Privacy Policy

This Privacy Policy describes how StoreWiz collects, uses, discloses, and protects Personal Data when you visit our websites, sign up for an account, or use the StoreWiz platform.

StoreWiz is operated by Night Labs Private Limited, a company established in India ("Night Labs", "StoreWiz", "we", "us"). Where this policy refers to StoreWiz as the party responsible for your data, the responsible legal entity is Night Labs.

StoreWiz is an autonomous AI platform that runs e-commerce stores on behalf of merchants. The platform reads merchants' connected store data, makes automated proposals (and, where the merchant grants autonomy, executes them), and is supervised by the merchant. This Privacy Policy reflects the end-state of the platform; sections marked "available from [Module N+]" disclose features that will be live at the noted milestone.

We aim to write this policy in plain English. Where legal terms are required for accuracy, we define them on first use.

---

1. Who we are and how to contact us

¹ Our DPO contact will be staffed by a named individual (or external DPO firm) prior to general availability. Until then, requests to dpo@storewiz.ai are answered by the same team that handles privacy@storewiz.ai.

If you are in the European Economic Area, the United Kingdom, or Switzerland and would prefer to use a local representative, see §16 (Regional Supplements) for jurisdiction-specific contacts. These contacts will be staffed prior to general availability.

---

2. The two roles StoreWiz plays

StoreWiz handles two distinct categories of data, and our role differs for each:

a) Account data. StoreWiz is the Data Controller. When you create a StoreWiz account, give us your name and work email, configure your Pillars and OKRs, or use our marketing website, StoreWiz decides why and how that data is processed. For account data, you have the rights described in §11.

b) Tenant Store Data. StoreWiz is the Data Processor. When you connect Shopify, Klaviyo, Meta Ads, Google Ads, Plaid, Zendesk/Intercom, or other systems to StoreWiz, you authorize us to read (and sometimes write) data from those systems on your behalf. That data may include your own customers' Personal Data. For Tenant Store Data, you are the Controller and StoreWiz is the Processor. The terms governing that relationship are in our Data Processing Addendum (the "DPA"), which is incorporated by reference into your subscription agreement.

If a conflict exists between this Privacy Policy and the DPA in respect of Tenant Store Data, the DPA prevails.

---

3. Personal Data we collect

We collect different categories of Personal Data depending on whether you are a (i) prospective or signed-up merchant ("Account Data"), (ii) a person who interacts with our marketing site, or (iii) a customer of a merchant whose store is run by StoreWiz ("Merchant-Customer Data", which we process as a Processor on behalf of our merchant tenant).

3.a. Account Data (we are the Controller)

3.b. Marketing-site visitor data (we are the Controller)

See the Cookies Policy for the full list of cookies we use and how to control them.

3.c. Merchant-Customer Data (we are the Processor; merchant is the Controller)

When you connect your store(s) and ad/email/support systems to StoreWiz, we ingest the following on your behalf:

We process Merchant-Customer Data only on the documented instructions of the merchant tenant (see DPA §3). The merchant, not StoreWiz, chooses what data to share, what autonomy to grant agents, and how long to retain it (subject to the limits in §8).

3.d. Data from the platforms you connect (permissions we request, and what we do with them)

This section lists, platform by platform, what StoreWiz asks each platform to let it do when you connect your own account. You choose whether to connect each one, you see the platform's own consent screen with the exact permissions before you agree, and you can disconnect at any time. Connections are being opened to sellers in stages. Where a row says "planned", the connection is not yet open to sellers: we list it so you can see what we intend to ask for, and we will not request those permissions before this policy says so.

Google user data (Limited Use disclosure). The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. StoreWiz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms, for everything we receive from Google:

• We use it only to provide or improve the features you can see in StoreWiz.
• We do not transfer it to others, except to provide those features with your consent, for security (for example investigating abuse), to comply with law, or as part of a merger or sale of assets after you have given explicit consent.
• We do not sell it, use it for advertising (including retargeting or interest-based advertising), or use it to judge credit-worthiness or for lending.
• We never use it to develop, improve or train generalized AI or machine-learning models, and it is excluded from any cross-store learning (see §6.4). The only AI use is preparing results for you, within your own workspace.
• No person at StoreWiz reads your Gmail messages unless you have given affirmative agreement to a specific message, it is necessary for security (for example investigating abuse), it is necessary to comply with law, or the data is aggregated and used only for internal operations.

