STOREGENIUS PRIVACY POLICY
Last updated: August 23, 2026
StoreGenius, with offices in Boise, Idaho, United States ("StoreGenius," "we," "us," or "our"), provides a customer experience platform for retail businesses. This Privacy Policy explains what personal information we handle, why we handle it, and the choices and rights available to you. Our Terms of Service, including our data processing addendum, are at storegenius.ai/terms.
This policy covers storegenius.ai and the StoreGenius platform, including our messaging channels, dashboards, and APIs. It does not cover the practices of merchants, sponsors, or other third parties who use our platform, each of which maintains its own privacy practices. Separate terms and privacy notices apply to individual SMS and RCS messaging programs and are linked from those programs' sign-up materials.
Questions about this policy can be sent to privacy@storegenius.ai.
Summary at a glance
This summary is not a substitute for the full policy below, but it answers the questions people ask most.
| Your question | Short answer | Where to read more |
|---|---|---|
| Whose data is this about? | If you are a merchant customer, the merchant controls your data and we handle it on their instructions — contact the merchant first. If you are a site visitor, demo requester, or dashboard user, we control it — contact us. | Our Two Roles |
| What do you collect? | From you: contact details, account credentials, and site-usage data. On a merchant's behalf: customer messages, phone numbers, consent records, and delivery status. | Information We Collect |
| Do you sell it? | No. We do not sell personal information and we do not share it for advertising. | How We Use Information |
| Do you use AI on my messages? | Yes — the platform drafts, summarises, classifies, and routes messages for the merchant. We do not use your information to train generally available AI models. | Automated Processing and AI |
| Who else sees it? | Our hosting, messaging, identity, AI-inference and support providers; the merchant you messaged; our professional advisers; and authorities where the law requires it. | Sharing and Subprocessors |
| How long do you keep it? | Customer data: the merchant's contract term plus 60 days. Backups age out within 35 days. Logs: 90 days, then archived for one year. | Retention |
| How do I delete it? | Email privacy@storegenius.ai. If a merchant holds the data, we forward your request to them and tell you we have. | Your Privacy Rights |
| Who do I contact? | privacy@storegenius.ai for privacy. security@storegenius.ai for security. | Contact Us |
Our Two Roles: Controller and Processor
Our obligations depend on whose data we are handling and why. Read the section that applies to you.
We act as a processor (a "service provider" under California law) for customer data. When a merchant uses StoreGenius to communicate with its customers, the merchant decides what to collect and why. We process that information on the merchant's documented instructions and do not use it for our own purposes. This covers messages, conversation history, consent records, and related customer information.
If you are a customer of a merchant and want to access or delete your information, contact the merchant directly — they control it. You may also contact us at privacy@storegenius.ai and we will route your request to the merchant and support them in responding.
We act as a controller for our own business data. This covers visitors to storegenius.ai, people who contact us or request a demo, and the individual users who access a customer's StoreGenius account. We decide the purposes and means of this processing, and you can bring requests to us directly.
Where this policy does not say otherwise, the sections below describe our controller activities.
Information We Collect
Information you give us. Your name, business email address, phone number, company, role, and anything else you include when you request a demo, start a trial, contact support, or correspond with us.
Account information. Credentials and profile details for users who access the StoreGenius dashboard, along with role and permission assignments. Authentication is handled through our identity provider; we do not store your password.
Customer communications (as processor). Messages exchanged between a merchant and its customers over SMS, WhatsApp, Instagram, web chat, and other supported channels, together with the phone number or channel identifier involved, consent and opt-out records, timestamps, and delivery status.
Website usage information (as controller). Pages viewed, features used, referring page, browser type, operating system, approximate location derived from IP address, and similar technical data generated when you visit storegenius.ai or sign in to the StoreGenius dashboard.
In-product technical data (as processor). When a customer uses a merchant's chat surface, the platform generates technical and delivery data about that session. We handle it on the merchant's instructions, as part of the customer data described above.
