Last updated: 4 October 2026
In short:
- Zack billiger is a free product search for AliExpress in ChatGPT. You do not need an account with us.
- For a search, ChatGPT sends us the search term, filters, delivery country and currency, or product numbers. It also sends a user ID that OpenAI describes as anonymised, and your approximate country. We do not receive your name, your email address or your chat history.
- We pass the search on to AliExpress (Singapore) and, via OpenRouter (USA), to AI models that prepare it and sort out unsuitable offers.
- We keep some data for a short time, for example operating data with the search phrases for 48 hours and the prepared search for seven days. We do not store your user ID or IP addresses with it.
- The product links are affiliate links. What happens when you click and buy is AliExpress's responsibility.
- The website sets no cookies and uses no analytics or advertising services.
This privacy policy covers the website zack-billiger.com and the search service at mcp.zack-billiger.com that ChatGPT calls for Zack billiger. It contains the information required by Articles 13 and 14 GDPR.
1. Controller
The controller responsible for data processing is:
Elias Friderici
Zack Software
c/o Online-Impressum.de #4680
Europaring 90
53757 Sankt Augustin
Germany
Email: hello@zack-ki.com
Zack Software is run as a sole proprietorship. No data protection officer has been appointed. You can send data protection requests directly to this email address.
2. Visiting the website and access logs
When you open a page, our server processes your device's IP address to establish the connection and deliver the page. The IP address is not written to the access logs. The same applies when ChatGPT calls the search service (section 4).
Categories of data: IP address, only for the connection. In the access logs: time, requested host name, request method, protocol, status code, size and duration of the response, and the remaining technical request headers, such as information about the program used (user agent) and language settings. IP address, requested address including path, referrer and cookies are not logged.
Purpose: delivering the website, troubleshooting and protection against disruptions and attacks.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website and the search service.
Recipients: netcup GmbH, Germany, as provider of the server infrastructure. A data processing agreement has been concluded with netcup.
Retention: The IP address is processed only for the duration of the connection. Access logs are written to files of at most 10 MB. When a file is full, it is replaced by a new one and deleted no later than seven days after that.
The domains zack-billiger.com and mcp.zack-billiger.com are managed at Cloudflare for name resolution (DNS) only. Page views and search requests do not pass through Cloudflare.
The website does not load fonts, scripts or other content from third-party servers and uses no analytics or advertising services.
3. Storage in your browser
The website sets no cookies. In your browser's local storage (localStorage) it creates only these entries:
| Entry | Content | Purpose | Retention |
|---|---|---|---|
zk-lang | language of the last page viewed (de or en) | keep the language for the next visit | until changed or until browser storage is cleared |
zk-theme | chosen colour scheme (light or dark; the entry is removed for "automatic") | keep the chosen colour scheme | until changed or until browser storage is cleared |
The entries do not leave your device. You can delete them at any time in your browser settings.
Legal basis: Section 25(2) no. 2 TDDDG, because the entries are strictly necessary for the website functions you use. Insofar as personal data is processed, this is based on Art. 6(1)(f) GDPR.
4. Searching with Zack billiger in ChatGPT
When you ask ChatGPT for products and ChatGPT uses Zack billiger, ChatGPT calls our search service at mcp.zack-billiger.com. The calls come from OpenAI's servers, not directly from your device. ChatGPT decides which information from your chat it uses for this.
Search information:
- the search term (up to 120 characters) as worded by ChatGPT,
- filters: sort order, price limits, number of results and, where applicable, words that must appear in the product title,
- delivery country and currency, where ChatGPT provides them,
- for a details request, the product numbers and whether all images and videos should be returned.
Accompanying information from ChatGPT: ChatGPT sends accompanying technical information with every call. We use only two items of it:
- User ID (
openai/subject): OpenAI describes it as an anonymised user ID; we cannot link it to a person. We use it solely to limit the number of searches per user. For this, the search service counts searches in memory. The counter applies only to the current minute and is discarded with the next minute. While a search is running, the search service also keeps the ID in memory to limit simultaneous searches per user. The ID is not stored, not logged and not passed on. - Approximate country (
openai/userLocation): If ChatGPT does not provide a delivery country, we use the country from this location hint as the delivery country and choose the currency accordingly. The country is sent to AliExpress as the delivery country and appears in the result. We do not use the city, region, time zone or coordinates from the hint. If there is no hint, we search for Germany.
