Privacy Policy

Who is responsible for your data

Nation is a commerce platform: merchants create and run online stores on it, and AI agents build the storefront and help manage the catalog, orders, customers, marketing and support. Our role depends on whose data it is.

• Merchants and website visitors: for merchant account data, and for the data you submit on withnation.ai, Nation is the controller. This policy describes how we handle that data.
• Shoppers: for the data of people who buy from or contact a store on Nation, the merchant who runs that store is the controller, and Nation acts as a processor (service provider) that handles the data on the merchant’s behalf and on the merchant’s instructions. If you are a shopper, read the store’s own privacy policy and send requests about your data to the store. We help merchants answer those requests.

Data we collect

• Account data: your name and email address. You sign in with a one-time code sent to your email, handled by our authentication provider.
• Waitlist data: the email address and the note about what you make that you submit on withnation.ai.
• Store and organization data: your organization and stores and their settings.
• Catalog data: products, collections, inventory and locations.
• Orders: orders, checkouts and draft orders.
• Shopper data that stores collect: names, email addresses, phone numbers, shipping and billing addresses, order history, marketing consent, and support conversations in the store inbox and chat widget.
• Marketing and content: discounts, email templates and campaigns, blog posts, store policies, and the files and images you upload or generate.
• Storefront: storefront code, its versions and deployments.
• Agent chats and tool call records: your conversations with Nation’s agents and, for every tool call made by an agent or an AI assistant, the tool name, the input arguments, the status, any error message, the calling client (for example “ChatGPT”) and a timestamp.
• Connected integration credentials: the API keys and tokens for integrations you connect, encrypted with AES-256-GCM.
• Billing data: your plan and subscription status. Card details are collected and stored by Stripe; we never receive full card numbers.
• Usage and technical data: IP address, browser and device type, and error reports.

Using Nation in ChatGPT, Claude and other AI assistants

When you connect Nation to ChatGPT, Claude or another MCP client, you sign in to Nation through OAuth at app.withnation.ai/mcp-auth and choose one store the assistant may use. After that:

• Store key: Nation creates a dedicated secret API key for that store, named “<App> (MCP)” after the assistant you connected. The assistant reaches your store only through this key.
• Connector sign-in: the connector runs on Cloudflare. It stores the OAuth grant for your assistant so the assistant can call Nation. Access tokens expire after one hour.
• Tool inputs: the arguments the assistant sends to a Nation tool (for example a product ID, a search term, or the new price of a product) are sent to Nation, used to perform that request, and logged in the tool call record described above.
• Tool outputs: Nation performs the request and returns the result to the assistant. We do not store a separate copy of tool outputs. A change made by a write tool, such as a new product, is saved in your store like any other change. The assistant provider (for example OpenAI or Anthropic) handles the conversation and the tool results under its own privacy policy.
• Write actions: tools that create, update or delete things in your store change it only when the assistant calls them on your behalf. Each tool is marked as read-only or not, destructive or not, and open-world or not, so that the assistant can ask for your confirmation before running it.
• What we do not do: we do not send the inputs or outputs of tool calls made from an AI assistant to AI model providers, and we do not use them to train AI models.
• Disconnecting: revoke the “<App> (MCP)” key in Nation under Settings → Developer. The connection stops working immediately, and the assistant asks you to connect again if you use it later.

How we use data

• Provide the service: build and host your storefront, run checkout, and carry out the work you or Nation’s agents do in your store.
• Run Nation’s agents and generate content, such as product descriptions, emails, blog posts and images, using the AI model providers listed below.
• Authenticate you and manage access to your organization and stores.
• Process subscription payments through Stripe and, for your store’s sales, payments through Stripe Connect.
• Send transactional email, and send the store emails and campaigns that merchants create.
• Provide customer support, including reviewing tool call records to fix a problem you report.
• Monitor reliability, debug errors, and prevent abuse and fraud.
• Comply with legal obligations.

