Privacy policy

Last updated October 17, 2026. This policy explains what Mandate records when you authorize an agent to shop for you, and what happens to that record. Mandate is a demo that runs in the PayPal sandbox: no real money moves and every store in it is fictional.

What we collect

A demo session. A signed cookie that keeps your mandates private to your browser. There are no accounts, so we do not ask for your name or email.
Mandates. The instructions you write, the terms you sign, the time you signed, any changes you approve, and a fingerprint of the signed record.
Checks. Each cart your agent submits, the result for every term, and when the check ran.
Order references. The PayPal order and transaction IDs, amount, store and order status for purchases made under a mandate.
A PayPal payment reference. When you link PayPal to a mandate, PayPal gives us a token that lets your agent pay inside that mandate. It is stored on our server only and deleted when you revoke the mandate.

We never receive your card or bank details. Payment happens inside PayPal.

How we use it

To stop a purchase before payment when it falls outside your mandate.
To give you receipts and a history of what your agent did.
To let a merchant answer a dispute with the records for that order.
To keep the service secure and to limit abuse of the demo.

You, for every mandate and check made in your session.
The merchant of an order, for the mandate and check attached to that order only, with your identity masked.
PayPal, which processes your payment under its own privacy statement.
Anthropic, which runs the model that reads your instructions to draft the terms and helps the shopping agent and the merchant. It receives the text needed for each request.
Render, which hosts the app and its database.

We do not sell your personal information or share it for targeted advertising.

How long we keep it

We keep mandates, checks and order references for 90 days after a mandate expires or is revoked, so the record is available if a dispute is opened. After that we delete it.

Your choices and rights

Revoke any mandate at any time. Your agent stops immediately.
Download the receipt for any mandate.
Clear the cookie for this site to start a new, empty session.
Ask us to delete the records of a mandate by giving its code (for example MDT4K7Q21).

Depending on the state you live in, you may have additional rights under state privacy laws. We will not treat you differently for using them. Mandate is not intended for anyone under 18.

Security

Signed mandates are fingerprinted so any later change is detectable. Connections use HTTPS, and API keys stay on our server. No method is perfect, and we will notify you of a breach as the law requires.

Contact

Open an issue on the Mandate repository with the mandate code. Do not post personal details there; we will reply with a private way to continue.

If we change this policy in a way that matters, we will say so on this page before the change applies.