Rules that apply to every connected platform.

• Your control. Shopify: you can disconnect in StoreWiz or uninstall the app in Shopify. Google, Meta and Gmail: in-app Disconnect is coming shortly. Until then you can remove StoreWiz's access yourself in your Google account permissions or your Meta business integrations settings, or email privacy@storewiz.ai and we will delete the stored access token. To have other stored data from a platform deleted, follow storewiz.ai/data-deletion or write to privacy@storewiz.ai.
• Tokens. Access tokens are encrypted before they are stored (see §10) and are not written to our logs.
• Least access. We ask only for the permissions in the table, and only for the features you turn on. If we need a new permission we will update this section first.
• Approval. StoreWiz prepares each action as a Proposal. Nothing is posted, sent, changed or spent on a connected platform until you approve it, except where you have set an autonomy level that allows it (see §5).
• No sale, no ads, no training. We do not sell data we receive from a platform and we do not use it for advertising. We do not use it to train AI models (see §6.1). Data from Google APIs is excluded from cross-store learning (see §6.4).
• AI processing. To prepare a Proposal, the text of a message or record may be sent to our AI provider under the retention terms in §6.3.

---

4. Why we collect Personal Data (purposes and lawful basis)

We do not process Special Category Data (Article 9) as part of normal operations and do not knowingly process Personal Data of children (see §12).

---

5. How automated decisions are made (Article 22 GDPR. Important)

This section is load-bearing. Please read it carefully.

5.1 What StoreWiz does autonomously

StoreWiz includes Wizzy and a set of specialist agents. These agents:

• Read data from your connected systems;
• Generate Proposals, which are typed payloads recommending specific actions on your store (e.g., "reorder 240 units of SKU X by Friday", "send this email sequence to this segment", "reduce CPC bid on this campaign by 12%");
• Execute approved Proposals against the relevant third-party systems, but only where you have explicitly granted that level of autonomy for that skill and that tenant.

These are automated decisions within the meaning of Article 22 GDPR, Quebec Law 25 Article 12.1, and similar provisions.

5.2 Your control over autonomy (the three tiers)

For every skill (e.g., Inventory, Ad Operations, Campaign), you choose one of three autonomy tiers:

You can change a skill's autonomy tier at any time from the StoreWiz Admin Console (not yet available). Changing a skill from Auto-approve to a lower tier takes effect immediately for new Proposals.

5.3 Your right to opt out of automated decisions

You have the right at any time to:

• Require human review for any individual Proposal, even on an Auto-approve skill. Simply reject and rework.
• Set a skill back to Proposal-only. Degraded UX, full agency preserved.
• Disable automated decision-making entirely for your tenant. Agents will continue to read data and prepare Proposals, but nothing will be queued for execution. Your platform usefulness will be substantially reduced; you remain fully in control.
• Express your view, contest a decision, and request human re-review of any executed Auto-approve action. We will provide written reasoning and reverse or compensate where the action is determined to have been wrong.

To exercise any of these rights, write to privacy@storewiz.ai or use the Admin Console.

5.4 Safety guardrails that always apply

Regardless of your autonomy tier, certain categories of action always require human approval:

• Spending above a per-tenant configurable daily cap (default: per channel);
• Outbound communications to more than a per-tenant configurable number of customers in a single send;
• Deletion of any data (we soft-delete only, see §8);
• Modification of brand-voice baseline;
• Cancelling subscriptions or issuing refunds;
• Publishing to platforms where you have explicitly opted out;
• Any action our confidence-threshold engine scores below 0.85 on sensitive actions (financial, billing, customer PII, external publishing).

5.5 The data sources that feed automated decisions

Automated decisions draw from: (a) data the merchant has connected to StoreWiz; (b) the merchant's stated OKRs and brand pillars; (c) anonymized cross-tenant learning patterns (statistical patterns derived from aggregated outcomes across many tenants, drawn from at least 10 different merchants, from which no individual merchant or person can be identified and which contain no personal data).

