Privacy Policy

01Who we are

epiphanies (“epiphanies,” “we,” “us,” or ‘our’) provides a merchandising analytics application for Shopify merchants. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to our application, our website at getepiphanies.ai, and related services (together, the ‘Services’).

The data controller for the purposes of applicable data protection law is HEWTLLC dba as getepiphanies.ai, 3663 Claycomb Ln, Johnstown, Colorado. If you have questions, contact us at privacy@getepiphanies.ai.

02Scope

This policy covers personal data we process as a controller (for example, a merchant’s account and contact details, and visitors to our website). When we process a merchant’s store data on the merchant’s behalf — including any end-customer personal data contained in orders — we act as a processor (or service provider) for that merchant, who is the controller of that data.

03Information we collect from Shopify

When you install epiphanies, you authorize us to access certain data from your Shopify store through Shopify’s APIs. Depending on the scopes you grant, this may include:

• Store and shop details (shop domain, plan, currency, locations, settings)
• Product and catalog data, including SKUs and your cost per item
• Inventory levels by product and location
• Orders and line items (quantities, prices, discounts, fulfillment, timestamps)
• Where you grant the relevant scopes, customer personal data contained in orders, such as name, email address, shipping/billing address, and phone number

We request only the scopes needed to provide the features you use, and we process only the minimum personal data required to deliver the Services.

04Information you provide to us

• Account and contact information (name, business name, email)
• Configuration you enter, such as cost data, margin thresholds, and alert settings
• Support communications you send to us
• Billing is handled by Shopify; we do not collect or store your full payment card details

05Information we collect automatically

When you use the Services or visit our website, we automatically collect:

• Usage and log data (features used, actions taken, timestamps, and diagnostic logs)
• Device and connection data (IP address, browser type, operating system)
• Cookies and similar technologies on our marketing website for analytics and to remember preferences

06How we use information

We use the information we collect to:

• Provide and operate the Services — computing forecasts, net profit, alerts, transfers, and related analytics
• Generate AI insights that summarize and prioritize your computed metrics in plain language. Our AI is given your already-computed figures as input and is used to explain and prioritize them; it does not sell or share your data to train third-party models
• Provide support, respond to requests, and send service-related communications
• Maintain security, prevent fraud and abuse, and debug and improve the Services
• Comply with legal obligations

We do not sell your personal data, and we do not use end-customer personal data for advertising.

07Protected customer data and data minimization

Where the Services access protected customer data through Shopify, we comply with Shopify’s Protected Customer Data requirements. We limit processing to what is necessary to provide the features you use, apply retention limits, encrypt data in transit and at rest, and maintain access controls. You can reduce the data we receive by limiting the scopes you grant or the features you enable.

08Legal bases for processing (EEA/UK)

Where the GDPR or UK GDPR applies and we act as a controller, we rely on the following legal bases: performance of a contract (to provide the Services you request); legitimate interests (to secure, maintain, and improve the Services); consent (for example, certain cookies or marketing emails); and compliance with legal obligations. Where we act as a processor for a merchant, the merchant is responsible for establishing the legal basis for the underlying processing.

09How we share information

We share information only as needed to run the Services:

• Service providers and sub-processors who host and support the Services (for example, cloud hosting, our AI processing provider, email/notification delivery, and product analytics), under contracts that require appropriate safeguards
• Tools you choose to connect, such as Slack or Klaviyo — data flows to those tools only when you enable the integration, subject to their own terms
• Legal and safety reasons, where required by law or to protect rights, property, or safety
• Business transfers, in connection with a merger, acquisition, or sale of assets, subject to this policy

A current list of sub-processors is available on request at privacy@getepiphanies.ai.

10Data retention

We retain personal data only as long as needed to provide the Services and for legitimate business or legal purposes. When you uninstall epiphanies, we delete or de-identify your store data within [90] days, except where longer retention is required by law or held in routine backups that expire on a rolling basis. We also honor Shopify’s data-erasure requests as described below.

11Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12International data transfers

We may process and store information in countries other than where you are located, including the United States. Where required, we use appropriate transfer mechanisms such as the European Commission’s Standard Contractual Clauses to protect personal data transferred outside the EEA or UK.

13Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing. You may also have the right to opt out of the ‘sale’ or ‘sharing’ of personal data under U.S. state laws — note that we do not sell personal data.

To exercise these rights for data we control, email privacy@getepiphanies.ai. Where an end customer’s data is processed on a merchant’s behalf, please direct the request to the merchant; we will assist the merchant in responding.

14Shopify data requests and erasure

As a Shopify app, we honor Shopify’s mandatory compliance webhooks:

• customers/data_request — when a store’s customer requests their data, we provide the relevant data we hold to the merchant
• customers/redact — we delete the identified customer’s personal data from our systems
• shop/redact — following uninstall, we erase the store’s data from our systems

We complete these requests within the timeframe required by Shopify and applicable law.

15Cookies and tracking

Our marketing website uses cookies and similar technologies for analytics and to remember preferences. You can control cookies through your browser settings. Where required, we request consent before setting non-essential cookies.

16Children

The Services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal data from children.

17Changes to this policy

We may update this policy from time to time. We will post the updated version with a new ‘Last updated’ date and, where appropriate, notify you. Your continued use of the Services after an update means you accept the revised policy.

18Contact us

Questions or requests? Contact [Legal Entity Name] at privacy@getepiphanies.ai or by mail at [Business Address]. If you are in the EEA or UK and have a concern we cannot resolve, you may have the right to lodge a complaint with your local data protection authority.