Privacy Policy.
California data requirements.
How Alloy AI Labs LLC handles information for AlloyAI Master Jeweler and JewelAgent, including California data disclosures and privacy rights under CCPA as amended by CPRA.
01 Who & what this covers
Alloy AI Labs LLC operates online and licenses AlloyAI/JewelAgent software to businesses. This notice covers this information website, information submitted by authorized business users, and information handled through an authorized eBay seller connection.
The current service is a restricted business pilot. JewelAgent retains business records and access controls; AlloyAI Master Jeweler provides jewelry assistance in ChatGPT. The documented eBay capability prepares unpublished offers. This policy does not represent future order imports, live publication, or additional data collection as already operating.
A business licensing the software may direct how its own employee, seller, and business records are handled. Its notice and applicable agreement also govern that relationship. This policy does not transfer the licensed business’s responsibilities to Alloy AI Labs LLC or replace its notice.
Other services you use directly, including eBay and ChatGPT, have their own privacy notices and account controls. Clicking a link to another service does not make this policy govern that service.
02 Information & purposes
The categories below describe information handled in the documented current service. The specific information depends on your role, what you submit, and the eBay permissions you authorize.
API data minimization requirement
The requirement for eBay API workflows is to avoid requesting personal details and discard any unexpected personal details before they enter business records, AI inputs, logs, exports, or backups. This control must be verified before that workflow is enabled. Receiving information temporarily is different from retaining it; this is not a claim that the system never handles personal information.
Personal payment-card, banking, and buyer financial-account details are not needed for this workflow. Jewelry values and item prices serve the jewelry task; a price linked to a person can still be personal information. Protected seller authorization credentials are separately needed to maintain the authorized connection, as disclosed below.
| Category / examples | Source | Purpose |
|---|---|---|
| Identifiers and contact information Name, email, display name, employee/account identifiers, and authorized eBay seller identifiers | You, your business administrator, authentication services, and eBay | Identify authorized users, manage access and connections, and respond to requests |
| Commercial and workflow records Jewelry identifiers, measurements, item evidence, prices, drafts, eBay SKU/offer mappings, and review history | Authorized employees and permitted eBay API responses | Organize jewelry work, retain evidence and versions, prepare approved drafts, and reconcile actions |
| Photos and submitted content Item photographs, marks, notes, and material supplied for jewelry assistance | You and authorized business users | Support item identification, employee review, and listing preparation |
| Internet, device, and security information Request metadata such as IP address, browser information, timestamps, access events, and security/audit records | Service requests, hosting providers, and application activity | Deliver the site, secure accounts and records, diagnose errors, and prevent abuse or duplicate actions |
| Professional and account-access information Employee role, assignments, attributable actions, and protected seller authorization tokens | Business administrators, service actions, and seller-authorized eBay consent | Apply role permissions, attribute decisions, and perform permitted connected-service operations |
| Privacy correspondence Contact details, request description, and information needed to verify or resolve a request | You or your authorized agent | Handle privacy questions and exercise applicable rights |
Some business records become personal information when linked to an identifiable person. Jewelry analyses concern the item and are advisory; they do not constitute physical verification or authority to make a consequential decision.
We do not ask for your eBay password. You sign in directly with eBay, which issues authorization tokens. Account credentials and tokens are used to provide and secure the authorized service, rather than to infer personal characteristics.
03 Disclosures & eBay
Information may be disclosed for the stated service purposes to these categories of recipients:
- Authorized business personnel: records are accessible according to role, ownership, and assignment; not every employee can access every record.
- Hosting, storage, and security providers: the website is prepared for Netlify hosting; the current JewelAgent service uses Cloudflare-hosted structured records and protected item files. Providers process information needed for their services.
- Connected services: user-submitted content is handled through ChatGPT when you use AlloyAI there. Approved item content and photos are sent to eBay when an authorized person confirms the supported draft action. Each service also processes information under its own applicable terms and privacy notice.
- Privacy and legal handling: information necessary to verify requests, meet a legal obligation, or protect lawful rights may be disclosed to relevant service providers, advisers, or authorities.
Authorizing an eBay connection grants only the permissions shown in eBay’s consent flow. It does not authorize unrelated data use. Access tokens and application secrets are not published in website files or business recovery exports.
You can withdraw the application's access through eBay’s account controls and request disconnection through your business administrator. The documented service removes stored seller tokens when the connection is disconnected or replaced; disconnecting does not automatically erase every business record.
