RetailSpec Privacy Policy
This policy explains how [RetailSpec legal entity name] ("RetailSpec", "we") handles personal information.
Who this covers, and our role
- Merchants and their staff: people who sign up for, use or contact RetailSpec. For their information we are the controller.
- Visitors to RetailSpec's own websites, and people who request a demo.
- Shoppers: our merchants' customers. A merchant's store, orders and customer list belong to the merchant. The merchant is the controller, and RetailSpec processes shoppers' information on the merchant's behalf, under our Data Processing Agreement with them. Shoppers with questions about their data should contact the store they bought from first. We will help the store respond.
What we collect
- Account details: name, business email, phone, role, the business you work for, and sign-in records. Passwords are stored only as secure hashes; we never see or send them.
- Billing details: plan, invoices and payment status. Card details are handled by Stripe and are never stored by RetailSpec.
- Usage information: which features are used, device and browser information, IP address, and logs needed to run, secure and improve the Service.
- Communications: support requests, demo bookings, call notes and, only with the participant's consent, recordings of demo and support calls.
- Merchant Data, processed for the merchant: products, orders, customers, stock and content.
How we use it
- To provide and secure the Service, and to keep your account working.
- To bill subscriptions and metered usage.
- To provide support and to tell you about the Service, including changes to these documents.
- To improve RetailSpec, using aggregated information that does not identify a merchant or shopper.
- To meet legal obligations.
We do not sell personal information, and we do not use Merchant Data to train AI models.
AI processing
Some features send content (for example product text, a document or a question) to AI providers so it can be processed. These providers are listed below and act as our subprocessors under business terms. Each request is limited to what the feature needs, and usage is metered per merchant.
Who we share it with (subprocessors)
We use these service providers to run RetailSpec. Each is bound to protect the information and use it only to provide its service to us.
- Hosting and infrastructure: Vercel (application hosting), Neon (databases), Cloudflare (content delivery, file storage and video calls).
- Email: Amazon Web Services (email sending) and Resend.
- Payments: Stripe (subscriptions, and merchants' own card payments).
- AI: Anthropic, OpenAI, Google, Jina AI.
- Text messages: Twilio.
- Connections a merchant chooses: for example QuickBooks, Xero, Microsoft Business Central, Shopify, Clover and EasyPost. These receive only what the merchant connects them to receive.
We may also disclose information when the law requires it, to protect the Service or its users, or as part of a sale or merger of our business, with notice.
International transfers
RetailSpec and its providers operate mainly in the United States. Where information is transferred from other countries, we rely on appropriate safeguards such as standard contractual clauses.
How long we keep it
- Account information: while the account is active and for a reasonable period after, as the law requires (for example tax records).
- Merchant Data: deleted 30 days after an account closes, unless the law requires otherwise.
- Call recordings: kept for 90 days unless a participant asks for them to be kept or deleted sooner.
Security
Measures include:
- each merchant in its own dedicated database;
- encryption in transit, and encrypted storage of service credentials;
- role-based access, and sign-in codes for sensitive actions.
We will notify affected people and authorities of a breach as the law requires.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. California residents have the rights described in the CCPA/CPRA, and we do not sell or share personal information for cross-context behavioural advertising.
To make a request, contact [privacy contact email]. We will verify your request and respond within the time the law allows. Shoppers should start with the store they bought from.
Cookies
RetailSpec uses cookies that are needed for sign-in, security and remembering preferences. Merchants' storefronts may use additional cookies chosen by the merchant, and the merchant's own policy describes them.
Children
RetailSpec is a business service and is not directed to children under 16.
Changes
We will post any update here with a new date, and notify merchants of material changes.
Contact
[RetailSpec legal entity name] · [address] · [privacy contact email]