Privacy Policy

Effective September 24, 2026

theNasty (“we”) lets AI assistants such as ChatGPT and Claude search boat and vehicle parts, price quotes, and start orders on your behalf. This policy explains what we collect, why, who we share it with, how long we keep it, and how to reach us. It applies to our website, our MCP server, and the ChatGPT app and Claude connector built on it.

What we collect

Account details — your email address, display name, and a salted hash of your password. We never store your password itself.
Shipping address — so orders can be delivered.
Your garage — parts you have bought through us or told us you own, used to check fitment and avoid selling you duplicates.
Orders — your name, email address, and shipping address as entered at checkout; items, quantities, prices, taxes, shipping, refunds, order status and history; each package's carrier and tracking number; and Stripe payment references (session and payment IDs — never card numbers).
Emails we send you — a record of each order or shipping email (recipient, subject, time) and its delivery status reported by our email provider (delivered, delayed, bounced, or marked as spam). We use this to make sure order updates reach you; we don't track opens or clicks.
Support messages — what you send us when you email support, including return photos.
Tool requests — the arguments your AI assistant sends to our tools (for example a part search like “impeller for an Alpha One”). We do not receive your full conversation with the assistant — only what it passes to our tools.
Connection records — which assistant apps you have connected, and hashed access tokens that expire (access tokens after one hour, refresh tokens after 30 days).
Supplier applications — the business contact details a supplier submits on our Suppliers page.
Live demo chats — if you use the live demo on our website, the messages you type are sent to OpenAI to generate replies. We keep a hashed (not raw) IP address for rate limiting; we don't store the conversation.
Server logs — IP address, timestamps, and error details, kept for security and debugging.

We do not collect or see your payment card details — payment is entered on Stripe's hosted checkout page. We do not collect government IDs, health information, or precise location.

How we use it

To answer tool requests: search parts, check fitment, calculate quotes, and create orders.
To process payment (through Stripe), fulfil, ship, and support your orders — including emailing your confirmation, shipping and delivery updates, refunds, and replies to your questions.
To secure the service, prevent fraud, and fix problems.
To meet legal obligations such as tax and accounting records.

We do not sell your personal information, use it for advertising, or use it to train AI models.

Stripe — order totals and line items, to take payment. Stripe's own privacy policy covers the payment details you give them.
Suppliers — your name, the items, and the shipping address for an order, so they can ship it directly to you. Suppliers don't receive your email address or payment details.
Your AI assistant — tool results (part listings, quotes, order links) are returned to the assistant you connected, such as ChatGPT (OpenAI) or Claude (Anthropic). How they handle your conversation is governed by their privacy policies.
Service providers that process data on our behalf under contract:
- Stripe — payments, refunds, fraud screening, and sales-tax calculation.
- Resend — sends our transactional emails and reports whether they were delivered.
- Vercel — hosts the website and API, including server logs.
- Neon — our Postgres database, where accounts and orders are stored.
- OpenAI — powers the live demo chat on our website only (not orders you place through your own ChatGPT or Claude).
Legal — when required by law, or to protect the rights and safety of our users or others.

How long we keep it

Account, address, and garage data — until you delete your account.
Orders, including the name, email, and shipping address on them — up to 7 years, as required for tax and accounting.
Email delivery records — up to 2 years.
Access tokens — one hour; refresh tokens — 30 days, or until you disconnect the app.
Server logs — up to 90 days.

Your choices and rights

You can disconnect theNasty at any time from ChatGPT's or Claude's settings, which stops the assistant from calling our tools. You can ask us to access, correct, export, or delete your personal information by emailing privacy@thenasty.ai. We will respond within 30 days. Depending on where you live (for example California or the EU/UK) you may have additional rights, and you may complain to your local data protection authority.

Security

Traffic is encrypted with HTTPS. Passwords are hashed with scrypt; API keys, OAuth codes, and tokens are stored only as SHA-256 hashes. No system is perfectly secure, but we will notify you of a breach affecting your data as required by law.

Children

theNasty is not directed at children under 13, and we do not knowingly collect their information. Purchases require an adult.

Changes

If we change this policy we will update the effective date above, and notify you by email for material changes.

Contact

Questions about privacy: privacy@thenasty.ai.