Dupe.com Privacy Policy

Effective Date: August 28, 2026

1. Who we are and what this covers

Carrot Cart, Inc. d/b/a Dupe.com ("Dupe.com," "we," "us," or "our") operates an AI-assisted product search service that helps you find similar products at lower prices.

This Privacy Policy applies to all of the following, together the "Services":

• Our website at dupe.com
• Our browser extensions for Chrome and other Chromium browsers including Brave and Edge, for Firefox, and for Safari
• Our iOS application
• Our application for third-party AI assistants, including our ChatGPT application
• Our developer interfaces, including our public MCP server at mcp.dupe.com and our API

Your use of the Services is also governed by our Terms of Service.

2. Information we collect

Information you give us

• Account information. Your name, email address, and phone number when you create an account. If you sign in through a social or third-party login, we receive basic profile information from that provider.
• Profile and content. Your username, profile image, saved collections, bookmarks, notes, and anything you choose to make public.
• Search inputs. Text queries, product links you paste, and photos you upload or take.
• Communications. Records of your correspondence with us, including support requests and feedback.
• Marketing preferences. Your choices about receiving marketing, and your engagement with those messages.

Information we collect automatically

• Device and connection data. Operating system, device manufacturer and model, browser type, screen resolution, IP address, unique identifiers, language settings, and approximate location such as city, state or country derived from your IP address.
• Usage data. Pages and screens viewed, searches run, products viewed and clicked, time spent, navigation paths, access times, and engagement with our emails.
• Click and transaction data. When you click through to a retailer, we record the click and, where the retailer or affiliate network reports it back to us, whether a purchase followed and its value. We use this to be paid our commission and to reconcile it.

Information we receive from others

• Retailers, marketplaces and affiliate networks. Product data, and reports about clicks and completed transactions attributed to us.
• Third-party AI assistants. If you reach us through an assistant such as ChatGPT, we receive the query that assistant sends us. We do not receive your conversation with that assistant beyond what it sends, and its provider's privacy policy governs your use of it.

3. What the browser extension collects

Our browser extension needs permission to run on the websites you visit in order to do its job. When it is active on a page, it reads the page content, including product details and, on retailer sites that support it, the contents of your shopping cart, so that it can find comparable products and tell you whether the price is competitive.

The extension sends us the product and page information it needs to run that comparison, along with your device and usage data described above. You can remove the extension, or restrict the sites it runs on, through your browser's extension settings at any time.

4. How we use your information

• To run the Services. Answer your searches, generate results and comparisons, maintain your account, save your collections, and provide support.
• To improve the Services. Understand what works, fix problems, develop new features, and produce aggregated or de-identified statistics.
• To earn and reconcile commission. Attribute clicks and completed purchases to us so we are paid by retailers and affiliate networks.
• To communicate with you. Send service messages, and marketing messages you can opt out of.
• To keep the Services safe. Detect and prevent fraud, abuse of the points program, and other prohibited activity, and verify eligibility before we pay anything out.
• To meet legal obligations. Comply with the law, enforce our Terms, and protect our rights and the rights and safety of others.

5. AI processing

What we send, and to whom

When you use our search, chat, research or comparison features, your query is processed by large language models. What we send to those providers is limited to what is needed to generate a response: your text query, product links, uploaded images, and product information such as title, retailer, price and currency. We do not include your name, email address, phone number, or account identifiers in these requests.

Production inference is served through Microsoft Azure OpenAI Service, with Anthropic and Google as configured fallbacks. We also use Groq and OpenRouter to serve certain features, including parts of our shopping chat, the product comparison in our browser extension, and our research reports. Image generation and image processing features use fal.ai. In each case we contract on terms that exclude our data from model training.

Training

Your queries and inputs are not used by us, or by any AI provider we use, to train, pre-train, fine-tune, adapt or otherwise improve any AI model. We have not enrolled in any data-sharing or model-improvement program with any AI provider.

Product image processing

We process product images supplied by retailers and third-party sources using automated tools, including machine learning systems, to display them consistently. This is limited to presentation, such as removing or replacing a background and improving clarity, and does not involve your personal information.

6. How we share your information

• Service providers. Vendors who work on our behalf, including cloud hosting, databases, email delivery, payment processing, customer support, analytics and error monitoring. They may use your information only to provide services to us.
• AI providers. As described in section 5.
• Analytics and infrastructure providers. PostHog receives usage analytics and a non-identifiable user identifier. Tinybird receives usage analytics together with the account or device identifier we assign you. Plausible receives aggregate, cookieless website statistics. Datadog receives anonymized identifiers for performance monitoring. Sentry receives error and crash data with personal identifiers stripped. Inngest processes background tasks. Intercom powers our support chat and receives your messages to us and basic account details. IPinfo and GeoJS receive your IP address to determine approximate location.
• Retailers, affiliate networks and advertising partners. As described in section 7.
• Legal authorities. When required by law, or to protect the rights, property or safety of Dupe, our users, or others.
• Corporate transactions. In connection with a merger, financing, acquisition, or sale of assets.

