Privacy policy

Introduction

ShopLens needs no account and sends nothing until you scan. The rest of this page says exactly what is sent, what is kept, and for how long.

Information ShopLens collects

When you ask for a scan, ShopLens sends one picture and a few technical details, and keeps a short record of the scan. Here is exactly what that includes.

When you scan a paused video

The first time you scan, the extension asks for your agreement. After that, each time you click the ShopLens button:

1. The extension captures a single still image (a JPEG) of the paused video frame, in your browser.
2. It sends that image over an encrypted connection to our server at api.shoplens.fr. Sent with it: the address and title of the page the video is on, your browser’s time zone name (for example “Europe/Paris”), a one-time request number, and the installation identifier described below.
3. Our server passes the image to Mistral AI, the vision AI provider listed under Who else handles the data, together with the title of the page (for a YouTube video, its public details such as the title) and your country as context. It returns the products it can see.
4. Our servers do not store the image.
5. The image stays in your browser tab only while the results are on screen, so the panel can show a close-up of each product. It is dropped when you scan again, resume playback or leave the page. It is never written to disk.
6. If the first look finds nothing, the extension automatically takes one sharper image of the same paused frame and sends it for a second look. Each look counts as one scan.
7. If you open a product, a small cut-out of just that product may be sent for a closer look, along with the name and details the first look gave it. The full frame is not sent again.

The page address tells us which video site you are on and, for YouTube, lets us look up the video’s public details (see YouTube). The time zone tells us which country’s shops to show you. We do not keep a history of the pages you visit.

A frame can include people who appear in the video. ShopLens looks for products. It does not try to identify anyone.

What we keep about a scan

For each scan our database keeps a short technical record, so that we can measure accuracy, control costs and understand which kinds of products appear in videos:

• the date and time, the video site (for example “youtube”), the country inferred from your time zone, and the region (for example “Normandy”) that our network provider works out from your connection. Your IP address itself is not stored;
• for YouTube videos, the public video ID, title and channel;
• which AI model answered, how long it took and whether it worked;
• the products that were identified: name, brand, category, visible attributes and where they were in the frame.

The record does not contain the image, the page address, your name, your email or the installation identifier. It is not linked to an account, because there are none. We keep these records for as long as they help us follow how accurate ShopLens is over time; there is no fixed time limit today.

To avoid analysing the same frame twice, we also keep the list of products (not the image) for 24 hours under a mathematical fingerprint of the frame. A fingerprint cannot be turned back into the image.

To avoid running the same request twice, the answer to each scan is also kept for two to three days in a duplicate-request record, under the installation identifier and the request number. When the outcome of the AI call is unknown (for example, the connection broke while it ran), the record is kept for 90 days without the answer, so that the cost can be checked. During that time this record can connect a scan to the installation that made it. After that we hold no direct link between a scan record and an installation.

We do not record which shop links you open.

The installation identifier

To limit how many scans one installation can make per day, the extension creates an identifier the first time it runs, made of the time it was created and random characters. It looks like “u_mg2k4x9a_7hq2m5pw”.

• It is stored on your device, in the extension’s own storage, and sent with each scan.
• Our server uses it to count scans against the daily allowance, to avoid running the same request twice, and to keep costs and abuse in check.
• It appears only in technical records, and these are deleted automatically: the daily counters after two days, the duplicate-request records after two to three days (90 days when the outcome of the AI call is unknown), and the cost records (one line per AI call) after 90 days. If an installation reaches its daily limit, the first characters of its identifier are noted in a log and removed from it after 90 days.
• It is not tied to your name, your email or any account. We still treat it as personal data.
• Removing the extension deletes it from your device. Reinstalling creates a new one.

The email forms on this website

If you type your email address into a form on this site, we store:

• the email address;
• the country inferred from your browser’s time zone;
• which form you used, and when.

We use it to send you one email when ShopLens is available for your browser or, if you used the “more scans” form, to answer that request. We don’t use it for anything else, and we don’t share or sell it.

We rely on your consent for this. You can withdraw it at any time through the contact form, and we will delete your address. We delete these addresses within twelve months of launch at the latest.

To stop the forms being abused, our server also counts submissions per IP address per day. That count is not stored with your email address or message and is deleted after two days.

The contact form on this website

If you write to us through the contact form, we store:

• your email address, and your name if you type one;
• the subject you pick and your message;
• the country inferred from your browser’s time zone, and when you sent it.

We use it to answer you, and for nothing else. We keep the message and your address until the matter is settled, and for at most twelve months after the last exchange. We don’t share or sell it.

This website

This site sets no cookies. It has no analytics, no advertising or social media trackers and no third-party scripts, and its fonts are served from the site itself. Like every website, the servers that deliver these pages process your IP address and basic request details in order to send you the page and to protect against attacks.

The shop links in the demo are ordinary links. Nothing is sent to a shop unless you click one.

Why ShopLens uses data

Every use of data on this page rests on one of two grounds in the GDPR: your consent, or our legitimate interest in keeping a free service working.

• The scans you ask for (the picture and what is sent with it, and the answer): your consent, which the extension asks for before the first scan (GDPR Article 6(1)(a)). You can withdraw it at any time by removing the extension. Scans made before stay lawful.
• Scan records, duplicate-request records, daily counters, cost records and abuse checks: our legitimate interest in keeping a free service working, secure, within its budget and accurate (Article 6(1)(f)). None of them holds the image; the ones that carry the installation identifier are deleted automatically, as described above. You can object by writing to us.
• The email forms: your consent (Article 6(1)(a)), as described above.
• Messages you send us through the contact form, for example a question or a deletion request: to answer you (Article 6(1)(f)). We keep the message and your address until the matter is settled, and for at most twelve months after the last exchange.
• This website’s server logs: our legitimate interest in delivering the pages and protecting them against attacks (Article 6(1)(f)).