5.6 The logic involved and likely consequences

We do not provide proprietary model weights, but we will explain in plain English on request:

• The category of data inputs used;
• The reasoning behind a given Proposal, which you can request via the Admin Console or privacy@storewiz.ai);
• The expected impact (e.g., projected change in a KPI);
• The actual outcome after execution (we record actuals and compare against expectations).

5.7 Data Protection Impact Assessment (DPIA)

Because automated decision-making on tenant store data constitutes high-risk processing under GDPR Article 35, StoreWiz will conduct a Data Protection Impact Assessment prior to general availability. The DPIA is renewed annually and on every material change to the platform's autonomous capabilities. A summary is available to enterprise tenants on request.

---

6. AI: training, retention, and cross-tenant patterns

This section is also load-bearing. Read this carefully.

6.1 We do not train any AI model on your data

StoreWiz does not use any tenant data (Account Data or Merchant-Customer Data) to train, fine-tune, or otherwise adapt the weights of any foundation model. We do not sell tenant data to AI model providers for training purposes. Data received from Google APIs (including Gmail and other Google Workspace scopes) is never used to develop, improve or train generalized AI or machine-learning models.

6.2 How AI providers receive your data

All AI model calls are routed through Vercel AI Gateway, which forwards them to the model provider (currently Anthropic for our LLM workloads; image / video / voice generation may route to additional providers in the future and will be disclosed in this Privacy Policy when added). We use BYOK (bring-your-own-key) configuration with Anthropic.

Anthropic's terms (incorporated by reference into our commercial relationship) state that Anthropic does not train its models on Customer Content delivered via the API.

6.3 The honest disclosure on retention

We are required to be precise about retention because it varies by configuration:

• Anthropic standard API retention (our current configuration): Anthropic retains the content of API calls for approximately 30 days for the purpose of abuse and safety review, then deletes it. This is the default retention behavior for the Anthropic paid API tier.
• Zero Data Retention (ZDR): ZDR is an Anthropic Enterprise-tier configuration that disables the 30-day retention window entirely. StoreWiz has NOT yet provisioned ZDR. We are evaluating it for a later release / a later release (when real tenant data starts flowing) and will update this section when our configuration changes.
• Vercel AI Gateway: Vercel commits in its AI Product Terms that AI Gateway content is not used to train AI Products and Services for Enterprise subscribers; for Pro plans, additional terms apply. Our subscription places us in this scope; we will publish the precise current Vercel tier in legal/sub-processors at GA.

If the 30-day Anthropic abuse-review retention is unacceptable for your data, please write to privacy@storewiz.ai before sending sensitive content. We will assess whether your use case requires us to prioritize ZDR provisioning.

6.4 Cross-tenant learning patterns

To improve agent decisions over time, StoreWiz derives statistical patterns from outcomes across many tenants. We do this under the following constraints:

• No raw PII. Cross-tenant aggregates contain no names, emails, addresses, or other direct identifiers.
• Google data excluded. Data received from Google APIs, including Gmail and other Google Workspace scopes, is never an input to cross-tenant learning.
• No tenant-attributable signals. Aggregates are derived only when at least 10 distinct tenants contribute to a pattern (that is, at least 10 different merchants).
• Tenant opt-out available. You can opt your tenant out of contributing to cross-tenant pattern learning from the Admin Console (not yet available). Opting out has no effect on your platform usage.
• No reverse-engineering. Patterns cannot be reverse-engineered to disclose individual tenant data, and we contractually prohibit any attempt to do so.

6.5 Content safety

We treat content provided by your end-customers (emails, reviews, support tickets, social posts) as untrusted. We clean it before any AI model sees it (see our Safety & Guardrails section in Terms). We log suspected prompt-injection attempts in our internal safety audit log.

---

7. Who receives your data (sub-processors and other recipients)

We share Personal Data only with the parties listed in this section.

7.1 Sub-processors

The canonical list of sub-processors is set out below and reproduced in our DPA Annex III. The current sub-processors are:

Sub-processors marked "Not yet active" are not currently in production. We will not engage them until that capability launches. Adding a new sub-processor requires written change order in our internal records and 30 days' advance notice to you (see §7.4).