Information from merchant systems. Where a customer connects a ticketing, point-of-sale, or CRM system, information may flow into the platform from that system. The customer determines what is shared.
We do not collect payment card numbers. Payments, where applicable, are handled by third-party processors under their own terms.
How We Use Information
As a controller, we use personal information to:
- Provide, operate, secure, and improve storegenius.ai and the StoreGenius platform
- Create and administer accounts, and authenticate users
- Respond to enquiries, provide support, and send service and administrative messages
- Send marketing communications where permitted, subject to your right to opt out at any time
- Produce aggregated and de-identified analytics about platform performance and usage
- Detect, investigate, and prevent fraud, abuse, and security incidents
- Comply with legal obligations and enforce our agreements
As a processor, we use customer information only to deliver the service on the merchant's instructions, to maintain security and integrity, and as otherwise required by law.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
Automated Processing and AI
The StoreGenius platform uses machine learning and generative AI. Depending on how a merchant configures it, the platform can draft and suggest replies, summarise conversations, classify and route messages, and produce analytics, recommendations, and predictions.
For customer messaging, the merchant is in control. The merchant decides how the platform is configured and is responsible for reviewing outputs before they affect a customer. Our Terms of Service require our customers to apply human review wherever an output could affect a customer's access, refunds, accommodations, safety, or similar interests, and prohibit using the platform to make fully automated decisions that legally or materially affect individuals without human review.
AI outputs can be wrong. They are generated automatically and may be inaccurate, incomplete, or out of date. They are produced for the merchant as drafts and suggestions.
We do not train general AI models on your information. We do not use customer data, customer messages, or the outputs generated for a customer to train, fine-tune, or improve generally available AI models outside the platform, except where the customer expressly consents in writing, where the information has been aggregated or de-identified so that it does not identify any individual, customer, merchant, or event, or where the law requires it.
If you want a human to look at a message you received, contact the merchant that sent it. You can also write to privacy@storegenius.ai and we will route your request to them.
Legal Bases for Processing
For individuals in the European Economic Area, the United Kingdom, and Switzerland, we rely on the following legal bases for the information we handle as a controller:
| Who | Purpose | Legal basis |
|---|---|---|
| Account holders and Authorized Users | Creating and administering accounts, authenticating users, providing and operating the platform, billing, and support | Performance of a contract |
| Visitors, demo and trial requesters | Responding to your enquiry and taking steps at your request before entering a contract | Steps prior to entering a contract, and our legitimate interest in responding to business enquiries |
| Everyone | Keeping the platform and our website secure, preventing fraud and abuse, and improving service quality | Our legitimate interests in operating a secure and reliable service |
| Everyone | Marketing communications | Consent, or legitimate interests where permitted |
| Everyone | Non-essential cookies and website analytics | Consent |
| Everyone | Meeting legal and regulatory obligations | Legal obligation |
Where we rely on legitimate interests, we balance those interests against your rights and freedoms before we rely on them, and you may object to that processing as described below. You can ask us for a summary of that assessment at privacy@storegenius.ai.
Providing your business contact details is not a statutory requirement. Account and contact information is needed to create an account, provide the platform, and respond to you — without it we cannot provide those things. Anything else you choose to tell us is voluntary, and withholding it does not affect your access.
Where we act as a processor, the merchant is responsible for establishing a legal basis for its collection and use of customer information, including obtaining any required consent for messaging.
Sharing and Subprocessors
We share personal information only as described here:
- Service providers and subprocessors who host our infrastructure, deliver messages over SMS, WhatsApp, and other channels, provide identity and authentication services, provide AI model inference, supply support tooling, or protect our website against automated abuse. We require these providers to commit in writing to protect the information and to use it only to provide services to us.
- Merchant customers, where the information relates to customers communicating with that merchant.
- Professional advisers, such as auditors and legal counsel, under duties of confidentiality.
- Authorities, where required by law, legal process, or to protect rights, safety, and property.