Your privacy controls

The extension asks for your agreement before the first picture is sent, lets you withdraw it, and keeps a few things on your device only.

Your agreement

The extension asks for your agreement before the first scan. You can withdraw it at any time by removing the extension. Scans made before stay lawful.

What you scan

Nothing is sent until you scan, and then only the picture described above.

What stays on your device

The extension also keeps a few things on your device only: your consent choice, a few counters and, if you press “Not right?” on a result, the name of that product and the time. None of these is sent to us.

Removing the extension removes everything it stored on your device.

Sharing your information

Data goes only to the providers that run ShopLens, to a shop when you click its link, or to an authority if the law requires it. We do not sell it. Shop links go straight to the shop.

Who else handles the data

Frames are analysed in the European Union. Under Mistral’s terms, requests are kept for up to 30 days to detect abuse and are then deleted, and we have switched off the option that would let Mistral use them to improve its models. On its way to our server a frame passes through Cloudflare’s network at the location nearest to you, which is outside the EU if you are. The only thing sent to Google is the public ID of a YouTube video, never a frame.

Only the image or product cut-out and the technical details listed above are sent, never an account, a name or a browsing history. Each provider handles the data under its own terms, and any transfer outside the EU relies on the safeguards in those terms, such as the European Commission’s standard contractual clauses.

Shop links

When you click a shop link you leave ShopLens. The shop’s own privacy policy applies from there.

Limited use of extension data

ShopLens’s use of the information it receives from the extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We apply the same rules to ShopLens for Firefox. In plain words:

• we use it only to find the products in the frame you scanned, to show you where to buy them, to keep that service working, secure and within its daily budget, and to measure and improve how well it identifies products;
• we do not sell it, and we pass it to nobody except the providers listed above, who handle it only to run ShopLens, or an authority if the law requires it;
• we do not use it or pass it on for advertising, and never to judge anyone’s creditworthiness or for lending;
• scan records hold no image and no identifier, and we read them to measure and improve accuracy. The technical records that carry the installation identifier are read only to investigate abuse or a fault, or if the law requires it.

YouTube

ShopLens uses YouTube API Services (the YouTube Data API v3) to read publicly available details of the video you are scanning, such as its title, channel, description and tags, and only to improve product identification. Using ShopLens on YouTube is also subject to the YouTube Terms of Service and the Google Privacy Policy.

Keeping your information secure

Everything travels over encrypted HTTPS connections.

Our server does not store the pictures you scan, and access to the database is restricted.

Deleting your information

Removing the extension removes everything on your device. For anything we hold, use the contact form.

In practice: if you left your email address, we can show you or delete your entry. Scan records do not carry your identifier, so we cannot pick out yours. The technical records that do carry it are deleted automatically as described above. Removing the extension removes everything it stored on your device.

Retaining your information

How long each kind of record is kept, in one table. Each period is also stated in the section it belongs to.

Your rights

Under the GDPR you can ask what we hold about you, and you can complain to the CNIL.

Under the GDPR you can ask to see the personal data we hold about you, have it corrected or deleted, restrict or object to its use, receive a copy of it, and withdraw your consent. Use the contact form.

You also have the right to complain to a data protection authority, for example the CNIL.

Children

ShopLens is not aimed at children. In France the age of digital consent is 15. If you are younger than that, please don’t leave your email address without a parent’s or guardian’s agreement.

About this policy

This policy covers the ShopLens browser extension and this website.

When this policy applies

It applies whenever you use the extension or visit www.shoplens.fr. It does not apply to the shops you reach through a link or to YouTube: each has its own privacy policy, as described under Sharing your information.

Changes to this policy

If this policy changes, we will update this page and the date at the top. Significant changes will also be announced in the extension.

Key terms

Short definitions of the words this page uses.

Frame

A single still image of the paused video, captured in your browser as a JPEG when you click the ShopLens button. ShopLens never receives the video itself: only this one image and, if needed, a sharper image or a product cut-out of the same frame.

Request number

A one-time number the extension attaches to each scan, so that the same request is not run twice.

Installation identifier

A code the extension creates the first time it runs, stored on your device and sent with each scan so that our server can count scans against the daily allowance. It looks like “u_mg2k4x9a_7hq2m5pw”. It is not tied to your name, your email or any account.

Scan record

The short technical record our database keeps for each scan: when it happened, which video site, the country and region, for YouTube the video’s public details, which AI model answered, and the products found. It contains neither the image nor the installation identifier.

Duplicate-request record

The answer to a scan, kept under the installation identifier and the request number so that the same request is not run twice. It deletes itself after two to three days (90 days, without the answer, when the outcome of the AI call is unknown).

Fingerprint

A mathematical summary of a frame, used to recognise the same frame for 24 hours without keeping the image. A fingerprint cannot be turned back into the image.

Provider

A company that handles data on ShopLens’s behalf to run the service. The providers are listed under Who else handles the data.

Controller

The GDPR’s word for whoever decides how personal data is used and is responsible for it. For the data described on this page, that is ShopLens.

Consent

Your agreement: asked for before the first scan, and given when you type your email address into a form on this site. You can withdraw it at any time; what was done before stays lawful.

Legitimate interest

A ground in the GDPR for the uses a free service needs in order to work, stay secure and within its budget, and to answer the people who write to us, as long as our interest does not override yours. You can object by writing to us.