Platform Privacy Policy

Last Revised: October 28, 2026

Effective: set at publication, at least 7 days after Merchants are notified

This Privacy Policy explains how Rep AI Technologies Inc. and its affiliates ("Rep AI", "we", "us" or "our") handle personal information when we provide the Rep AI platform: the AI shopping and support assistant that runs on online stores and messaging channels, the Rep AI Console, Rep Inbox, our integrations and APIs, and the Rep AI connector for AI assistants (together, the "Services").

It covers three groups of people:

• Merchants and their users: businesses that subscribe to the Services ("Merchants") and the people who use the Console or Rep Inbox on their behalf ("Users"). See Section 2.
• Shoppers: people who chat with a Rep AI assistant for an online store ("Shoppers"). See Section 3.
• AI assistant connections: what happens when a Merchant connects Rep AI to an AI assistant such as ChatGPT or Claude. See Section 4.

Visitors to our marketing website at hellorep.ai are covered by our separate Website Privacy Policy. If a Merchant has signed an agreement with us (the "Agreement"), including a Data Processing Agreement ("DPA"), and that agreement conflicts with this Privacy Policy, the agreement controls.

1. Our role

For Shopper data, we act for the Merchant. When a Shopper chats with a Rep AI assistant, the Merchant decides why and how that information is used, and we process it on the Merchant's behalf and under its instructions. In legal terms, the Merchant is the "controller" (or "business") and Rep AI is its "processor" (or "service provider"). The Merchant's own privacy policy also applies to Shoppers.

For Merchant and User account data, we act for ourselves. We decide how we use the information we need to run Merchant accounts, bill for the Services, provide support and keep the Services secure.

We do not sell personal information, and we never share Shopper information for cross-context behavioral advertising. The Console uses advertising tags to measure our own marketing; they never run on pages that show Shopper data (Section 2.3).

2. Merchants and Users

2.1 What we collect

• Account details: name, business email address, company name, store URL, e-commerce platform, role and permissions, and a password or single sign-on details (for example, through Google or Shopify).
• Billing details: plan, invoices and billing contact. Card and bank details are collected and held by our payment processors (Stripe and Shopify Billing), not by us.
• Store and integration data: product catalog, policies, FAQs, AI instructions and the content of help desk, e-commerce, messaging and marketing tools the Merchant connects (for example, Shopify, Gorgias, Zendesk, Klaviyo, WhatsApp, Instagram or Facebook). We use the access tokens the Merchant grants only to provide the Services.
• Usage data: how Users use the Console and Rep Inbox (pages viewed, settings changed, actions taken), device and browser type, IP address and approximate location, and records of changes made to the account (the Audit Log).
• Communications: support requests, emails, call notes and recordings of meetings with our team where the participants were told the meeting is recorded.

2.2 How we use it

• To create and run the account, provide the Services, and authenticate Users.
• To bill for the Services and manage the subscription.
• To provide support, onboarding and service announcements, including notice of changes to this policy.
• To keep the Services secure, detect and prevent fraud and abuse, and fix problems.
• To understand how the Services are used and improve them, mostly from aggregated data.
• To send product news and marketing to business contacts. Every marketing email has an unsubscribe link. We also use advertising tags in the Console to measure our advertising (Section 2.3).
• To comply with the law and protect our rights.

Where EU or UK law applies, we rely on the performance of our contract with the Merchant, our legitimate interests in running and improving a secure business service, compliance with legal obligations, and, for certain marketing, consent.

2.3 Cookies in the Console

The Console uses cookies and similar technologies to keep Users signed in and remember preferences. We also use analytics and advertising tags, loaded through Google Tag Manager, to understand how people sign up for and use the Console and to measure our advertising: Google Analytics, Google Ads, Meta Pixel, Microsoft Advertising, Microsoft Clarity (which records how Users interact with the pages it runs on), X (Twitter) and OpenAI. These tags can receive what you enter or view on those pages, such as your name, email address, store URL and the pages you visit. They never run on the Console pages that show Shopper data, such as conversations, customer profiles, insights and support, so they never see Shopper conversations or Shopper details. The companies behind them may use what they collect under their own terms, including for advertising. If your browser sends a Global Privacy Control signal, these tags do not load at all. You can also block them with your browser settings; the Console still works without them. If you block essential cookies, the Console will not work.