7.2 Tenant-OAuth connectors

When you connect Klaviyo, Meta Ads, Google Ads, Plaid, Zendesk/Intercom, or similar to StoreWiz, the tenant, not StoreWiz, has the primary contract with that vendor. StoreWiz acts as a Processor of the data flowing through that OAuth connection. The vendor's own DPA continues to govern the relationship; StoreWiz's DPA covers our handling of the data once it reaches us.

7.3 Other recipients

We may also disclose Personal Data to:

• Professional advisers (lawyers, accountants, auditors) under confidentiality obligations.
• Law enforcement and regulators, where required by law. We will challenge overbroad or improperly-served requests and, where legally permitted, notify you of any compelled disclosure relating to your data.
• A successor entity in connection with a merger, acquisition, financing, or sale of all or substantially all of StoreWiz's assets. Your data continues to be protected under terms no less protective than this Privacy Policy.
• With your direction. E.g., when you ask us to send your data to a third party you nominate.

7.4 Sub-processor change notification

We give 30 days' advance notice of any new or replacement sub-processor (or of any material change to an existing sub-processor's role) by email to your primary contact and by updating storewiz.ai/legal/sub-processors. You may object in writing within 14 days. If we cannot accommodate your objection, you may terminate the affected service for cause. Emergency changes (e.g., security incident at a vendor) may be made with shorter notice and documented post-hoc.

7.5 We do not sell your data

We do not "sell" Personal Data within the meaning of CCPA/CPRA, and we do not "share" Personal Data for cross-context behavioral advertising. We honor the Global Privacy Control (GPC) signal as a valid opt-out request where applicable. We do not use Personal Data for retargeting on our marketing site.

---

8. How long we keep data (retention)

We keep Personal Data for as long as is necessary for the purposes set out in §4 and as required by law. Specifically:

Soft-delete model. Deletions from StoreWiz are first applied as soft-deletes (the row is marked inactive and excluded from queries). Hard deletion follows within 30 days, subject to backups (see below).

Backups. Neon database backups are retained for 14 days (point-in-time recovery window). If a deletion request is honored during a period when backups still contain the data, the data continues to exist in backup until the backup ages out; we will not restore it. If a database restore is genuinely necessary within the backup window, we re-run the deletion as soon as the restore completes.

Shopify-mandated retention. If you uninstall the StoreWiz Shopify app (not yet available), we honor Shopify's mandatory privacy webhooks: data is deleted within 30 days of the relevant webhook (customers/redact, shop/redact, customers/data_request).

---

9. International data transfers

StoreWiz is built primarily on US-based infrastructure. The providers are listed in §7.1. When you are in the EEA, the United Kingdom, or Switzerland, your Personal Data is transferred to the United States and, in some cases, to other jurisdictions where our sub-processors operate.

We rely on the following transfer mechanisms:

• EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller-to-processor) and Module 3 (processor-to-sub-processor) as applicable;
• UK International Data Transfer Addendum (IDTA) and / or the UK Addendum to the EU SCCs, as applicable;
• Swiss FADP supplement to the SCCs, where Swiss data is in scope;
• Transfer Impact Assessments (TIAs) that we conduct before engaging US-based sub-processors and update annually or on material change.

We do not currently certify under the EU-US Data Privacy Framework (DPF).

If you wish to receive a copy of the SCCs or the TIA summary in respect of a specific sub-processor, write to privacy@storewiz.ai.

Data residency choice. From a later release onward, paid tenants may elect EU-region data residency for their Neon-hosted Tenant Store Data. Application traffic and AI-gateway calls remain US-routed (see §6); we will update this clause as additional residency regions go live.

---

10. Security

We protect Personal Data using a defense-in-depth model that includes:

• Encryption in transit with TLS 1.2 or higher for all external traffic.
• Encryption at rest for the Neon database (AES-256 per Neon's documentation) and for sensitive secrets (OAuth tokens, credentials) in our application layer.
• Database-level separation so that each merchant's data can only be read under that merchant's verified identity, independently of application code.
• Application-layer tenant scoping through a typed query wrapper that prevents tenant-id leakage in code.
• Per-request tenant context that is set from your verified session and that throws if missing.
• A cross-tenant attack test suite that runs in CI on every code change.
• Defenses against manipulated input, so that content written by your customers cannot redirect what our agents do.
• Confidence-threshold gating on sensitive actions; below-threshold actions escalate to human review.
• An internal safety log recording when a guardrail stopped or escalated an agent action.
• Error monitoring via Sentry with PII-scrubbing rules applied at capture.
• Service status. We do not currently operate a public status page. Incident notices are sent by email to affected account owners.

