Privacy Policy

Spokenfor AI Inc. is a Canadian company. For our marketing website, newsletter, contact forms and merchant accounts, we act as the controller (or “business” under the CPRA) of the personal data described below.

For personal data belonging to a merchant’s own customers that we process on that merchant’s behalf inside the Shopify app (for example order and shopper region data used to enforce a regional claim), we act as a processor / service provider. The merchant is the controller of that data and their own privacy policy governs it. Our processing of that data is governed by our Data Processing Addendum, available on request from info@spokenfor.ai.

• Website contact form: name, email address, Shopify store URL, topic and the content of your message.
• Launch updates / waitlist: email address, and the date and source of your sign-up (kept as proof of consent).
• Merchant account and app install: Shopify shop domain, store name and contact email, plan and configuration settings, and the app permissions you grant.
• Claim and order data: order identifiers, product and claim records, and approximate location (country, region/state, city) derived from an IP address in order to determine which regional claim applies. We do not store full IP addresses for longer than needed to perform the lookup and to prevent abuse.
• Billing: subscription status and charges are handled through the Shopify Billing API. We do not receive or store full payment card numbers.
• Technical and security logs: request metadata such as timestamps, user agent, coarse location and error traces, used to keep the service secure and reliable.

We do not knowingly collect special-category data (health, biometrics, precise geolocation, political or religious beliefs) and we do not knowingly collect data from children under 16. If you believe a child has given us data, email info@spokenfor.ai and we will delete it.

• To provide the service — install, configure and run the app, enforce regional exclusivity, render the storefront widget, and support merchants. Legal basis: performance of a contract.
• To bill and account for subscriptions. Legal basis: contract and legal obligation.
• To answer your enquiries submitted through the contact form. Legal basis: legitimate interests / steps prior to a contract.
• To send launch updates and product news to people who asked for them. Legal basis: consent (and express consent under CASL). Every email contains a one-click unsubscribe link.
• To keep the service secure, prevent fraud and abuse, and debug errors. Legal basis: legitimate interests.
• To comply with law, respond to lawful requests and enforce our terms. Legal basis: legal obligation / legitimate interests.

We do not use your personal data to train third-party AI models, and we do not make decisions producing legal or similarly significant effects about you by purely automated means.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CPRA and similar US state privacy laws. We have not done so in the preceding twelve months, including for consumers we know to be under 16.

We share personal data only with vendors who process it on our instructions under written contracts, and only as needed to run Spokenfor:

• Shopify — app distribution, authentication, order data and billing.
• Cloud hosting and database providers — application hosting, managed Postgres and caching.
• Email delivery provider — transactional and update emails sent from notify.spokenfor.ai.
• IP geolocation provider — converting an IP address into an approximate region.

We may also disclose data to professional advisers, to authorities where legally required, and to an acquirer in the event of a merger or sale — in which case we will notify affected users. A current list of subprocessors is available at info@spokenfor.ai.

We are based in Canada and our providers may process data in Canada, the United States and the European Union. Where personal data is transferred out of the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), on Canada’s adequacy decision, or on another lawful transfer mechanism, together with appropriate technical safeguards. You can request a copy of the safeguards we use.

Our website uses only strictly necessary cookies and local storage required to serve the site securely and to remember your session — no advertising, profiling or cross-site tracking cookies, and no third-party analytics that would require consent. If we ever add non-essential cookies or analytics, we will ask for your consent first through a cookie banner and update this policy. Most browsers also let you block or delete cookies; the site will continue to work.

• Contact form messages: up to 24 months after the enquiry is resolved.
• Launch update subscribers: until you unsubscribe, plus a suppression record so we do not email you again.
• Merchant account and claim data: for the life of the subscription and then purged within 30 days of app uninstall or shop deletion, except where we must keep records longer for tax, accounting or legal reasons (typically 6–7 years for invoices).
• Security logs: normally 90 days.

We honour Shopify’s mandatory compliance webhooks — customers/data_request, customers/redact and shop/redact — so that merchant and shopper data is exported or erased within the timelines Shopify requires.

Personal data is encrypted in transit (TLS) and at rest by our hosting and database providers. Access is restricted to the people who need it, protected by unique accounts and multi-factor authentication, and database rows are protected by row-level access rules. No system is perfectly secure, but if a breach affects your personal data we will notify the relevant supervisory authority and affected individuals as required by law (for the GDPR, within 72 hours of becoming aware).

Depending on where you live, you may have the right to: access a copy of your data; correct it; delete it; restrict or object to processing; withdraw consent at any time (without affecting prior processing); receive your data in a portable format; opt out of sale, sharing or targeted advertising (we do none of these); and to be free from discrimination for exercising your rights.

To exercise any right, email info@spokenfor.ai or use our contact form. We respond within 30 days (45 days for CPRA requests, extendable once where permitted) and we may need to verify your identity first. An authorised agent may submit a request on your behalf with proof of authorisation. To stop marketing email, use the unsubscribe link in any message.

If you are a shopper of a merchant using Spokenfor, please contact that merchant first — they control your data and we will assist them in responding.

If you are unhappy with how we handle your data you can complain to your data protection authority: in the EEA, your national supervisory authority; in the UK, the Information Commissioner’s Office (ico.org.uk); in Canada, the Office of the Privacy Commissioner (priv.gc.ca). We would appreciate the chance to resolve it first.

We will post any changes on this page and update the “last updated” date. For material changes affecting how we use your data, we will notify merchants by email or in-app before the change takes effect.

Spokenfor AI Inc. (SPKN4) — privacy enquiries and data rights requests: info@spokenfor.ai. General enquiries: contact form. We will provide our registered postal address and, where required, the details of our EU/UK representative on request.