reasonable opportunity to respond, you may contact the Office of the Australian Information Commissioner or another regulator available under applicable law.

People in the European Economic Area, the United Kingdom, and Switzerland. Where those laws apply, Luke Mortensen is the controller for the processing described in this policy. We process personal information to perform our contract with the account holder, to meet legal obligations such as tax and accounting records, on the basis of legitimate interests in securing the service, preventing fraud, and supporting users, and on consent where consent is separately requested. In addition to the access, correction, deletion, and complaint rights described above, you may request restriction of processing or a portable copy of information you provided, object to processing based on legitimate interests, and withdraw consent at any time without affecting processing already carried out. Use the same support address to make a request. You may also complain to your local supervisory authority.

10. Website, children, and policy changes

The public website does not intentionally use advertising, third-party analytics, or non-essential cookies. Firebase Hosting and network providers may create ordinary request and security logs. The website no longer provides a testing-access request form. If tracking technologies are introduced, this policy and any required consent mechanism will be updated before they are enabled.

Product Agent is intended for business users aged 18 or older and is not directed to children. We may update this policy as the service, providers, or law changes. Version au-privacy-v1 remains the authenticated app acknowledgement version because retiring the optional pre-account testing form reduces website collection and does not change authenticated app processing. Material changes to the authenticated app-data contract will be communicated and may require renewed acceptance.