Constructor AI Product Discovery and AI Shopping Agent

by Constructor

AI Application

Low Confidence

Constructor (Constructor.io Corporation, San Francisco, founded 2015) provides API-first, headless search and product discovery for enterprise ecommerce and B2B retailers, with customers such as Sephora, Under Armour, Petco, Gap and The Very Group shown on its site. A central 'Commerce Reasoning Engine' trained on clickstream behavior drives search and autosuggest, browse and category ranking, recommendations, collections, quizzes, retail media (sponsored listings) and offsite recommendations for email, SMS and in-store, with merchandiser controls, dashboards and A/B testing. Generative and agentic features include the AI Shopping Agent (a conversational assistant that answers shopper questions in natural language, builds carts, suggests substitutions and uses sentiment analysis to tailor responses), the Product Insights Agent (generated product Q&A), the Merchant Intelligence Agent (explains and fixes rankings), Attribute Enrichment (GenAI catalog attributes) and Answer Engine Assistants for ChatGPT-style answer engines (beta). The vendor states its models are 'glass box' with human override and that no PII is passed to LLMs, but does not name its LLM or hosting providers. Typical users are ecommerce, merchandising, digital product and retail media teams. Vendor-reported figures (400+ billion requests per year, 98.5% retention, Gartner, Forrester and IDC leader placements) are not independently verified here. Risk rationale: Rated medium. Under the EU AI Act this is not an Annex III high-risk use; it ranks and explains products. The AI Shopping Agent is a shopper-facing chatbot, so the deployer has Article 50 duties to disclose AI interaction and to manage generated product answers that may be wrong (for example on dimensions, ingredients or compatibility, which can create consumer-law exposure). Its text sentiment analysis is not biometric emotion recognition under the AI Act, but it should be disclosed in the deployer's privacy notice. Data is mostly pseudonymous behavioral data (anonymous IDs, truncated IPs, hashed identifiers per site), which lowers GDPR exposure compared with tools that store names and emails, and the vendor reports SOC 2 Type 2 and ISO 27001 audits, DPF certification and an EU Art. 27 representative. It is not rated limited because the LLM providers, hosting regions and sub-processor list are not public, all processing is by a US company with no EU establishment, the ToS allows aggregated and anonymized customer and visitor data to be used for cross-customer AI/ML training, and grocery and fashion use cases invite sensitive preferences (dietary needs, sizes, past purchases) into conversations. The rating would drop to limited once the DPA, sub-processor list and LLM data flows (with zero retention) are confirmed and certification scope and dates are shared. It would rise to high if the agent were used to steer credit, insurance or pricing decisions about individuals, or if health-related inputs (pharmacy, medical devices) were processed without safeguards.