Privacy Policy

We collect information you provide directly, such as name, email address, shipping address, and payment information when you create an account or place an order. We also automatically collect usage data including IP address, browser type, pages visited, and device information to improve our service. Shopping companion chat. When you use the shopping companion, the messages you type and its replies are processed to answer you. To continue the conversation, we keep the most recent messages (up to 10), together with the last product search made in the chat and the conversation's language, on our servers for 24 hours after your last message; this happens only while your browser has a chat session. To generate replies, your recent messages (up to the last 6, plus the new one) and the product search results used to answer are sent to our AI model provider, Anthropic (Claude API), which processes them on our behalf. A copy of the conversation (up to 40 messages) is also kept in your own browser for 7 days so it stays available as you move between pages; clearing your browser's site data removes it. Unlock requests. When you pay a service fee, that unlock request is linked to your account — including one an AI agent started for you — and it stays linked even if the payment does not go through. What is linked includes the item and its price, the delivery destination, and information about the AI agent or app that sent the request.

We use cookies and similar technologies for the purposes below. • Essential — needed for the site to work, so they are set without asking: your cookie choice (consent_status and consent_meta, kept for one year); signing in (two security cookies from our sign-in system, __Host-next-auth.csrf-token and __Secure-next-auth.callback-url, set when a page loads and expiring when you close your browser, and a session cookie when you sign in, kept for 30 days from your last visit); funnel_session (30 minutes), which keeps your shopping conversation going — your language, what you are looking for, and limits that protect the service from abuse; and, on the step where you enter your card, cookies set by Stripe, our payment processor, to detect fraud (on our site, __stripe_mid, kept for one year, and __stripe_sid, kept for 30 minutes; on Stripe's own domain, m.stripe.com, a cookie named m, set for two years, though your browser may keep it for less). • Preferences — remembering your language and currency (cookies user-locale and user-currency, kept for one year). They are set on your first visit and do not depend on your choice in the cookie banner. The country estimate described under ipapi.co in Section 3 is kept in your browser's storage. • Analytics — Google Analytics (_ga cookies), and our own statistics about how visitors move through the shopping flow: the funnel_session identifier with the product, country and language (linked to your account while you are signed in), and, when you use the AI helper on a product card, what you tell it about your purpose, budget and situation, under a second identifier kept in your browser's storage (mogan_session_id, with a copy of those events in mogan_funnel_events), and, when you use our AI search, the first 100 characters of what you typed and a short summary of the AI's result, under the same funnel_session identifier. These are non-essential: they are used only after you accept them via our cookie consent banner, and choosing "Reject Non-essential" keeps them off. Changing your choice: select "Cookie settings" at the bottom of the page to reopen the cookie consent banner. If you choose "Reject Non-essential" after having accepted, your withdrawal takes effect immediately: analytics collection stops, analytics events created in the last few seconds that are still in your browser are discarded, and the analytics cookies (_ga) are deleted, as are mogan_session_id and mogan_funnel_events in your browser's storage. Withdrawing does not delete data already sent to Google Analytics or to our own statistics before you changed your choice. Your analytics ID from before you withdrew is kept only in this browser (in mogan_consent_history, which records your consent choices and is not sent to us) and is shown when you open Cookie settings again — quote it if you ask us at privacy@mogan.ai to delete that data; we respond within one month. You can also clear or block cookies in your browser settings, though this may affect functionality.

We use trusted third-party services to operate our platform: • Stripe — Payment processing for our service fee. Your card details are handled directly by Stripe and never stored on our servers. When the card form is shown, Stripe also collects device and activity signals on that page to detect fraud. • Stripe Identity — Identity verification before you unlock (photo of your ID and a selfie). Stripe processes the images; mogan never receives them. Each time you pay, Stripe returns the verification result to mogan: the details printed on your ID (such as your name, address and issuing country, but not the ID number or date of birth). mogan uses only your verified name and issuing country, to screen against sanctions lists and comply with U.S. sanctions law, and does not store the result; our security logs keep only a one-way code derived from the name. • Amazon Web Services (AWS) — Cloud hosting and database infrastructure for the platform. • Cloudflare, Inc. — Network security and delivery for our API for AI agents (acp-mogan.com). Requests to that address and our responses pass through Cloudflare's network on their way between the sender and our servers, including the sender's IP address and the content of both — for example, names and addresses submitted for sanctions screening or delivery estimates, and the screening results. • Google Analytics — Site analytics, loaded only after you consent via the cookie banner. • ipapi.co — If you have no saved language or currency preference, your IP address is sent to ipapi.co to estimate your country so we can suggest a default language and currency. This happens once per browser, and again only if your browser's site data is cleared or blocked. The result is stored only in your browser and is not linked to your account. ipapi.co privacy policy: https://ipapi.co/privacy/ • Anthropic, PBC — AI shopping companion replies — messages you type in the companion chat, recent messages from the same conversation, and the product search results used to answer. Each third-party provider has its own privacy policy governing their use of your data. When you purchase from a seller, the seller (and any forwarder you choose) processes your order and delivery data under their own policies.

We use your information to: process and fulfill orders; send order confirmations and shipping updates; provide customer support; improve our AI shopping assistant; send promotional emails (with your consent); comply with legal obligations; and prevent fraud and abuse.

We retain your personal data for as long as necessary to provide our services and comply with legal obligations. Order records are kept for 7 years for accounting purposes. You may request deletion of your account at any time, subject to these retention requirements.

Depending on your location, you may have the right to: access your personal data; correct inaccurate data; request deletion of your data; object to processing; data portability; and withdraw consent. To exercise any of these rights, contact us at privacy@mogan.ai — we respond within the timeframe required by applicable law. EU / EEA / UK residents (GDPR / UK GDPR): The data controller is Mogan Solutions Corp. Our legal bases for processing are performance of your contract (processing and fulfilling orders), your consent (marketing emails and non-essential analytics cookies), our legitimate interests (fraud prevention and securing and improving the service), and compliance with legal obligations (such as accounting retention). You also have the right to lodge a complaint with your local data protection supervisory authority. California residents (CCPA / CPRA): You have the right to know what personal information we collect and how it is used; to access, delete, and correct it; to opt out of the sale or sharing of personal information; and to non-discrimination for exercising these rights. MOGAN·AI does not sell your personal information and does not share it for cross-context behavioral advertising; analytics load only with your consent (see Section 2). To exercise your California rights, contact privacy@mogan.ai.

We implement industry-standard security measures including encryption in transit (TLS) and at rest, access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure.

MOGAN·AI operates across Japan, Taiwan, and globally. Your data may be processed in countries other than your own. We ensure appropriate safeguards are in place for cross-border data transfers.

For privacy-related questions or to exercise your rights, contact us at: Email: privacy@mogan.ai Mogan Solutions Corp. 1187 N Willow Ave, Clovis, CA 93611, USA

To complete customs clearance for a cross-border parcel, we collect your government-issued identification number (for example, a national ID or passport number) together with a statement of purpose, at the point where customs authorities request supplementary documents. This information is used solely for that customs procedure and is not used to infer characteristics about you. You enter it yourself — our AI never fills it in on your behalf. It is encrypted at rest using AES-256-GCM. We keep this information only while a customs procedure can still use it, and delete it from your account afterwards; a later checkout that needs it will ask you again.