Honest limits. StoreWiz has NOT yet completed SOC 2 Type I or Type II certification, ISO 27001 certification, or PCI-DSS attestation. Our roadmap targets SOC 2 Type I post-MVP (currently planned within ~6 months of GA) and SOC 2 Type II to follow. We do not claim compliance with frameworks we have not yet attested to. We will update this section when audit reports are available.

Pen-testing. We will commission third-party penetration tests as we approach SOC 2 Type I readiness and at least annually thereafter.

---

11. Your rights

Subject to applicable law, you have the following rights in respect of Personal Data we hold about you as a Controller (and, in respect of Merchant-Customer Data, where law gives you a direct right against a Processor):

• Right of access. Receive a copy of the Personal Data we hold about you.
• Right to rectification. Correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"). Request deletion, subject to legal-retention obligations (see §8).
• Right to restriction. Pause our processing of your data.
• Right to data portability. Receive your data in a structured, commonly-used, machine-readable format and (where technically feasible) have it transmitted to another controller.
• Right to object. Object to processing based on legitimate interests, including direct marketing.
• Rights in respect of automated decision-making. See §5.3 for the full set of controls.
• Right to withdraw consent. Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.
• Right to lodge a complaint with a supervisory authority in your country of residence.

How to exercise. Email privacy@storewiz.ai from the email address associated with your account, or contact us at the postal address in §1. We will verify your identity (typically via email confirmation; for higher-risk requests, additional verification may apply). We will respond within 30 days for most requests, extendable by up to two further months for complex requests with reasoned notice (GDPR Art. 12(3)). We do not charge for the first DSAR per year; manifestly unfounded or excessive repeat requests may attract a reasonable fee or be refused.

For Tenant Store Data, contact the merchant first. If you are an end-customer of a merchant who uses StoreWiz, please contact the merchant directly to exercise your rights. We will assist the merchant in responding to your request as required by the DPA.

---

12. Children's data

StoreWiz is a business-to-business platform. The Services are not directed to and we do not knowingly collect Personal Data from any person under the age of 16 (or under the higher local age of digital consent where it applies, such as under 13 in the United States under COPPA). If you believe we hold data about a minor, contact privacy@storewiz.ai and we will delete it promptly.

Merchants using StoreWiz to run stores aimed at minors must ensure their own compliance with applicable youth-data law. The DPA addresses Controller-side responsibility.

---

13. Data Protection Officer

[TODO[entity-pending]: Named DPO or external DPO firm, to be staffed prior to general availability.]

Until the DPO is named, the same team that handles privacy@storewiz.ai handles DPO-routed requests at dpo@storewiz.ai. EEA tenants may also nominate a EU Representative under Article 27 GDPR; we will name our own EU Representative prior to general availability ([TODO[entity-pending]: EU representative]).

---

14. Data breaches

If we become aware of a Personal Data breach affecting your data, we will:

• For data where we are the Controller: notify the competent supervisory authority within 72 hours of becoming aware where required by Article 33 GDPR, and notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms.
• For Tenant Store Data where you are the Controller and we are the Processor: notify you without undue delay after becoming aware so you can meet your own 72-hour obligation. The DPA contains more specific commitments.

The notification will include, to the extent known: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address and mitigate.

---

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. For material changes, we will:

• Post a clear notice on our marketing site and in the Admin Console at least 30 days before the change takes effect (or 14 days for changes required by law), and
• Email tenants' primary contacts.

Your continued use of the Services after a material change takes effect constitutes acceptance, unless applicable law requires affirmative consent in which case we will obtain it.

Previous versions are archived at storewiz.ai/legal/archive.