3. Shoppers who chat with Rep AI for an online store

This section applies to you if you chat with a Rep AI assistant for an online store (a "Store"), whether on the Store's website or through one of its channels, such as email, WhatsApp, Instagram or Facebook Messenger. In that chat, Rep AI acts on behalf of the Store, and the Store's own privacy policy also applies. Rep AI does not sell your information.

3.1 What we collect

• Your messages and the assistant's replies, including voice notes you send, which we turn into text.
• Photos, videos and files you send, such as a picture of a damaged item, a receipt, or a photo of yourself for Virtual Try-On.
• Try-on images we create from your photo.
• Details you choose to share, such as your name, email address, phone number, shipping address or order number.
• Order and account details the Store shares with us so the assistant can help you, such as your order status, order history or loyalty status.
• Shopping activity on the Store while the chat is available: pages and products viewed, items added to your cart, and how you interact with the page (for example scrolling, clicks, key presses and time on page, counted but not what you type outside the chat), so the assistant can give relevant answers.
• Technical data, such as browser and device type, language, IP address, approximate location (country or city), the page you were on, and a chat session identifier.

3.2 Cookies and similar storage in the chat

The chat uses cookies and browser storage on the Store's site to keep your chat session and remember earlier chats with that Store. Where the chat or the Store's consent banner asks for your choice, we respect it. Until you accept, the activity data we receive is not linked to an identifier stored on your device, and the chat still works.

3.3 How we use it

• To answer your questions, recommend products and help with your order, returns or exchanges.
• To create try-on images when you ask to see a product on you, and to let you try on more items without uploading your photo again.
• To remember earlier conversations with the same Store, so you do not have to repeat yourself. This memory is kept separately for each Store and is never shared with other Stores.
• To let the Store review the conversation, for example to check an answer, follow up on a support request, or understand what shoppers ask about.
• To label conversations by topic and by the shopper's apparent mood (for example satisfied or frustrated), so the Store can review them.
• To pass your conversation to the Store's support team or help desk when the assistant hands it over to a person.
• To keep the service secure and working properly, and to measure and improve the quality of the assistant's answers.

We do not use your photos or videos to train AI models. Our AI service providers' terms prohibit them from using our data to train their models.

3.4 Photos, videos and Virtual Try-On

You never have to send a photo or video. The assistant can still help without one.

When you send a photo or video, the assistant looks at it to understand your request, for example to see the damage on an item. When you send a photo for Virtual Try-On, we use it to create an image of you wearing the product. To do this, your photo is processed by our AI service providers (OpenAI, Google and Amazon). An AI model then checks that the product was applied correctly and the image is not distorted; it does not compare faces. Photos we upload to an AI provider for this are deleted from the provider's file storage as soon as the try-on is done.

So the Store can see what was shared in the chat, we keep a short text description of each photo you send, such as "a torn shoulder seam on a blue jacket".

We do not use your photo to identify you, and we do not create or store face templates, face geometry or any other biometric identifiers from it. Only send photos of yourself, or of someone who has agreed. Do not use Virtual Try-On with a photo of a child.

Where the chat asks, we ask for your agreement before you send a photo. By sending a photo or video, you agree to its use as described in this section.

3.5 Who we share it with

• The Store you are chatting with.
• The Store's own tools, such as its help desk, e-commerce platform or email marketing tool, when the Store has connected them to Rep AI, for example when your conversation is handed to a person or you ask to be contacted.
• Our service providers, listed in Section 7, which host our data and run the AI models that generate replies, search results and try-on images. They may use the data only to provide their services to us.
• An AI assistant the Store has connected to its Rep AI account, such as ChatGPT or Claude, when the Store asks it to read its conversations. See Section 4.