The remaining accompanying information, such as language settings or information about the program used, reaches our server as part of the request but is neither evaluated nor stored.
Technical connection information:
- The IP address a call comes from usually belongs to an OpenAI server. The search service uses it to limit the number of all requests per address and minute. It also keeps the address in memory for the duration of the connection so that it can limit searches per address instead if ChatGPT does not send a user ID.
- For each connection, the search service assigns a random session ID. It stays in memory until the connection ends or has been unused for 15 minutes, and also appears as a technical header in the access logs (section 2).
Please do not include information about yourself or other people in search requests; it is not needed for the search.
Purpose: finding matching products, providing product details, creating product links and protecting the service against overload and abuse.
Legal basis: Art. 6(1)(b) GDPR for carrying out the search you requested under the terms of use, including determining the delivery country and currency; Art. 6(1)(f) GDPR for limiting requests. Our legitimate interest is running the free service in a stable and abuse-resistant way.
5. How a search is processed
Our search service processes a search in several steps. Apart from the queries to AliExpress and the model calls via OpenRouter, all steps run on our server.
- Preparation: The search term is sent via OpenRouter to an AI model, currently a model from OpenAI. It describes the requested product in English and creates up to three English search phrases. We store the result for seven days so that the same search does not have to be prepared again. The entry contains the English description and the search phrases, but no user ID, IP address or other information about you.
- Query to AliExpress: Using the search phrases, our server queries the AliExpress affiliate interface, together with delivery country, currency, sort order, page number, price limits and our partner ID. If preparation fails, we use the search term itself. For a details request, the product numbers are sent to AliExpress. The requests are made by our server; AliExpress receives neither your user ID nor any IP address of yours.
- Product database: We store the product information supplied by AliExpress, for example title, price, images, ratings and shop, in a product database. We add matching products from earlier lookups to the results of a search. The information is deleted seven days after the last lookup; a daily backup copy contains it for one day longer. The product database contains no search requests and no information about you.
- Screening: The search term, the English description and the titles of the offers found are sent via OpenRouter to the AI model Jev from TypeSafe, which sorts out unsuitable offers. We store the result for each offer until 90 days after it was last used. The entry is filed under a checksum and contains neither the search term nor the description in plain text.
- Product links: For the selected products, our server creates affiliate links with our partner ID via the AliExpress affiliate interface. We store the links for 30 days per product so that they do not have to be created every time; if no link could be created, we remember this for one day. The links contain no information about you.
- Answer: The results are returned to ChatGPT, for example with title, price, image, rating, number of sales, delivery country, time of the price information and link, and for a details request additionally with shop, category and further images, for example.
Legal basis: Art. 6(1)(b) GDPR for carrying out the search; Art. 6(1)(f) GDPR for caching the preparation, screening results, product information and links. Our legitimate interest is answering searches quickly and at a sustainable cost.
6. Operating data
For each search, the search service stores operating data in order to find errors, monitor performance and limit costs: the function called, the outcome (for example results, no results, error or cancellation), duration, number of results, delivery country and currency, error reasons, number and cost of model and interface calls, and the search phrases sent to AliExpress with page number and number of results. The operating data contains no user ID or IP address.
Retention: 48 hours; if the data volume is large, the oldest entries are deleted earlier. Counts derived from it, without search content, are deleted after seven days, and the daily cost totals one day later. A more detailed diagnostic log of the search service is switched off in operation.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the stable, low-error and affordable operation of the service.
