Privacy

Privacy Policy

Working template: fill in every item marked [TO COMPLETE], settle every [TO CONFIRM] choice, and have this policy reviewed by a US-licensed lawyer before launch. It describes the planned production setup (accounts and data stored on our servers): make sure it matches what the app really does at launch, and update it before adding any ad pixel, analytics, email or AI provider.

This Privacy Policy explains how [TO COMPLETE: company legal name], a [TO COMPLETE: entity type] with its registered address at [TO COMPLETE: registered address] ("Shopclic", "we", "us" or "our"), collects, uses and shares personal information when you use the shopclic.ai website and the Shopclic web app (the "Service").

It doesn't cover third-party services you use alongside Shopclic, such as Whop, Shopify or social media platforms, which have their own privacy policies. If you run a store, you are responsible for your own customers' personal information and for your store's privacy policy.

Payments and card data. Payments are processed by Whop. You enter your card details on Whop's checkout, and your card number, expiry date and security code never reach Shopclic: we don't receive or store them.

The short version

• We collect what we need to run Shopclic: your email and first name, your quiz answers, how you use the app, and how you found us (for example, a referral code).
• We don't sell your personal information, and we don't share it for targeted advertising.
• You can ask us to access, correct or delete your information at any time.

1. Information we collect

Information you give us

• Account information: your email address, first name and password. Passwords are stored only in hashed form, never in plain text.
• Sign in with Google: if you choose "Continue with Google", Google shares your name and verified email address with us. We use them only to create or open your Shopclic account. We don't receive your Google password or access your Google account, contacts or files.
• Quiz answers: for example your age range, your experience with e-commerce, your current work situation, your goals, the time and budget you have, the product categories you like and, if you already sell online, your platform and revenue range, plus any free-text answers. Please don't include sensitive information, such as health or financial account details, in free-text answers.
• Store and project information: the products you choose, your store name, brand and style preferences, your store's web address (for example, if you ask for a store review) and the launch-plan steps you check off.
• Content you create: the directions you type for AI generation, and the store briefs, prompts, images, video ads and assistant conversations generated for you. [TO CONFIRM: which of these are stored on our servers]
• Purchases: the plans and add-ons you buy. Payment details stay with Whop, as explained above.
• Messages and guarantee claims: what you send our support team, including any evidence for a first-sale guarantee claim, such as your store address, screenshots, links to your videos or ads, and order information.

Information collected automatically

• Usage events: the screens you view, the buttons you click, the features you use, your progress in the quiz and the app, and when these happen.
• Device and log data: IP address, browser and device type, operating system, language, referring web page, and approximate location (city, region or country) derived from your IP address.
• Attribution data: UTM parameters in the link you followed, referral or affiliate codes, and the campaign or partner that sent you to us. [TO CONFIRM: whether ad click IDs, such as fbclid or ttclid, are stored]
• Cookies and local storage: see Section 5.

Information from third parties

• Whop: confirmation of your purchase, the plan and amount, payment and renewal status, transaction ID, refunds and disputes, and limited billing details such as your name, email address and country or ZIP code. [TO CONFIRM: exact fields Whop shares with you]
• Referral partners: the referral code that links your sign-up or purchase to the partner who referred you.

What we don't collect

• Your full card number, expiry date or security code (see "Payments and card data" above).
• Biometric information. The "hold to sign" commitment button in the app doesn't scan or store your fingerprint.
• Your precise geolocation.

2. How we use your information

• To provide the Service: create and secure your account, save your progress, run the quiz, and generate your content, plans and assistant answers.
• To personalize recommendations: we use your quiz answers to rank product suggestions and to build the scenarios and plans shown in the app. These are automated suggestions only, with no legal or similarly significant effect on you.
• To process payments and manage your plan with Whop, including renewals, cancellations and refunds.
• To run the first-sale guarantee: to check whether its conditions are met, using your dashboard activity and the information you send us.
• To support you and send service messages, such as receipts, renewal and cancellation confirmations, security alerts and changes to our terms.
• To send marketing emails about Shopclic, which you can unsubscribe from at any time (see Section 6).
• To measure our marketing and pay partners: to understand which campaigns, links and partners bring people to Shopclic, and to calculate referral commissions.
• To understand and improve the Service: to analyze usage, fix bugs and build new features. We don't use your content to train AI models. [TO CONFIRM]
• To keep the Service safe: to prevent fraud, security incidents, and abuse of quotas or of the guarantee.
• To comply with the law, enforce our terms, respond to lawful requests, and establish or defend legal claims.

