Privacy Policy.

What AI Would Buy (“the Site”, “we”, “our”) is an independent research preview operated under the project name “What AI Would Buy”. For all privacy-related requests, including access, deletion or objection requests under GDPR, UK GDPR, or CCPA / CPRA, contact us at legal@whataiwouldbuy.com. We respond to verified requests within 30 days.

The Site is read-only and has no user accounts. We process two narrow data sets:

• Search queries. When you use the on-site search, your query is sent to our backend to retrieve matching brands, products, categories or intents. Queries are not retained beyond standard server logs.
• Analytics. Page-view events are recorded via Google Analytics 4 (provider: Google LLC / Google Ireland Ltd). The default GA4 cookie set (_ga, _ga_*) stores a randomised client identifier; we do not pass IP addresses, names or contact details to Google.

We do not collect information about your race, ethnicity, political views, health, sexual orientation or any other special-category data under GDPR Art. 9.

Where the General Data Protection Regulation or UK Data Protection Act 2018 applies, we rely on the following legal bases:

• Legitimate interest (Art. 6(1)(f)) — to operate the Site, keep it secure, and retain short-lived server logs for abuse prevention. This basis does NOT cover analytics cookies (see below). You can object at any time using the contact below.
• Consent (Art. 6(1)(a)) — for Google Analytics 4 cookies. We set them only after you click Accept in the consent banner that appears on your first visit; closing the banner declines, and analytics never load. You can revoke at any time via the Cookie preferences link in the footer; the choice is stored in a first-party cookie for 13 months and we will re-prompt only when the disclosure materially changes.

The Site uses two narrow categories of cookies:

• Strictly necessary. One cookie, waib_consent, stores your choice from the consent banner — first-party, host-only (no Domain attribute), SameSite=Lax, Path=/, 13-month lifetime. It contains a small JSON value of the form {"analytics": true|false, "version": 1, "decidedAt": "<ISO timestamp>"} and nothing else (no identifier, no IP, no fingerprint). It is set without consent because it carries the consent decision itself — ePrivacy Art. 5(3) treats this category as exempt from the prior-consent requirement. You can clear it at any time by clearing your browser cookies for this site; the banner will reappear on your next visit.
• Analytics (optional, off by default). Google Analytics 4 sets _ga and _ga_QSM5D6V6W8 with a 13-month lifetime — anonymous traffic stats only, no contact details, no IP forwarding. These are set only after you opt in via the consent banner on your first visit. To change your choice at any time — including revoking after an initial Accept — use the Cookie preferences link in the footer. Revoking instructs Google Analytics to stop recording new events via the Consent Mode v2 signal (analytics_storage: denied); the cookies already on your device remain until you clear them in your browser (we have no API to delete cookies the browser set under Google’s host-only scope).

Aggregated analytics are processed by Google LLC under a Data Processing Addendum that includes the EU Standard Contractual Clauses (2021 modules) and the UK International Data Transfer Addendum. We do not sell or rent personal information to third parties, and we do not share data with advertisers, brokers, or affiliate networks.

Server logs are retained for up to 30 days for security and abuse-prevention purposes. Aggregated GA4 reports are retained for the GA4 default retention window of 14 months and are not used to build behavioural profiles.

Depending on where you live, you may have the right to access, correct, delete, restrict or port the personal data we hold about you, to object to processing, and to withdraw consent at any time. EU/UK residents may lodge a complaint with their supervisory authority (e.g. CNIL, ICO, Garante).

California residents (CCPA / CPRA): you have the right to know what personal information we collect, to request deletion, to opt out of any “sale” or “sharing” of personal information, and to be free from discrimination for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA.

To exercise any of these rights, write to legal@whataiwouldbuy.com. We respond to verified requests within 30 days.

The Site is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe we have, contact us and we will delete it.

We may update this Policy as the Site evolves. The “Last updated” date at the top reflects the most recent material change.

Privacy questions or rights requests: legal@whataiwouldbuy.com.