Privacy policy

Last updated November 6, 2026

1. Who we are

Polytaste (“Polytaste”, “we”, “us”) is operated by Retail Native LLC, a United States company. This policy explains how we handle personal information when you visit polytaste.ai, join the beta waitlist, use the Polytaste app, or let an AI assistant use Polytaste on your behalf. Polytaste is currently offered in the United States only.

2. What we collect

When you join the waitlist

Your email address, and, if you tell us, your first name, the categories you're interested in and which AI assistants you use. Also your confirmation that you are 18 or older and your agreement to receive waitlist emails (with the date and the version of the wording you agreed to). We do not store your IP address with your signup.

When you create an account

• Your email address and first name, used to sign you in with a one-time code.
• Your date of birth, which we use only to apply age rules (18+ overall, 21+ for wine and beer). We store it encrypted and use flags derived from it, not the date itself.

What you tell us about your taste

• Quiz answers, ratings (Not for me, Liked it, Love it), swipes and comments.
• Things you never want suggested, and profiles for people you buy gifts for (a name or nickname and their tastes, kept separate from yours; no contact details).
• Photos or screenshots you choose to share (“Snap your taste”). We extract the products shown and do not keep the image.

From your inbox, if you connect it

Product, brand, size or variant, quantity, price, date and shop, extracted from receipts, order and shipping confirmations, and emails from shops on our list. See section 3.

From AI assistants you connect

The options an assistant asks us to rank, the context it sends (for example occasion, budget, or whether it's a gift), and outcomes it reports back (purchased, returned, rated or skipped). We log each request so you can see it.

Technical information

Basic logs needed to run and secure the service (for example request times and error codes). Our logs are designed to exclude email content and your profile. We do not use advertising cookies or third-party trackers.

3. Google user data (Gmail)

Connecting Gmail is optional. You can use Polytaste fully with the quiz and your own ratings instead.

What we access

With your permission on Google's consent screen, we request read-only access to Gmail (the gmail.readonly scope). We cannot send, change or delete your email. If you sign in with Google, we also receive your name, email address and Google account ID.

What we read

We ask Gmail only for messages from shops on our published merchant list (which you can see and edit), such as receipts, order and shipping confirmations and emails from those brands. We do not scan the rest of your mailbox. If you are under 21, we never look for wine or beer merchants.

What we keep, and what we don't

• From each matching message we extract the product, brand, variant, quantity, price, date and shop, and show them to you in your Purchase & Taste Timeline, where you can edit or delete any item.
• We never store the email itself. Messages are processed in memory and discarded. We do not keep message bodies, subject lines or attachments, and we do not write email content to logs.
• The facts we extract are stored encrypted, in a separate part of our database that the systems serving AI assistants and any model training cannot access.

How we use it

Only to provide and improve features you can see: your timeline, your swipe deck, your taste profile, and the taste and rankings Polytaste shares for you, inside Polytaste and with AI assistants you choose to connect (section 6). Assistants receive only aggregated taste, never your emails, receipts or purchases, and you can turn off the use of inbox learning for each assistant. It is never used for advertising, never sold, never used to build reports or insights for brands or shops (even anonymised), and never used to train AI or machine-learning models other than your own personal profile.

Who sees it

No person at Polytaste reads your email. People may see extracted data only with your explicit permission (for example, when you ask for support), when needed for security (such as investigating abuse), to comply with the law, or in aggregated form for internal operations as permitted by Google's policy.

Limited Use

Polytaste's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting

You can disconnect Gmail at any time in Settings, or from your Google Account's security page. When you disconnect, we revoke our access and delete everything that came from your inbox, including swipes and ratings on items found there, and recompute your profile without it.

4. How we use information

• To build and show you your taste profile, timeline and swipe deck.
• To share the taste a request needs, and to rank options for you, in Polytaste and for AI assistants you connect.
• To apply age rules and the limits you set.
• To run the beta: invite you, send service and beta emails you agreed to, and ask for feedback. You can unsubscribe from beta emails at any time.
• To secure the service, prevent abuse and comply with the law.
• To improve Polytaste, using only data that did not come from your inbox (for example quiz answers and ratings of items you added yourself), and never your email data.

5. AI processing and service providers

We use carefully chosen providers to run Polytaste. They process data on our instructions and may not use it for their own purposes.

• Anthropic (AI models): reads the text of matching receipts and order emails, photos you share, and comments you write, so we can extract products and preferences. Anthropic processes this under commercial terms that do not allow it to train its models on our data, and we have requested zero data retention, so content is not stored after it is processed. Only messages from shops on our list are sent.
• Supabase (database, sign-in) and Vercel (hosting), in the United States.
• Google Cloud (encryption key management) and Google APIs (Gmail and Google sign-in, if you use them).
• An error-reporting provider and an email-sending provider, configured not to receive email content or your profile.

