Terms of use

What CartRelay does

CartRelay has two authenticated agent entry points: hosted MCP and REST fallback. Agents discover current source products, inspect exact variants, query offers and create expiring signed intents. The consumer website builds briefs, helps connect agents and provides narrow human consent to an agent-issued intent. It does not offer parallel direct browser catalog discovery, variant selection or manual cart creation.

CartRelay is not a merchant of record, payment service, inventory reservation, universal retailer cart or on-site LLM. Original homepage illustrations are shopping-intent inspiration, not retail products, live offers or product claims. Availability depends on source configuration and eligible merchants, not complete Canadian coverage. Unknown facts, source failures, empty results and rate limits can occur.

Human review authorizes handoff, not purchase

Open the agent-issued review link in its originating shopper browser. Tokens are independently signed, short-lived and session-owned. The review page cannot search, add new references, change variants or quantities, or create another cart. Ask your agent to revise the intent and send a fresh link if anything needs changing.

Review the exact variants, quantities, actual currencies and unknown facts. The explicit checkbox authorizes retailer handoff only, not a purchase. The server records an opaque human approval hash and rechecks current source facts. An agent asserting approval is not human consent. Changed merchant, link or variant fingerprints, missing offers or unknown current selections require renewed review and withhold all retailer action links.

Only permitted source-returned HTTPS retailer destinations may be released. A link may open one item only and may not set your requested quantity; quantity support defaults to unknown. Confirm the final variant, quantity, currency, price, stock, taxes, shipping and eligibility at the retailer. Each retailer handles payment, fulfillment, delivery, returns and order support. No purchase or inventory reservation occurs in CartRelay, and a cross-retailer intent is not one checkout.

Preserve returned currencies; do not relabel non-CAD prices or invent conversions. Inferred descriptions are not verified evidence. Verify important ingredients, claims, certifications and suitability with the retailer or manufacturer.

Delegated keys and trusted clients

Choose a trusted agent client and keep keys and review tokens private. Delegated keys are short-lived guest-scoped credentials, not operator access. Revoke unused keys in the docs. Copying a brief does not connect or authorize an assistant. Browser cookies do not authorize MCP or REST commerce.

Use the actual endpoint and documented transport supported by both your client and the service. Consumer platform features and permissions vary; unverified compatibility or approval is not promised. Agents must respect explicit shopper intent and human review, not automate purchases or bypass consent.

Permitted source-data use

Use authenticated discovery for a current shopper need, not unattended harvesting. Do not bulk export, persist a copied catalog, mirror source images, retain provider response bodies, invent facts, bypass ownership/rate controls or misuse credentials. Follow source no-cache rules, preserve retailer attribution and never synthesize merchant cart URLs or affiliate parameters.

Third-party content remains subject to its owners' rights and source terms. A CartRelay key or expiring intent does not grant ownership, resale rights or permission to republish a catalog. Commission tracking is not enabled.

Service changes and support

Access can be limited for misuse, security, expiry or source unavailability. The proposed v1 documentation and current service schemas describe the interface; no unavailable historical-version compatibility is promised. Specific uptime, coverage or support-response deadlines are not guaranteed. Nothing removes rights that applicable law does not permit us to exclude.

Use support for service questions and privacy requests for data or notification-copy help. App-database cleanup does not delete copies delivered to owner inboxes or Manus notification systems; those follow separate retention policies described in the privacy notice. Do not send secrets or payment details. Contact the retailer for an order it accepted.