Privacy policy

1. 1.Who is responsible for what

   For your account with us — your email, your organisation, your billing details — Comulu is the data controller.

   For the data inside your store — your customers, their orders and their addresses — you are the controller and Comulu is your processor. We handle that data on your instructions, to run the store you operate.

2. 2.What we collect

   We keep the collection narrow and tie every category to a purpose.

   • Account data: name, email address, organisation and store details, and authentication events.
   • Store data: products, pages, media, orders, customers and settings you create or import.
   • Usage data: pages viewed in the dashboard, feature usage and error reports, used to keep the product working.
   • Storefront analytics: page views, product views and checkout events for the stores you run, so you can see how they perform.
   • Billing data: plan, invoices and payment status. Card details are handled by our payment provider, not by us.

3. 3.AI processing

   When you use a generative feature, the prompt and the store context needed to answer it are sent to our model provider. Store content is sent only when the feature you invoked requires it.

   We do not use your store data or your prompts to train models.

4. 4.Cookies

   The dashboard uses strictly necessary cookies for authentication and security. Storefront analytics use a first-party session identifier that is not shared with third parties and carries no advertising profile.

5. 5.Sharing

   We share data only with processors that make the service work, under contract and only for that purpose.

   • Hosting and database infrastructure.
   • The model provider behind the AI features.
   • Payment processing for your subscription.
   • Email delivery for transactional messages.

6. 6.Retention

   Account and store data is kept while your account is active. After you delete a store, its data is removed from production within 30 days and from backups within 90 days.

   Invoices and tax records are kept for as long as the law requires.

7. 7.Your rights

   You can access, correct, export or delete your account data from the dashboard, or by contacting us. Where the GDPR applies, you also have the right to object, to restrict processing and to complain to your supervisory authority.

   If one of your own customers contacts us about their data, we will point them to you as the controller and support you in responding.

8. 8.Security

   Data is encrypted in transit and at rest. Every store is isolated at the database level, and access is checked on every request. Internal access is limited to the people who need it and is logged.

9. 9.International transfers

   Our primary infrastructure is in the European Union. Where a processor is outside the EEA, transfers rely on standard contractual clauses and appropriate safeguards.

Privacy questions, access requests or a data processing agreement? Write to privacy@comulu.ai.