6. Sharing with AI assistants you connect

Polytaste is built for AI assistants like Claude and ChatGPT. An assistant can use Polytaste only after you approve it, and only for the categories you choose (for example coffee but not fragrance).

• Only what the request needs. When an assistant works on something for you, it can ask for your taste in one category for that purpose. We send preferences (for example “prefers darker roasts, likes chocolate notes, never flavoured”) and can rank options it is considering, with a short reason.
• Inbox learning, in aggregate only. If you connected your inbox, these preferences may reflect what we learned from your receipts, in aggregate only. You can turn that off for each assistant.
• Never sent: your emails, receipts, purchase history, prices, brands you bought, individual ratings, comments, People profiles or your whole profile.
• Use limited to your request. We instruct assistants to use what we send only for the request it was asked for, not to keep it beyond that, sell it, use it for ads or train AI on it.
• You can see and stop it. Every request appears in your access log (kept 12 months). You can revoke an assistant in one tap; it loses access immediately and we ask its provider to delete what it received.
• Alcohol. Wine and beer taste and rankings are never shared for anyone under 21.
• Assistants are operated by other companies under their own privacy policies. What you do with an assistant (including purchases) is governed by its terms.

We may also disclose information if required by law, to protect people's safety or our rights, or as part of a merger or acquisition, in which case this policy and Google's Limited Use requirements continue to apply to your data.

7. What we never do

• Sell your personal information, or share it for cross-context behavioral advertising.
• Show ads, sell sponsored placement, or let brands pay to rank higher.
• Sell or share insights about you or about users in general with brands or shops.
• Store the content of your emails, or let anyone at Polytaste read them.
• Use data from your inbox to train AI models for other people.

8. Shopping links and commission

When we return a buy link, the shop may pay us a commission if you buy. Links are added after ranking is finished, by a separate system that receives only product identifiers and a request ID, never who you are or your taste. Commission never affects ranking. See How we stay neutral.

9. How long we keep data

10. Security

We encrypt data in transit and at rest, encrypt inbox-derived data with per-user keys held in a key management service, limit each part of our system to the data it needs, require hardware security keys for administrator accounts, and test these controls automatically on every change. No system is perfectly secure; if a breach affects your data, we will notify you as the law requires.

11. Your choices and rights

• See and download everything we hold about you, in a machine-readable file, from Settings.
• Correct anything in your profile or timeline directly in the app.
• Delete a single item, everything from one source (such as your inbox), or your whole account. Account deletion removes your data from our live systems immediately and from backups within 7 days.
• Revoke any AI assistant, or any category for an assistant, at any time.
• Unsubscribe from beta emails with the link in any email, or by writing to us.

Waitlist members and anyone without an account can make any of these requests by emailing privacy@polytaste.ai. We may need to confirm you control the email address before acting.

12. California privacy rights

If you live in California, the California Consumer Privacy Act (as amended by the CPRA) gives you these rights. Residents of other US states with similar laws have comparable rights, and we honour them in the same way.

• Right to know and access the categories and specific pieces of personal information we collect, the sources, our purposes, and who we disclose it to.
• Right to delete and right to correct your personal information.
• Right to opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the past 12 months. We honour Global Privacy Control signals.
• Right to limit use of sensitive personal information. The content of emails you let us read is sensitive personal information. We use it only to provide the service you asked for, as permitted by law, and not to infer characteristics for other purposes.
• Right not to be discriminated against for using these rights.

Categories we collect: identifiers (email, name, account ID); commercial information (products you bought or rated); inferences (your taste profile); sensitive personal information (email content, processed but not stored; date of birth, encrypted); internet activity (requests from AI assistants you connect). Sources: you, your inbox if you connect it, and assistants you connect. Purposes: those in section 4. Disclosures: to the service providers in section 5 and, at your direction, rankings to the assistants you connect.

To make a request, use the controls in Settings or email privacy@polytaste.ai. You may use an authorised agent; we will ask them for proof of authority and may ask you to confirm your identity. We respond within 45 days.

13. Age requirements

Polytaste is for people 18 and older. Wine and beer are available only to people 21 and older. We do not knowingly collect information from anyone under 18; if we learn that we have, we delete it. If you believe a minor has given us information, contact privacy@polytaste.ai.

14. Changes to this policy

We will post any change here with a new date. If we make a material change, we will tell you by email or in the app before it applies, and we will ask for your consent before using Google user data in a new way.

15. Contact us

Retail Native LLC, operator of Polytaste
Email: privacy@polytaste.ai