Product Terms

Last updated: May 2026

These Product Terms (the "Terms") govern your access to and use of the XTAL Search platform (the "Service") provided by Prompt Engineering, Inc ("XTAL," "we," or "us"). They are separate from our Website Terms, which govern xtalsearch.com. By accessing the Service, signing an order form referencing the Service, or installing the XTAL SDK on a digital property, the entity you represent ("Customer" or "Merchant") agrees to these Terms.

1. Definitions

To make data-handling commitments precise, the Service distinguishes four classes of data:

• Merchant Data means data Customer or its agents provide to the Service, including product catalog content (titles, descriptions, prices, images, SKUs, taxonomy, inventory state), brand and merchandising configuration, account information, and administrator credentials.
• Shopper Data means data generated by end-shoppers interacting with Customer's digital properties through the Service, including search queries, clicks, add-to-cart events, conversion events, pseudonymous session identifiers, referrer URLs, and coarse geolocation derived from IP. Shopper Data is pseudonymous, not anonymous.
• Service Data means operational logs and telemetry of XTAL's own systems, including request latency, error rates, cache hit ratios, billing events, and security audit trails.
• Aggregated Data means data derived from Merchant Data, Shopper Data, or Service Data that has been de-identified and aggregated such that it cannot reasonably be used to identify any merchant, end-shopper, individual, or specific catalog item.

2. Ownership

As between the parties, Customer retains all right, title, and interest in and to Merchant Data and Shopper Data. XTAL retains all right, title, and interest in and to the Service, Service Data, and Aggregated Data. No rights are granted to either party except those expressly set out in these Terms.

3. License to XTAL

Customer grants XTAL a worldwide, non-exclusive, royalty-free license to access, store, process, transmit, and create derivative works of Merchant Data and Shopper Data solely to:

• operate, maintain, and provide the Service to Customer;
• generate Aggregated Data as defined in Section 1;
• monitor for security incidents, abuse, fraud, and Service availability;
• comply with applicable law, regulation, court order, or governmental request.

No other use of Merchant Data or Shopper Data is permitted under these Terms.

4. Cross-Tenant Prohibition

No Merchant Data or Shopper Data attributable to a single Customer will be shared with, displayed to, or used to directly serve any other XTAL customer or its end-shoppers. Catalog content, raw search queries, and click and conversion events remain logically partitioned per Customer at all times. This commitment is not subject to the Aggregated Data carve-out in Section 5.

5. Aggregated Data and Service Improvement

XTAL may use Aggregated Data to improve and develop the Service, including for the specific purposes below. Aggregated Data does not directly or indirectly identify any merchant, end-shopper, or specific catalog item.

• Tuning generic pipeline configurations, including query enhancement prompts, marketing re-rank prompts, color re-rank logic, synonym dictionaries, and typo-correction tables.
• Improving relevance, ranking, and freshness models applied across Customers, including the training of XTAL's own machine learning models on Aggregated Data.
• Improving catalog description quality and enrichment models, including learning from the alignment between shopper queries and the products shoppers select to inform how product descriptions can be rewritten to match shopper language. Insights derived from this analysis inform XTAL's description enrichment pipelines applied across Customers; raw catalog text attributable to a single Customer is not reproduced for any other Customer.
• Industry benchmarks and trend research in which no individual Customer or end-shopper is identifiable.
• Marketing collateral, case studies, and product analyses in which no individual Customer or end-shopper is identifiable, except where Customer has consented in writing to be named.

Re-combination. If XTAL combines Aggregated Data with personal information, the combined data set will be treated as personal information for as long as it remains so combined.

6. Shopper Data and End-Shopper Privacy

With respect to Shopper Data, XTAL acts as a processor (or service provider) on behalf of Customer. Customer acts as the controller (or business) and is responsible for providing all notices, obtaining all consents, and otherwise complying with applicable privacy laws (including GDPR, UK GDPR, CCPA/CPRA, and other state privacy laws) with respect to its end-shoppers.

Customer must not submit, and must not configure the Service to collect:

• payment card numbers or financial account credentials;
• protected health information subject to HIPAA;
• government-issued identification numbers;
• information of children under 13 (or applicable equivalent age).

XTAL pseudonymizes session identifiers and does not store end-shopper email addresses except where Customer has connected an email service provider (such as Klaviyo) for the purpose of click-to-order attribution, in which case email addresses are matched transiently against click events and not retained beyond what is required to compute attribution.

7. Subprocessors and Upstream LLM Providers

The Service relies on third-party subprocessors to deliver core functionality, including large language model ("LLM") providers. The current LLM subprocessors and the capabilities each supports are:

• OpenAI — query enhancement, intent classification, aspect extraction, and certain re-ranking steps. XTAL accesses OpenAI through its commercial API. Per OpenAI's API data-usage policy effective March 1, 2023, data submitted via the API is not used by OpenAI to train or improve OpenAI's models unless XTAL explicitly opts in. XTAL does not opt in.
• Anthropic — natural-language explanations of search results and reasoning over product context. XTAL accesses Anthropic under its Commercial Terms, which prohibit Anthropic from training models on Customer Content submitted through the API.
• Groq — low-latency aspect generation and fast reasoning paths. XTAL accesses Groq under terms that prohibit use of submitted content for model training.