We will ask for your consent before using your information for a purpose that is materially different from those listed here, for example before featuring your story or results in our marketing.

3. How AI features use your information

• When you generate product visuals, we send our AI provider, OpenAI, only what's needed to create the image: the product name, the directions you typed and the style settings. We don't send your name or email address.
• [TO COMPLETE: AI agent provider (for example Anthropic or OpenAI) and what is sent to it, such as your question and your product and profile context]
• Video ads are currently assembled in your browser. [TO CONFIRM: update this if a video-generation provider is added]
• Under its API terms, OpenAI does not use data sent through its API to train its models by default. [TO CONFIRM against your current OpenAI agreement and data-retention settings]
• Please don't include personal information about yourself or others in the directions you type.

4. How we share your information

We share personal information only as described below.

• Service providers that process it on our behalf, under contracts that limit how they can use it:
  • hosting: Vercel;
  • database: [TO CONFIRM: Neon or Supabase];
  • AI image generation: OpenAI;
  • AI agent: [TO COMPLETE];
  • email delivery: [TO COMPLETE];
  • product analytics: [TO COMPLETE: e.g., PostHog, Amplitude or Google Analytics, or none];
  • customer support tools: [TO COMPLETE].
• Whop, which processes your payments and subscriptions. Whop collects payment information directly from you at checkout and handles it under its own Privacy Policy.
• Referral partners: if you came through a partner's link or code, we (or Whop) may tell that partner that a purchase was made, and its amount, so their commission can be paid. We don't give partners your contact details. [TO CONFIRM]
• Professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality.
• Legal and safety reasons: when required by law or legal process, or when needed to protect the rights, property or safety of Shopclic, our users or others.
• Business transfers: as part of a merger, acquisition, financing or sale of assets, subject to this policy.
• With your consent or at your direction, for example when you follow a link to a third-party service like Shopify, which then collects information under its own policy.

We may also use and share information that has been aggregated or de-identified so that it can no longer reasonably identify you. We keep de-identified information in that form and don't try to re-identify it.

5. Cookies, local storage and similar technologies

• Essential: we use your browser's local storage, and cookies once accounts are live [TO CONFIRM], to save your progress and keep you signed in. The Service doesn't work properly without them.
• Analytics: [TO COMPLETE: analytics tools used, or "We don't use analytics tools"] help us understand how the Service is used. [TO CONFIRM: configured without advertising features]
• Advertising pixels: we don't currently use advertising pixels, such as the Meta Pixel or the TikTok Pixel. If we add them, we'll update this policy first and give you a way to opt out (see Section 12).
• Your controls: you can block or delete cookies and local storage in your browser settings. Clearing local storage may reset your progress in the app.
• Do Not Track and Global Privacy Control: there is no common standard for "Do Not Track" browser signals, so we don't respond to them. We do honor Global Privacy Control (GPC) signals, as described in Section 12.
• Third parties don't currently collect personal information about your online activities over time and across different websites through the Service. [TO CONFIRM: true only while no ad pixels or cross-site trackers are installed]

6. Emails from us

• We send service emails, such as receipts, renewal notices and security alerts, while you have an account or an active plan.
• We also send marketing emails about Shopclic. Every marketing email includes an unsubscribe link, and you can also reply to ask us to stop. Unsubscribing doesn't stop service emails.
• We never sell or rent your email address.

7. How long we keep your information

We keep personal information only as long as we need it for the purposes above, then delete or de-identify it:

• Account information and content you create: while your account is open, then deleted or de-identified within [TO CONFIRM: 90] days after your account closes, except for the records below.
• Quiz answers, if you never create an account or buy a plan: [TO CONFIRM: 12 months] after your last visit.
• Usage events and attribution data: [TO CONFIRM: 24 months], then deleted or aggregated. Data needed to pay a referral commission is kept until the commission is settled.
• Purchase, refund and guarantee records: [TO CONFIRM: 7 years], for tax, accounting and legal purposes.
• Support messages: [TO CONFIRM: 3 years] after our last exchange.
• Technical logs: up to [TO CONFIRM: 12 months].
• Unsubscribe requests: as long as needed to respect your choice.

We may keep information longer when the law requires it or to resolve a dispute. Information stored in your browser's local storage stays on your device until you clear it.