---

16. Regional supplements

16.a. California (United States). CCPA and CPRA

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you the following rights:

• Right to know what categories of Personal Information we have collected, sold (we don't), shared (we don't for cross-context behavioral advertising), and disclosed for business purposes, see §3 and §7.
• Right to delete Personal Information we hold about you (subject to legal-retention obligations).
• Right to correct inaccurate Personal Information.
• Right to opt out of sale or sharing. We do not sell or share Personal Information; we honor the Global Privacy Control (GPC) signal as a valid opt-out request.
• Right to limit use of Sensitive Personal Information. We do not collect or use Sensitive Personal Information except as strictly necessary to provide the Services.
• Right to opt out of automated decision-making technology. See §5.3 and §5.6. The right to receive meaningful information about the logic is built into the platform via reasoning traces; the right to opt out is exercisable per skill or platform-wide.
• Right to non-retaliation. We will not discriminate against you for exercising any of these rights.
• Authorized agents. You may designate an authorized agent to make a request on your behalf; we will verify the agent's authority.

Categories of personal information collected per the CCPA taxonomy: Identifiers; Customer Records (Cal. Civ. Code § 1798.80(e)); Commercial Information; Internet/Network Activity Information; Geolocation Data (approximate, IP-derived); Professional/Employment-Related Information; Inferences drawn from the foregoing.

Sensitive Personal Information categories collected: account credentials (used only to authenticate). We do not use this category beyond service-provision per Cal. Civ. Code § 1798.121.

We will publish these metrics from 1 July 2027.

16.b. Other US states (Virginia, Colorado, Connecticut, Utah, Texas, and others with comprehensive privacy laws)

Residents of US states with comprehensive privacy laws have analogous rights to those described above, including the right to access, correct, delete, opt out of sale/sharing, opt out of profiling for decisions producing legal or similarly significant effects, and appeal denied requests. Where the relevant law applies to us, we honor those rights on the same channels as the CCPA rights above.

16.c. European Economic Area and United Kingdom

The Controller for Account Data is Night Labs Private Limited (see the operator statement in §1). Our EU Representative under Article 27 GDPR is [TODO[entity-pending]: EU representative]; our UK Representative is [TODO[entity-pending]: UK representative]. You may lodge a complaint with the supervisory authority in your country of residence. A list of EU supervisory authorities is maintained by the EDPB at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

16.d. Switzerland

The Swiss Federal Act on Data Protection (FADP, revised 2023) applies in addition to the references above for Swiss residents. Our Swiss representative is [TODO[entity-pending]: Swiss representative or "to be appointed if processing meets FADP threshold"].

16.e. Canada (PIPEDA and Quebec Law 25)

Canadian residents have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial laws (most notably Quebec's Law 25). These include the right to access, correct, withdraw consent, and, under Law 25, receive information about automated decision-making and request human review. We treat the Article 22 GDPR right and Law 25 Article 12.1 right as equivalent in practice (see §5).

16.f. Brazil (LGPD)

[TODO[founder-decide]: Brazil LGPD coverage, recommend confirming yes/no for launch; if yes, name DPO (encarregado) and add LGPD-specific rights paragraph here]

16.g. Australia (Privacy Act 1988)

[TODO[founder-decide]: Australia coverage, recommend confirming yes/no for launch; if yes, add Australian Privacy Principles applicability paragraph here]

16.h. Other jurisdictions

If you are in a jurisdiction not listed above, we still aim to give you the substance of the rights set out in this Privacy Policy. Contact privacy@storewiz.ai and we will work with you in good faith.

---

17. Governing law

This Privacy Policy is governed by the laws of India. The courts at Mumbai, India have exclusive jurisdiction over any dispute arising out of it.

Nothing in this section takes away rights you have under the mandatory consumer-protection or data-protection law of the country you live in. If you are in the European Economic Area, the United Kingdom, Switzerland, Brazil, Canada, Australia or a US state with a comprehensive privacy law, you keep the rights and the regulatory remedies described in §16, including the right to complain to your own supervisory authority.

---

Contact. Questions about this Privacy Policy: privacy@storewiz.ai. DPO matters: dpo@storewiz.ai. Legal: legal@storewiz.ai. General support: support@storewiz.ai.