- Acquirers, in connection with a merger, acquisition, financing, or sale of assets, subject to this policy continuing to apply to the transferred information.
A list of our subprocessors is available through our Trust Center at app.vanta.com. Where a data processing agreement applies, we give customers notice of new subprocessors as set out in that agreement, and customers may object on reasonable data-protection grounds.
International Transfers
We operate primarily in North America, and information we process may be stored and accessed in the United States.
Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we put an appropriate transfer safeguard in place, such as the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, or the Standard Contractual Clauses as amended for Swiss law. Tell us which transfer you are asking about at privacy@storegenius.ai and we will confirm the mechanism that applies.
Retention
We keep personal information for as long as we need it for the purpose we collected it, and for as long as a contract, a regulation, or the law requires. When none of those apply, we delete it or strip out the details that identify you. The periods below are our standard maximums.
| Information | How long we keep it |
|---|---|
| Customer and attendee personal information processed for a merchant | The term of that merchant's contract with us, plus 60 days |
| Encrypted database backups | 35 days, on a rolling basis |
| Application and audit logs | 90 days live, then archived for one year |
| Security incident records and root cause analyses | 3 years |
| Business contact and account information we hold as a controller | For as long as your account or relationship with us is active, and afterwards only as long as we need it for our records or the law requires |
Because backups run on a 35-day rolling cycle, information you or a merchant delete from the live service can persist in encrypted backups for up to 35 more days before it ages out.
A merchant can configure a shorter retention period for its own customer data. Where it does, that shorter period applies. We delete or return customer information at the merchant's direction and on termination of their agreement.
Where we act as a controller, we will delete personal information in response to a verified request, unless the law allows or requires us to keep it. Where we act as a processor for a merchant, we forward your request to the merchant, as described under Your Privacy Rights. Any information subject to a legal hold or a legal retention obligation is kept until the hold is lifted.
Security
We run an information security program sized to the sensitivity of the information we handle. It includes:
- Encryption. Information is encrypted in transit using TLS 1.2 or higher, and at rest using AES-256.
- Access control. Access follows least privilege and is managed through our identity provider. Multi-factor authentication is required for privileged access to production systems, and every user has a unique account.
- Logging. We log log-ins, changes to security settings, and administrator access to customer data, with the user, timestamp, and action recorded.
- Vulnerability remediation. Our policy requires vulnerabilities to be remediated within 14 days for critical, 30 days for high, 90 days for medium, and 180 days for low severity, or to carry a documented risk treatment plan.
- Access reviews. Our policy requires access to production systems to be reviewed at least quarterly.
- Personnel. Everyone with access to customer information is bound by confidentiality obligations and a code of conduct.
Physical and environmental security of the infrastructure holding your information is provided by our cloud host. StoreGenius does not own or operate data centres.
Our security policies and other security documentation are available through our Trust Center at app.vanta.com. Some documents are provided under a non-disclosure agreement.
If a security incident affects your personal information, we will notify affected individuals, our customers, and regulators without undue delay, as required by applicable law and our contractual commitments.
No system is perfectly secure. If you believe your information has been compromised, or you wish to report a vulnerability, contact security@storegenius.ai.
Your Privacy Rights
European Economic Area, United Kingdom, and Switzerland
Subject to applicable law, you have the right to:
- Access the personal information we hold about you
- Rectify information that is inaccurate or incomplete
- Erase your personal information in certain circumstances
- Restrict processing in certain circumstances
- Object to processing based on legitimate interests, and to direct marketing at any time
- Port information you provided to us to another controller, where technically feasible
- Withdraw consent at any time, without affecting processing carried out before withdrawal
- Lodge a complaint with your local supervisory authority
California
Subject to the California Consumer Privacy Act, as amended, you have the right to:
- Know what personal information we have collected, the sources, the purposes, and the categories of recipients
- Delete personal information we have collected from you, subject to legal exceptions
- Correct inaccurate personal information
- Opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of
- Limit the use of sensitive personal information. Where we act as a business, we do not use sensitive personal information for purposes that trigger this right. Messages a customer sends to a merchant may contain sensitive information; we handle those only as a service provider on the merchant's instructions
- Non-discrimination for exercising any of these rights
You may designate an authorised agent to make a request on your behalf. We will ask the agent for proof of authorisation and may ask you to verify your identity directly.
