Privacy Policy

This Privacy Policy explains how Praevidens.ai processes personal data when merchants and marketing agencies use our e-commerce retention and analytics platform, and when we process shoppers' data on a merchant's behalf. It also describes the AI Memory Graph, the third parties we rely on, how long we keep data, and the rights available to you under the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA).

1. Who we are & our two roles

Praevidens.ai ("Praevidens", "we", "us") is a platform operated by BOYAKOV PROPERTY INVESTMENTS LTD, a company registered in Cyprus. Depending on the data, we act in one of two roles under the GDPR:

• As a processor — for the personal data of a merchant's own customers (shoppers). The merchant decides why and how that data is used; we process it only to provide the service, under the instructions set out in our Data Processing Agreement. The merchant is the controller.
• As a controller — for the personal data of the merchant's or agency's own account users (the people who sign in and run the platform): their name, work email, authentication data, and usage logs.

2. Data we process

Account data (we are controller)

• Name, work email, and role of the people who create or are invited to a workspace.
• Authentication data (e.g. Google sign-in identifier) and session information.
• Technical and usage data: IP address, device/browser type, pages used, and diagnostic logs.
• Billing information handled by our payment provider (we do not store full card numbers).

Merchant customer data (we are processor)

When a merchant connects a store (e.g. Shopify) or an analytics/ad account, we process the shopper data needed to deliver retention analytics and offers, on the merchant's behalf:

• Contact details of the merchant's customers (name, email).
• Order and purchase history, order values, product and category preferences.
• Behavioural and engagement signals (purchase cadence, replenishment timing, response to offers).
• Aggregated traffic and campaign metrics from connected analytics and advertising sources.

3. The AI Memory Graph

We do not use the AI Memory Graph to make decisions producing legal or similarly significant effects on a person within the meaning of Article 22 GDPR. It is used to prioritise marketing offers, not to grant or deny anything.

4. Why we process it (legal bases)

• Performance of a contract — to provide the platform to the merchant/agency account holder (Art. 6(1)(b)).
• Legitimate interests — to operate, secure and improve the service, and to produce analytics for our customers, balanced against the rights of the individuals concerned (Art. 6(1)(f)).
• Consent — for optional features such as the AI Memory Graph profiling and automated retention marketing, obtained through the merchant's own consent flow (Art. 6(1)(a)). Consent can be withdrawn at any time.

Where we act as processor, the legal basis for using shopper data is established by the merchant (the controller), not by us.

5. Sub-processors we use

We rely on the following sub-processors to run the service. Each is bound by a data processing agreement and processes data only on our documented instructions.

An up-to-date list is available on request at privacy@praevidens.ai. We give merchants advance notice of new sub-processors so they can object, as set out in the DPA.

6. International transfers

Some sub-processors (notably Anthropic, Google and Meta) are located in the United States. Where personal data is transferred outside the EEA/UK, we rely on the European Commission's Standard Contractual Clauses and equivalent safeguards. We prioritise EU-region infrastructure for hosting and the AI Memory Graph.

7. How long we keep data

• AI Memory Graph & behavioural data: up to 24 months from the last relevant activity, then deleted or anonymised.
• Account data: for the life of the account and up to 24 months after closure, unless a longer period is required by law.
• On uninstall/termination: merchant customer data is deleted or returned as described in the DPA.

8. Security

We use encryption in transit, access controls with least-privilege roles, credential rotation, isolated tenants, and monitoring of critical jobs. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the data.

9. Your rights (GDPR)

If you are in the EEA or UK, you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent. You can also lodge a complaint with a supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection.

To exercise a right, use our data request form or email privacy@praevidens.ai. If your data was collected by a merchant using our platform, we will forward your request to that merchant (the controller) and assist them in responding, normally within 30 days.

10. California rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected, to access and delete it, to correct it, and to opt out of certain automated decision-making and profiling. Because our platform can use AI-based profiling to personalise offers, we treat that as automated decision-making technology and offer an opt-out.

We do not sell personal information for money. Submit a request via the data request form or privacy@praevidens.ai.

11. Children

The platform is a business tool and is not directed to children. We do not knowingly process the data of individuals under 16.

12. Google user data & Limited Use

When you connect a Google Analytics property, you grant Praevidens read-only access to that property's data using the analytics.readonly scope. Our access to, and use of, information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

• What we access: with your explicit consent, read-only Google Analytics 4 data for the properties you choose to connect (e.g. sessions, page and product views, traffic sources, conversion metrics). We request the narrowest scope needed and never request write access.
• How we use it: solely to display your analytics and to power the retention insights and offer recommendations shown to you inside the product. We do not use it for advertising.
• Storage: we store the analytics metrics we retrieve (such as sessions, product/page views and traffic sources) to render your dashboards and generate insights, retained per Section 7, and no more than is necessary for those features.
• Sharing: we do not sell Google user data and do not share it with third parties except the sub-processors in Section 5 that are necessary to operate the service. We do not use Google user data to develop, improve or train generalised or non-personalised AI/ML models.
• Control: you can disconnect Google access at any time in the app's Settings, which revokes our access and stops further processing; you may also request deletion via our data request form.

13. Changes & contact

We may update this policy; material changes will be reflected by the "Last updated" date above and, where appropriate, notified to account holders. Questions or requests: privacy@praevidens.ai, or by post to BOYAKOV PROPERTY INVESTMENTS LTD, Erifylis 16, Mouttalos, 8049, Paphos, Cyprus.