Prompts and contexts sent to these subprocessors necessarily include portions of Merchant Data (such as product titles and descriptions) and Shopper Data (such as the shopper's search query) required to fulfill the request. XTAL contractually requires each LLM subprocessor to (a) refrain from training on submitted content, and (b) honor short or zero retention windows for inputs and outputs as offered by the provider's commercial tier.

XTAL also relies on infrastructure subprocessors including Amazon Web Services, Vercel, Upstash, and Qdrant for compute, hosting, caching, and vector storage. XTAL will provide notice of material changes to its subprocessor list. A current list is available on request to legal@xtalsearch.com.

8. Retention and Deletion

• Billing usage events are retained for ninety (90) days in the active billing log, then deleted.
• Merchant Data (catalog content, brand and merchandising configuration, and account information) is removed from active production systems within sixty (60) days of termination upon Customer's written request, except where legal hold applies. Catalog content already incorporated prior to termination into Aggregated Data — including embeddings, training corpora, and learned model weights used to improve description enrichment and search-to-product matching across Customers — is retained under the Aggregated Data bullet below.
• Shopper Data, including search queries, clicks, and conversion events, is retained in pseudonymized form during and after the subscription term to support security and abuse monitoring, continued operation of the Service, and the generation of Aggregated Data described in Section 5. Pseudonymized Shopper Data does not include end-shopper email addresses or other directly identifying information.
• Service Data (operational telemetry of XTAL's systems) is retained at XTAL's discretion.
• Aggregated Data is retained indefinitely. Once de-identified and merged with data of other Customers, Aggregated Data can no longer be associated with any individual Customer and is not reversed by termination.

9. Customer Obligations

• Customer will use the Service only for lawful purposes and only with content Customer has the right to submit.
• Customer will obtain all necessary consents and provide all necessary disclosures to its end-shoppers.
• Customer will not use the Service to build or train a competing product, to reverse-engineer XTAL's models, or to evade rate limits, billing, or audit controls. Production traffic must not be tagged with the is_demo flag.
• Customer is responsible for the security of API keys issued to it and for actions taken by users with access to its administrator console.

10. Service Availability and Support

XTAL will use commercially reasonable efforts to make the Service available and to respond to support requests during business hours. Specific service level commitments, credits, and remedies, where offered, are set out in the applicable order form or service level agreement.

11. Warranty Disclaimer

The Service is provided "as is" and "as available." To the maximum extent permitted by law, XTAL disclaims all warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, non-infringement, and any warranty arising out of course of dealing or usage of trade. XTAL does not warrant that the Service will be uninterrupted, error-free, or that results obtained through the Service (including search rankings or LLM-generated outputs) will be accurate, complete, or commercially advantageous.

12. Limitation of Liability

To the fullest extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, or goodwill, arising out of or related to these Terms or the Service. Each party's aggregate liability arising out of or related to these Terms will not exceed the fees paid or payable by Customer to XTAL in the twelve (12) months immediately preceding the event giving rise to liability.

13. Indemnification

Customer will defend, indemnify, and hold harmless XTAL from and against third-party claims arising from (a) Merchant Data or Shopper Data, (b) Customer's breach of Section 6 (Shopper Data and End-Shopper Privacy) or Section 9 (Customer Obligations), and (c) Customer's violation of applicable law in connection with its use of the Service.

14. Term and Termination

These Terms apply for so long as Customer accesses or uses the Service. Either party may terminate for material breach upon thirty (30) days' written notice if the breach is not cured within that period. Sections 2 (Ownership), 4 (Cross-Tenant Prohibition), 5 (Aggregated Data, with respect to Aggregated Data already created), 8 (Retention and Deletion), 11 (Warranty Disclaimer), 12 (Limitation of Liability), 13 (Indemnification), and 16 (Governing Law) survive termination.

15. Changes to These Terms

XTAL may update these Terms from time to time. For material changes that reduce Customer's rights or expand XTAL's data-use rights, XTAL will provide at least thirty (30) days' notice by email to Customer's administrator contact before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the revised Terms.

16. Governing Law

These Terms are governed by the laws of the State of Delaware, United States, without regard to its conflict of law provisions. The parties consent to the exclusive jurisdiction of the state and federal courts located in Delaware for any dispute arising out of or related to these Terms that is not subject to arbitration.

17. Contact

Questions about these Terms, subprocessor lists, or data handling can be directed to legal@xtalsearch.com. Privacy-specific requests, including end-shopper data deletion requests routed through Customer, should be sent to privacy@xtalsearch.com.