We do not sell personal data. We process shopper data only to provide the service to the merchant who runs the store.

Who receives data

We share data with service providers that process it on our behalf, for these purposes:

• Supabase: database, authentication and file storage.
• Vercel: hosting.
• Cloudflare: DNS, and hosting of the Nation connector for AI assistants and its OAuth sign-in.
• Upstash: job queues, cache and realtime updates.
• Stripe: subscriptions and invoicing, payments for merchants’ stores through Stripe Connect, and sales tax calculation through Stripe Tax.
• Resend: transactional email, and the emails and campaigns stores send to their customers.
• Sentry: error monitoring.
• OpenRouter, OpenAI and Google (Gemini): AI models that power Nation’s agents and content generation in the Nation app. They receive the content needed for the task, such as your messages and the store data an agent works with. Not used for tool calls made from ChatGPT, Claude or other assistants.
• E2B: isolated sandboxes that build storefronts; receive storefront code.
• Browserbase and Apify: web browsing and page collection for agent research; receive the pages and queries the agent looks up.
• Tavily: web search; receives search queries.
• DataForSEO: search data; receives the keywords and domains researched.
• Google Maps and Places: address and place lookups.
• Google Fonts: web fonts.
• remove.bg: removing image backgrounds; receives the image.
• Exchange-rate providers: currency exchange rates.

When you connect an integration, data needed for the actions you or Nation’s agents take is exchanged with that platform under its own terms. The integrations Nation supports are AliExpress, CJ Dropshipping, Printify, ShipBob, Shippo, Meta (ads) and Whop.

We may disclose data when required by law or valid legal process, or to a successor in a merger or acquisition, in which case this policy continues to apply.

Retention

• Account, store and content data: kept while your account is active and deleted when the store or account is deleted.
• Shopper data: kept for as long as the merchant’s store holds it, and deleted with the store or on the merchant’s instruction.
• Tool call records: kept with the store so we can provide support and investigate issues, and deleted with the store or on request.
• Tool outputs from AI assistants: not stored separately by Nation.
• AI assistant keys and grants: the “<App> (MCP)” key is kept until you revoke it. Connector access tokens expire after one hour, and once the key is revoked the grant can no longer reach your store.
• Connected integration credentials: kept until you disconnect the integration or the store is deleted.
• Billing records: kept as long as required for tax and accounting obligations.
• Logs and error reports: kept for the limited periods set by the providers listed above.

When you ask us to delete your personal data, we delete it within 30 days, except records we must keep by law.

Your controls and rights

• Disconnect an AI assistant at any time by revoking its “<App> (MCP)” key in Nation under Settings → Developer. You can also remove Nation in the assistant’s own settings.
• Disconnect an integration in Nation at any time.
• Access, correct, export or delete your personal data, or object to or restrict its processing, by emailing dk@withnation.ai with the subject “Privacy Request”. We respond within 30 days.
• Shoppers: send requests about your data to the store you bought from. The merchant decides how to answer, and we help them do it.
• Cookies: the Nation app uses cookies to keep you signed in. You can block cookies in your browser, but signing in may stop working.

Security

Data is encrypted in transit with TLS. Integration credentials are encrypted at rest with AES-256-GCM. Each AI assistant connection uses its own key for one store, which you can revoke at any time. Card details stay with Stripe. Access to production systems is limited to staff who need it. No method of protection is perfect; if a breach affects your personal data, we will notify you without undue delay.

International transfers

Nation is based in the United States, and our service providers may process data in the United States and other countries. By using Nation you understand that your data may be processed outside your country of residence.

Children

Nation is a service for merchants who are 18 or older, and the Nation website and app are not directed to children. We do not knowingly collect personal data from children through them, and we delete it if we learn we have.

Changes

We update this policy when our data practices change. The date at the top shows the current version, and we will email account owners before a material change takes effect.

Contact us

Autonomous Marketing SF, Inc. (Nation). Email dk@withnation.ai. For help with your account or store, see Support.