We require third parties who receive user data to maintain security and data protection standards equivalent to or exceeding our own, to use the data only for the purposes for which it was shared, and to delete it when it is no longer needed.

7. Advertising, affiliate tracking and analytics

Dupe.com is free to use. We are paid by retailers and advertising partners, and that involves sharing some information about your activity.

• Affiliate networks. When you click through to a retailer, your click carries tracking parameters that identify Dupe as the source. The retailer and the affiliate network use these to attribute and pay commission, and they report clicks and completed transactions back to us. Our affiliate relationships include AvantLink, Awin, CJ Affiliate, eBay Partner Network, FlexOffers, ShareASale, and Rakuten Advertising. We use a third-party tool, Strackr, to add these tracking parameters to outbound links and to consolidate the reports we receive back.
• Cost-per-click advertising partners. We also participate in cost-per-click programs, including AdMarketplace, AdMedia, and Ad.net, in which brands pay us a fee for each click.
• Advertising and measurement partners. We use Meta (Facebook) advertising tools, Google Analytics and Google Ads to measure how our marketing performs and to reach people who may be interested in the Services. These partners receive information about your activity on the Services, such as pages and products viewed and actions taken, together with online identifiers such as cookie and device identifiers. We do not disclose your name, email address or phone number to advertising partners. Some of these tags are delivered through Cloudflare Zaraz, which sends the event from our servers rather than from your browser.
• Cookies and similar technologies. We and our partners use cookies, pixels and similar technologies to run the Services, measure performance, and understand how the Services are used. Most browsers accept cookies by default; you can change your browser settings to remove or reject them, though parts of the Services may not work as a result.

8. Points program

If you take part in our points program, we record the activity that earns points, your points balance, referrals you make, and redemptions you request. Before we pay anything out we may verify that your account and its activity are genuine, which can include reviewing the activity records associated with your account.

To redeem points for a gift card we share what the fulfilment provider needs to issue it, such as your email address. Redemption is available to users in the United States who are at least 18 years old.

9. Digital wallets

Some accounts have a blockchain wallet that was provisioned through a third-party custody provider in connection with an earlier feature. Where that applies to your account, we hold a wallet identifier and related metadata, and the custody provider holds the wallet itself under its own terms and privacy policy. We are not currently offering or promoting any digital asset. To ask about a wallet associated with your account, contact support@dupe.com.

10. How long we keep information

• Account and profile information. For as long as your account is open, and for a limited period afterwards.
• Operational logs. Approximately 15 days.
• Analytics events. Up to 180 days.
• Click and transaction records. For as long as needed to reconcile commission with retailers and affiliate networks, and to meet our tax and accounting obligations.
• Search queries and AI inputs. As described in section 5, and no longer than needed to provide and support the feature.

We may keep information longer where the law requires it, or where we need it to resolve a dispute or enforce our agreements.

11. Your rights and choices

• Access and correction. You can view and update your account information in your settings.
• Deletion. You can ask us to delete your account and the personal information associated with it by contacting support@dupe.com. Some information may be retained as described in section 10.
• Marketing. You can unsubscribe from marketing email using the link in any such message, or by contacting us.
• Cookies. You can manage cookies through your browser settings.
• The extension. You can remove it, or limit the sites it runs on, in your browser's extension settings.

12. State privacy rights

Depending on where you live, you may have the right to know what personal information we hold about you, to receive a copy of it, to correct it, to delete it, and to be free from discrimination for exercising these rights. To make a request, contact support@dupe.com. We will verify your request before acting on it, and you may use an authorized agent where the law allows.

California residents may also contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs by email at dca@dca.ca.gov, in writing at Department of Consumer Affairs, Consumer Information Division, 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210 or (800) 326-2297 (TDD).

13. Children and teens

The Services are not intended for anyone under 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we have, we will delete it.

If you are between 13 and 17, you may use the Services only with the involvement of a parent or legal guardian, who accepts our Terms on your behalf. You must be at least 18 to take part in the points program.

14. Security

We use reasonable administrative, technical and physical safeguards to protect personal information from unauthorized access, use or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15. Where your information is processed

We are based in the United States and your information is processed in the United States, including by the providers described in sections 5 and 6. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

16. Changes to this policy

We may update this policy. If we make material changes, we will update the Effective Date above and, where appropriate, give additional notice such as an email or a notice in the Services.

17. Contact us

For privacy questions, requests about your information, or anything else in this policy:

Carrot Cart, Inc. d/b/a Dupe.com
1270 Ave of the Americas, 7th Fl 1013 (At Rockefeller Center)
New York, NY 10020, United States

Privacy and support:  support@dupe.com
Legal:                legal@dupe.com
Phone:                (917) 909-4660