Privacy Policy

Effective September 23, 2026

theNasty (“we”) lets AI assistants such as ChatGPT and Claude search boat and vehicle parts, price quotes, and start orders on your behalf. This policy explains what we collect, why, who we share it with, how long we keep it, and how to reach us. It applies to our website, our MCP server, and the ChatGPT app and Claude connector built on it.

What we collect

Account details — your email address, display name, and a salted hash of your password. We never store your password itself.
Shipping address — so orders can be delivered.
Your garage — parts you have bought through us or told us you own, used to check fitment and avoid selling you duplicates.
Orders — items, quantities, prices, taxes, shipping, order status, and the Stripe session ID.
Tool requests — the arguments your AI assistant sends to our tools (for example a part search like “impeller for an Alpha One”). We do not receive your full conversation with the assistant — only what it passes to our tools.
Connection records — which assistant apps you have connected, and hashed access tokens that expire (access tokens after one hour, refresh tokens after 30 days).
Supplier applications — the business contact details a supplier submits on our Suppliers page.
Server logs — IP address, timestamps, and error details, kept for security and debugging.

We do not collect or see your payment card details — payment is entered on Stripe's hosted checkout page. We do not collect government IDs, health information, or precise location.

How we use it

To answer tool requests: search parts, check fitment, calculate quotes, and create orders.
To process payment (through Stripe), fulfil, ship, and support your orders.
To secure the service, prevent fraud, and fix problems.
To meet legal obligations such as tax and accounting records.

We do not sell your personal information, use it for advertising, or use it to train AI models.

Stripe — order totals and line items, to take payment. Stripe's own privacy policy covers the payment details you give them.
Suppliers — your name, the items, and the shipping address for an order, so they can ship it directly to you.
Your AI assistant — tool results (part listings, quotes, order links) are returned to the assistant you connected, such as ChatGPT (OpenAI) or Claude (Anthropic). How they handle your conversation is governed by their privacy policies.
Infrastructure providers — our hosting, database, and email providers process data on our behalf under contract.
Legal — when required by law, or to protect the rights and safety of our users or others.

How long we keep it

Account, address, and garage data — until you delete your account.
Orders — up to 7 years, as required for tax and accounting.
Access tokens — one hour; refresh tokens — 30 days, or until you disconnect the app.
Server logs — up to 90 days.

Your choices and rights

You can disconnect theNasty at any time from ChatGPT's or Claude's settings, which stops the assistant from calling our tools. You can ask us to access, correct, export, or delete your personal information by emailing privacy@thenasty.ai. We will respond within 30 days. Depending on where you live (for example California or the EU/UK) you may have additional rights, and you may complain to your local data protection authority.

Security

Traffic is encrypted with HTTPS. Passwords are hashed with scrypt; API keys, OAuth codes, and tokens are stored only as SHA-256 hashes. No system is perfectly secure, but we will notify you of a breach affecting your data as required by law.

Children

theNasty is not directed at children under 13, and we do not knowingly collect their information. Purchases require an adult.

Changes

If we change this policy we will update the effective date above, and notify you by email for material changes.

Contact

Questions about privacy: privacy@thenasty.ai.