On October 10, 2026, Elon Musk proposed a Grok shopping flow in which users upload a photo of a credit card and ask the chatbot to find a deal and order the item. Musk’s post described that idea. In a separate post that day, he said Grok had bought LEGO from LEGO’s website. Musk’s LEGO post
Musk’s proposed shopping flow
The proposal combines product search with checkout: Grok would look for a deal and place an order after the user uploaded a card photo. Musk’s separate LEGO post attributed a purchase to Grok.
What xAI’s consumer privacy policy says
SpaceXSI’s consumer Privacy Policy advises users not to include personal information in prompts or other inputs. It treats images as user content and says that content may be used to provide, analyze, maintain, develop, and improve services, as well as for research.
The policy says deleted conversations or account data are deleted within 30 days, subject to legal, compliance, or safety exceptions. Its terms apply to xAI’s websites and apps; use of Grok through X is governed by X’s privacy policy and terms. The consumer policy also excludes data processed for business offerings.
Grok Bot’s separate payment controls
Grok Bot has its own terms and security guidance. Its terms describe a persistent cloud environment where customer data, browser sessions, credentials, memory, and routines may be retained across a user’s Bots. They require appropriate human review before permitting financial transactions and warn that approval controls may not prevent every unintended action or reverse completed ones.
Grok Bot’s payment guidance says users should take control of the computer to complete payment confirmations. These controls are specific to Grok Bot.
A Reddit commenter suggested asking an AI to find a deal and then buying directly from the retailer. Separating search from checkout avoids submitting a card photo to the chat, while leaving payment with the retailer.