3.6 How long we keep it

• Photos, videos, voice notes and files you send in chat, and try-on images created from them: up to 90 days, then deleted automatically.
• Photos you attach but never send: deleted after one day.
• Attachments in emails the Store handles in Rep Inbox: up to 12 months, so the Store can follow up on its support tickets.
• Copies kept by our AI providers: our AI providers may keep a temporary copy of what we send them under their own terms, for example up to 30 days to detect abuse, and then delete it.
• Conversation messages, the details you shared and the assistant's memory of you: for as long as the Store uses Rep AI, so the Store can review its conversation history, unless you or the Store ask us to delete them sooner.
• Analytics copies: up to 100 days for activity events, up to 400 days for session behavior summaries, and about 13 months for conversation archives, then deleted.
• System logs and AI quality traces: up to 12 months.
• Backups: expire within 14 days.

When you or the Store ask us to delete your information, we delete your conversations, the photos, videos and media you sent, try-on images, the assistant's memory of you, and your support tickets and the attachments you sent in Rep Inbox. Files the Store's team attached to its own replies, such as guides or templates, belong to the Store and stay with it. Copies in analytics data, system logs, AI quality traces and backups are not deleted individually; they expire on the schedule above. When a Store stops using Rep AI, see Section 11.

3.7 Your choices and rights

• To ask us to access, correct or delete your conversations, photos or other information, email dpo@hellorep.ai or contact the Store. Please tell us which Store you chatted with and the email address or phone number you used. We will respond within 30 days.
• Because Rep AI acts for the Store, we may pass your request to the Store and help it respond.
• Depending on where you live, you may have more rights, described in Section 9.

3.8 Children

The chat assistant is not intended for children under 16. We do not knowingly collect information from children under 16. If you are a parent, do not use Virtual Try-On with your child's photo. If you believe a child has shared information with a Rep AI assistant, contact dpo@hellorep.ai and we will delete it.

4. Connecting Rep AI to AI assistants

Merchants can connect their Rep AI account to an AI assistant of their choice, such as ChatGPT or Claude, through our connector at mcp.hellorep.ai. Only a Console administrator can create or revoke a connection.

What is shared. When a Merchant connects an assistant, it chooses which permissions to grant on a Rep AI consent screen. With those permissions, the assistant can read the Merchant's Rep AI data when the Merchant asks it to. That data can include store performance metrics, conversation topics, support ticket summaries, and full chat transcripts between the Merchant's Shoppers and the Rep AI assistant. Transcripts are not redacted, so they can include a Shopper's name, email address and the messages they wrote. If the Merchant grants edit permissions, the assistant can also propose changes to the Merchant's AI instructions, FAQs and skills. A change is saved only after the Merchant approves it.

Who receives it. The data goes to the AI assistant the Merchant connected. Its provider processes it under its own terms and privacy policy. The Merchant chooses the provider and acts as controller for this sharing; the provider is the Merchant's vendor, not ours. We do not sell this data and we do not use it for advertising.

What we keep. We keep a record of each connection: the app name, its permissions, when it was granted or revoked, and when it was last used. Each change made through a connection is recorded in the Merchant's Audit Log. We do not receive or store the Merchant's conversation with the assistant beyond the requests the assistant sends to us.

Controls. A Merchant can revoke a connection at any time from the Rep AI Console. After that, the assistant can no longer reach the Merchant's data. Shoppers can exercise their rights through the Merchant, or by contacting dpo@hellorep.ai.

5. Other disclosures

Besides the sharing described above, we may disclose personal information:

• to comply with law, a court order, subpoena or a lawful request from a public authority;
• to enforce our agreements and this policy, and to investigate possible violations;
• to detect, prevent or address fraud, security or technical issues;
• to protect the rights, property or safety of Rep AI, our Merchants, Shoppers or the public;
• in a merger, acquisition, financing or sale of all or part of our business, as long as the recipient keeps protecting the information as described in this policy; and
• with the instruction or consent of the person or Merchant concerned.

