Privacy Policy

This Privacy Policy explains how Suadivo (“Suadivo”, “we”, “us”) — operated by [Legal entity name], [address] — handles personal data in connection with our AI sales-assistant service and the chat widget we provide to merchants (“Customers”) for use on their websites.

1. Our two roles

• For our Customers’ account data (the brands who license Suadivo), we act as a data controller.
• For end-shopper data collected through the widget on a Customer’s website, we act as a data processor on that Customer’s behalf. The Customer is the controller and is responsible for its own privacy notice and for any consent required from its shoppers.

2. Data we collect

Customer account data

• Name, work email, and a securely hashed password.
• Subscription plan, usage counts, and billing metadata (payments are processed by Razorpay — we do not store card numbers).

Brand content

• Publicly accessible pages we crawl from the website you ask us to index, plus any product catalog and knowledge files you upload.

Shopper interaction data (via the widget)

• Messages a shopper types into the assistant, and preferences it infers from the conversation to personalise recommendations (“shopper memory”).
• A random session identifier, event timestamps, and coarse analytics (e.g. messages sent, products shown).
• Order and attribution data when the Customer connects order webhooks.
• IP address (used transiently for rate-limiting and revenue attribution).

Local storage

• Functional browser storage only: a session token for logged-in Customers, and a session id for the shopper widget. We do not use third-party advertising or cross-site tracking cookies.

3. How we use data

• To operate the assistant — understand a shopper’s need and generate grounded recommendations and answers.
• To provide Customers with analytics and insights about shopper demand.
• To meter usage, bill subscriptions, secure the service, and prevent abuse.

4. AI processing

To generate replies, the text of a shopper’s message and relevant brand content is sent to Google’s Gemini API. Content understanding for search (embeddings) runs on our own servers and is not sent to third parties. We do not use shopper conversations to train our own or third parties’ foundation models. AI-generated responses may be imperfect and should not be relied on as professional advice.

5. Sub-processors

We share data with these providers only as needed to run the service:

• Google (Gemini API) — generates assistant replies.
• Supabase — database hosting for the data described above.
• Railway — backend application hosting.
• Vercel — dashboard hosting.
• Razorpay — subscription payment processing (Customer billing).

These providers may process data outside your country; we rely on their respective safeguards for international transfers.

6. Retention

We keep Customer account data for as long as the account is active. Crawled content and shopper interaction data are retained while they are useful to the service or as the Customer directs, and are deleted or anonymised within [retention period] of a deletion request or account closure, except where we must retain records to meet legal obligations.

7. Your rights

Depending on your location (including under the EU/UK GDPR and India’s Digital Personal Data Protection Act, 2023), you may have the right to access, correct, delete, or port your personal data, and to object to or restrict certain processing. Shoppers should contact the brand whose site they used; that brand can direct us to act. Customers and others may contact us using the details below.

8. Security

We protect data with transport encryption, password hashing (scrypt), tenant isolation, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children

The service is intended for business use and is not directed to children under [16/18].

10. Changes

We may update this policy; material changes will be reflected by the effective date above and, where appropriate, notified to Customers.