Other jurisdictions
Residents of other US states with comprehensive privacy laws have rights to:
- Access the personal information we hold about them
- Correct inaccurate personal information
- Delete personal information, subject to legal exceptions
- Obtain a portable copy of information they provided to us
- Opt out of the sale of personal information, of targeted advertising, and of profiling used to make decisions with legal or similarly significant effects. We do not sell personal information, do not use it for targeted advertising, and do not profile you in this way, so there is nothing here to opt out of
- Appeal a decision we make on a request, as described below
If you are in Oregon or Minnesota, you may also ask us for a list of the specific third parties to which we have disclosed your personal information. If you are in Minnesota, you may also question the result of any profiling and review the personal information used in it.
These rights apply as and to the extent the law of your state provides them. Most state privacy laws do not cover information we hold about you in a business or employment capacity.
Making a request
Send your request to privacy@storegenius.ai. We will verify your identity before acting on it.
We respond within the time applicable law requires. For requests under US state privacy laws that is generally 45 days, which we may extend once by a further 45 days where the law allows, and we will tell you if we do. For requests under UK or EU law that is one month, extendable by two further months for complex requests, with notice to you. If we cannot fulfil a request, we will tell you why.
Appeals. If we refuse a request, you may appeal by emailing privacy@storegenius.ai with "Privacy Request Appeal" in the subject line. We will respond in writing, with our reasons, within 45 days. If we deny your appeal, you may submit a complaint to your state Attorney General.
Complaints. You can complain to us directly about how we have handled your personal information. Email privacy@storegenius.ai. We will acknowledge your complaint within 30 days and respond without undue delay. If you are in the United Kingdom you may also complain to the Information Commissioner's Office at ico.org.uk, and if you are elsewhere in Europe you may complain to your local supervisory authority. You do not have to complain to us first.
If your request concerns information a merchant holds about you as a customer, we will forward it to that merchant, since they control it, and we will confirm to you that we have done so.
Cookies and Similar Technologies
storegenius.ai sets no cookies of its own: there is no sign-in on the marketing site and no preference we store in your browser. The only cookies set when you visit are Google reCAPTCHA's, described below. You can control cookies through your browser settings; disabling them may stop the trial form from submitting.
Our trial form is protected by Google reCAPTCHA, which helps us tell people apart from automated abuse. reCAPTCHA collects device and behavioural information and sets cookies, and is subject to Google's privacy policy and terms of service.
We do not use cookies for advertising, and we do not use cookies to build profiles of you across other websites or services. Because we do not sell or share personal information, there is no sale or sharing to opt out of.
Children
The StoreGenius platform is intended for business use and is not directed to children. We do not knowingly collect personal information from children under 13, or under 16 where a higher age applies. If you believe a child has provided us personal information, contact privacy@storegenius.ai and we will delete it.
We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. We do not sell or share personal information at all, and we do not direct advertising to minors.
Merchants are responsible for determining whether their customer communications reach minors and for complying with the laws that apply to them.
Changes to This Policy
We review this policy at least annually and update it when our practices change.
When we make a material change, we will update the date at the top of this page and give notice in advance by email or in the product where we can. Where a change relies on your consent, we will ask you for that consent rather than assume it. Previous versions are available on request to privacy@storegenius.ai.
Contact Us
StoreGenius Inc. 999 West Main St. Boise, Idaho 83702 United States
Privacy enquiries and rights requests: privacy@storegenius.ai Security reports: security@storegenius.ai General support: support@storegenius.ai