We may share aggregated or de-identified information that cannot reasonably be used to identify a person, a Shopper or a Merchant.

6. How we use AI

• Replies in the chat are generated by large language models run by the AI providers listed in Section 7. AI replies can be wrong; Merchants configure what the assistant may say and can review every conversation.
• We send AI providers only what is needed to answer the request in front of them. Their terms prohibit them from using our data to train their models. Some may keep a temporary copy for a short period to detect abuse, as their terms allow.
• We do not train our own or third-party foundation models on Shoppers' personal information. We use Merchants' store content, such as products, policies and FAQs, to configure that Merchant's assistant.
• The assistant does not make decisions that have legal or similarly significant effects on Shoppers.

7. Service providers (sub-processors)

We use the following service providers to process personal information on our behalf:

For Merchant and User account data, we also use business tools such as Google Workspace (email), HubSpot and Salesforce (customer relationship management), Vitally (customer success) and Fireflies (meeting notes). The analytics and advertising tags we use in the Console are listed in Section 2.3.

Merchants may connect their own tools (for example, a help desk, e-commerce platform or AI assistant). Those tools are the Merchant's vendors, not ours, and their own terms apply. We will give Merchants notice before adding or replacing a sub-processor, as set out in the DPA.

8. Security

We protect personal information with technical and organizational measures appropriate to the risk, including encryption in transit, encryption at rest, access limited to authorized staff and systems, and monitoring. Photos, videos and files Shoppers send are stored in private storage, with access limited to authorized staff and systems, and are shown only through signed links. No system is perfectly secure; if a security breach affects personal information, we will notify affected Merchants without undue delay and as required by law.

9. Your privacy rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it;
• correct it;
• delete it;
• receive it in a portable format;
• object to or restrict certain processing, and withdraw consent where we rely on it;
• opt out of marketing;
• appeal if we refuse your request; and
• complain to your data protection authority. In the EU, see the list of supervisory authorities; in the UK, the Information Commissioner's Office.

To make a request, email dpo@hellorep.ai. You may also use an authorized agent; we may ask the agent for proof of your permission and ask you to confirm your identity. We will verify the request and respond within 30 days, or within the period required by law. If we refuse your request, you can appeal by replying to our decision with the subject line "Appeal"; we will answer within the period required by law. We will not discriminate against you for exercising your rights. If you are a Shopper, we may pass your request to the Store, which decides how your information is used (see Section 3.7).

California and other US states. We do not sell personal information. The advertising tags we use in the Console (Section 2.3) may count as "sharing" under the California Consumer Privacy Act and similar state laws. To opt out, turn on Global Privacy Control in your browser, which stops those tags from loading, or email dpo@hellorep.ai. We do not share Shopper information, and we do not use sensitive personal information to infer characteristics about you. The categories of information we collect, their sources and purposes, and the recipients are described in Sections 2 to 7.

10. International transfers

We are based in the United States and store data in the United States. Our team and some service providers may access or process it from other countries, including Israel. When we transfer personal information from the EU, UK or Switzerland, we rely on adequacy decisions (such as the decision for Israel) or on the European Commission's Standard Contractual Clauses and the UK Addendum, together with additional safeguards where needed.

11. When a Merchant closes its account

We keep Merchant and User account data for as long as the account is active. After a Merchant closes its account, we delete its Shoppers' conversations, the assistant's memory of them, and the store data we synced from its e-commerce platform within 90 days. Photos, videos and other files expire on the schedule in Section 3.6, as do analytics copies, logs and backups. We keep basic account records (such as the account, its users and settings, and invoices) so the Merchant can reactivate, and to meet legal, tax and dispute needs. Aggregated or de-identified data may be kept longer.

12. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the "Last Revised" date. If a change is material, we will notify Merchants by email or in the Console at least 7 days before it takes effect, unless a faster change is required by law.

13. Contact us

Rep AI Technologies Inc.

85 Broad Street, New York, NY 10004, United States

Privacy and data protection: dpo@hellorep.ai

Support: support@hellorep.ai

‍