When eBay sends an account-deletion notification, its requirements call for irreversible deletion of all data associated with the specified eBay user, except data retained to meet specific, demonstrable legal requirements. This obligation is separate from a California privacy request and does not depend on the licensing business approving a request. The notification endpoint is an operational backend requirement; this public notice is not that endpoint.
Related platform requirements: eBay API license and data protection terms and eBay marketplace account deletion.
04 Retention & security
Retention is determined by the record’s authorized purpose: whether an account or connection is active; whether a jewelry workflow or evidence record is still needed; necessary security, audit, or recovery requirements; and applicable legal obligations or claims. Protected item files are retained for the approved business purpose. Seller-token retention ends on disconnection or replacement as described above.
A deletion request is reviewed against applicable rights and lawful exceptions. Records retained under an exception remain subject to access restrictions. Disconnection, account access revocation, and deletion of business records are distinct actions.
Any retained non-personal material remains subject to its source license, permitted purpose, and contractual restrictions. Removing a name or other direct identifier does not by itself make a record anonymous or authorize unrestricted reuse of eBay content.
The current system uses authentication, role-based access, protected media storage, and encrypted stored eBay tokens. Secrets and tokens are excluded from recovery exports. These controls reduce risk; no service can guarantee absolute security.
Please do not send passwords, full payment-card details, or unnecessary sensitive information in jewelry photos or privacy emails.
05 Sale, sharing & tracking
Alloy AI Labs LLC does not sell personal information or share personal information for cross-context behavioral advertising. Disclosures necessary to provide the service are described above and are distinct from advertising-related sharing.
This information website includes no advertising pixels, analytics scripts, embedded third-party media, or site-created cookies. Its image and stylesheet are served locally with the page. Hosting providers may process technical request information for delivery and security.
This website does not conduct cross-site behavioral tracking. Browser Do Not Track settings do not change its behavior. Global Privacy Control communicates a sale/sharing opt-out preference; there is no sale or cross-context advertising sharing on this site to disable. Neither statement limits any right you have under applicable law.
We do not use sensitive account information to infer characteristics about you. Its purpose is to provide and protect authorized account access. The services are intended for business users, not children.
06 California privacy rights
California residents have the following rights where the CCPA, as amended by CPRA, applies, subject to the law’s verification requirements and exceptions:
- Know and access: request the personal information held about you and information about its categories, sources, purposes, and disclosures.
- Delete: request deletion of covered personal information, subject to lawful exceptions.
- Correct: request correction of inaccurate personal information.
- Opt out of sale or sharing: direct a covered business to stop sale or cross-context advertising sharing. Alloy AI Labs LLC does neither.
- Limit sensitive-information use: exercise the applicable right where sensitive personal information is used beyond permitted purposes.
- Non-discrimination: exercise applicable privacy rights without unlawful discrimination or retaliation.
CCPA coverage depends on the business’s actual circumstances; publishing this notice does not determine that coverage. We accept privacy questions and requests through the contact below regardless of whether you describe them as a statutory request.
Official rights information: California Privacy Protection Agency and California Attorney General.
07 Submit a request
Email data@alloyai.net with the subject “Privacy Request”. Tell us the right you want to exercise and enough information to locate the relevant account or record. You do not need to create a new account to submit a request.
If your request concerns records handled on behalf of a business that licenses the software, that business may be responsible for deciding the request. You may contact that business directly or email us for help identifying the appropriate contact. Records Alloy AI Labs LLC handles for its own purposes remain subject to its applicable responsibilities.
We may ask for information reasonably necessary to verify your identity and the request. Verification information is used for that purpose. An authorized agent may submit a request; we may require evidence of authorization and, where permitted, your direct confirmation.
For covered requests to know, delete, or correct, applicable California rules generally require acknowledgment within 10 business days and a response within 45 calendar days. If a permitted extension is needed, you must be notified with the reason. Different deadlines may apply to other rights.
If a request cannot be fulfilled in whole or in part because of verification limits or an applicable exception, the response should explain the outcome. Privacy requests do not require payment merely to exercise applicable rights.
Email a privacy requestRequest rules: Current CCPA regulations, §§7020–7021 and 7060–7063.
08 Updates & contact
Revisions are published on this page with an updated date. Material changes are identified with the revised notice. Where applicable law requires additional notice or consent before a new use or collection, that requirement applies independently of publishing a revision.
Operator: Alloy AI Labs LLC
Privacy contact: data@alloyai.net
Last updated: October 9, 2026
This notice describes the documented current service and operator-confirmed information practices. A new feature or service that changes data collection, disclosure, or permitted use requires corresponding notice and operational review.