7. Retention at a glance
| Data | Location | Duration |
|---|---|---|
| search term, filters and accompanying information from ChatGPT | memory of the search service | duration of the request |
| counter per user ID | memory of the search service | current minute or duration of the running search |
| IP address of the calling server and session ID | memory of the search service | duration of the connection, at most until 15 minutes after its last use |
| access logs without IP address and without requested address | server | until the file reaches 10 MB, then at most seven days |
| prepared search (English description and search phrases) | search service | seven days |
| screening result per offer | search service | until 90 days after last use |
| operating data with the search phrases sent to AliExpress | search service | 48 hours |
| counts without search content | search service | seven days, daily cost totals one day longer |
| product information from AliExpress | product database | seven days after the last lookup, backup copy one day longer |
| affiliate links per product | server | 30 days, without a link one day |
zk-lang and zk-theme | your browser | until changed or deleted |
| emails to us | mailbox | until dealt with, beyond that only under statutory obligations |
8. Recipients
| Recipient | Task | Data |
|---|---|---|
| netcup GmbH, Germany | server infrastructure for website and search service; data processing agreement concluded | all data processed on our servers |
| OpenRouter, Inc., USA | forwarding requests to AI models | search term, English description, offer titles |
| the respective model provider, currently OpenAI (preparation) and TypeSafe (screening with the Jev model) | preparing the search and screening the offers | search term, English description, offer titles |
| AliExpress (Alibaba.com Singapore E-Commerce Private Limited, Singapore) | product information and affiliate links via the affiliate interface | search phrases, filters, delivery country, currency, product numbers and product addresses, our partner ID |
The models used may change. The privacy notices of OpenRouter and the model providers also apply (OpenRouter). We make no statement as to whether and for how long these providers store transmitted data.
AliExpress processes the information it receives via the affiliate interface as an independent controller under its privacy policy.
9. Transfers to third countries
OpenRouter and the model providers may process data outside the European Union and the European Economic Area, in particular in the USA. Where a provider is certified under an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, the transfer is based primarily on that decision. Otherwise, it is based on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR, which form part of the respective usage agreements.
AliExpress is based in Singapore. There is no adequacy decision for Singapore. The search information transmitted to AliExpress contains no user ID, no IP address and no other information that we could link to you. If a search request nevertheless contains personal information in an individual case, the transfer takes place under Art. 49(1)(b) GDPR, because it is necessary for the search you requested.
10. Product links and commission
The product links in the results are usually affiliate links of the AliExpress affiliate programme. They contain our partner ID but no ID of yours. If you click such a link, AliExpress opens. AliExpress records that you came via our link and may use cookies or similar technologies for this. This takes place under AliExpress's responsibility and its privacy policy.
To settle commissions, AliExpress provides us with reports on referred orders, for example with product, order value and time. We do not receive buyers' names, addresses or contact details; we cannot identify you from these reports. We use the reports for settlement and accounting and keep them where tax retention obligations apply (Art. 6(1)(c) and (f) GDPR).
11. ChatGPT and AliExpress
OpenAI processes your chat with ChatGPT, including the results from Zack billiger, under its own responsibility in accordance with OpenAI's privacy policy. OpenAI also decides which information ChatGPT sends to us. Purchase, payment and shipping take place exclusively via AliExpress under its responsibility. We have no influence on this processing.
12. Contact by email
If you write to us at hello@zack-ki.com, we process your email address, the content of your message and the technical information of the email to deal with your request. Please only send us the information needed.
Legal basis: Art. 6(1)(b) GDPR for questions about using Zack billiger, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering enquiries.
Recipients: the provider of our email mailbox.
Retention: as long as handling the request and, where applicable, statutory obligations or legal defence require.
13. Source of the data
We do not receive the search information directly from you but from OpenAI: ChatGPT derives the search term and filters from your chat and sends them together with the accompanying information described in section 4. Product information and commission reports come from AliExpress.
14. Obligation to provide data and automated decisions
You are under no statutory or contractual obligation to provide data. Without a search term or product number, however, Zack billiger cannot search.
We do not create profiles and do not make automated decisions within the meaning of Art. 22 GDPR. The AI models assess offers, not you.
15. Your rights
Subject to the legal requirements, you have the following rights:
- access to information about the processing of your personal data (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR).
A message to hello@zack-ki.com is sufficient.
We do not store search requests together with a user ID, an IP address or other information about you. We are therefore usually unable to attribute stored entries to you. In that case, the rights under Articles 15 to 20 GDPR apply only if you provide additional information that makes attribution possible (Art. 11(2) GDPR).
16. Right to lodge a complaint
Under Art. 77 GDPR you may lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
17. Changes
We update this privacy policy when functions, service providers or legal requirements change. The version published on this website applies.