Privacy & GDPR
Your data stays yours. And in Europe.
You run your store on this data. We treat it accordingly: EU hosting, strong encryption, no AI training, and rights you can actually exercise.
Hosted in the EU
Database, file storage and authentication run in Frankfurt. Your data lives under European law, by default.
GDPR rights, honored
Access, rectification, erasure, restriction, portability and objection (art. 15 to 22). Ask, and it happens.
No AI training on your data
Your emails, customers and orders are never used to train AI models, and never sold. Full stop.
First-party analytics
The tracking pixel is first-party: your visitors' data flows to your workspace, not to an ad network's cookie pool.
A bounded email window
Connecting a mailbox backfills 90 days, then syncs forward. Disconnecting stops the sync and revokes the tokens.
Security & isolation
Locked down below the application
Security choices you can verify, not adjectives.
AES-256-GCM at rest
OAuth tokens and integration credentials are sealed with envelope encryption and per-workspace keys.
Isolation at the database level
Every workspace's rows are separated by row-level security in Postgres, not by application code alone.
One immutable audit log
Campaign changes, AI tool calls, dispute submissions and refunds each write one append-only row.
Sub-processors
The short list of companies that touch your data on our behalf, and why.
| Provider | Region & basis | Purpose |
|---|---|---|
| Supabase | EU (Frankfurt) | Database, storage, authentication |
| Vercel | EU edge, SCCs | Application hosting |
| Google LLC | US, under SCCs | Gmail connectivity for the helpdesk |
| Microsoft | EU/US, under SCCs | Outlook connectivity for the helpdesk |
| Shopify | CA/US, under SCCs | Store data via your Admin API app |
Privacy questions
In the European Union. Postgres, file storage and auth run in Frankfurt. Some sub-processors (Google, Microsoft, Shopify) operate outside the EU under Standard Contractual Clauses.
The fine print, in full:
Questions your DPO will ask? Bring them.
Book a demo and walk through the data flows with us, integration by integration.