8. How we protect your information

We use appropriate technical and organizational measures, including encryption in transit (HTTPS), hashed passwords, separate environments, role-based and least-privilege access for our team and providers, and logging. Card payments are handled by Whop. No system is infallible, so we can't guarantee absolute security. If a data breach affects your personal information, we'll notify you as required by law. Please use a strong, unique password and tell us right away if you think your account has been compromised.

9. Children's privacy

The Service is meant for adults and is not directed to anyone under 18: you must be at least 18 to create an account or buy a plan. We do not knowingly collect personal information from children under 13, in line with the Children's Online Privacy Protection Act (COPPA). If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child has given us personal information, please contact us at support@shopclic.ai. We don't sell or share the personal information of anyone we know is under 16.

10. Your choices and rights

Wherever you live in the United States, you can:

• view and update your account information in the app [TO CONFIRM: Settings page];
• ask us for a copy of your personal information, or ask us to correct or delete it;
• unsubscribe from marketing emails;
• control cookies and local storage in your browser.

To make a request, email support@shopclic.ai [TO COMPLETE: confirm support email, or use a dedicated privacy address] with the subject "Privacy request". Residents of some states have additional rights, described in the next sections. [TO CONFIRM: whether you extend access and deletion rights to all US users, as written here, or only where the law requires]

11. California privacy rights (CCPA)

This section applies to California residents and supplements the rest of this policy. It describes our practices over the last 12 months and serves as our notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"). [TO CONFIRM WITH COUNSEL: whether the CCPA applies to the business yet. If you publish this section, you must honor it.]

Categories of personal information we collect

• Identifiers: first name, email address, account ID, IP address and device identifiers.
• Customer records (California Civil Code Section 1798.80(e)): name, email address and limited billing details received from Whop.
• Characteristics of protected classifications: your age range, if you give it in the quiz.
• Commercial information: plans and add-ons purchased, purchase history, refund requests and guarantee claims, and, if you share it, the revenue range of a store you already run.
• Internet or other electronic network activity: usage events, pages viewed, clicks, referring pages, UTM parameters and referral codes.
• Approximate geolocation: city, region or country derived from your IP address. We don't collect precise geolocation.
• Professional or employment-related information: your current work situation, if you give it in the quiz.
• Inferences: preferences and a profile drawn from your quiz answers, such as product categories, budget and experience level, used to recommend products.
• Sensitive personal information: your account login (email address and password), used only to give you secure access to your account.

Sources. We collect this information directly from you, automatically from your device and browser, from Whop and from referral partners (see Section 1).

Purposes. We use it for the business and commercial purposes described in Sections 2 and 3: providing and personalizing the Service, processing payments, running the guarantee, customer support, marketing our own services, measuring campaigns and referrals, analytics and improvement, security and fraud prevention, and legal compliance.

Disclosures for a business purpose. In the last 12 months, we disclosed each category above to our service providers (hosting, database, email, analytics and support) as needed for those purposes. We also disclosed identifiers, customer records and commercial information to Whop to process payments, and commercial information (that a purchase was made, and its amount) to referral partners to pay their commissions. The directions you type for AI generation go to our AI providers, as described in Section 3.

Sale and sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16.

Sensitive personal information. We use and disclose sensitive personal information only for purposes the CCPA allows, such as providing the Service and keeping it secure, and not to infer characteristics about you. For this reason, we don't offer a "Limit the Use of My Sensitive Personal Information" link.

Retention. See Section 7.

Your rights. As a California resident, you have the right to:

• know and access the personal information we have collected about you, including its categories, sources, purposes and recipients, and to get a copy of specific pieces of it in a portable format;
• delete personal information we collected from you, subject to legal exceptions (for example, records we must keep for tax purposes);
• correct inaccurate personal information;
• opt out of the sale or sharing of your personal information (see Section 12);
• limit the use of your sensitive personal information, where this right applies;
• not be discriminated against for exercising these rights: we won't deny you the Service, charge you a different price or give you a different level of service because you used them.

How to make a request. Email support@shopclic.ai with the subject "California privacy request". [TO COMPLETE: add a web form link if you set one up] To protect your information, we verify your identity by matching what you tell us with what we hold, usually by confirming that you control the email address on your account. We confirm receipt within 10 business days and respond within 45 calendar days. If we need more time (up to another 45 days), we'll tell you why.

Authorized agents. You can ask an authorized agent to make a request for you. We will ask the agent for proof that you gave them signed permission, and we may ask you to verify your identity directly with us.

Financial incentives. [TO CONFIRM WITH COUNSEL: if a discount (such as a welcome discount) is offered in exchange for your email address or quiz answers, add a Notice of Financial Incentive here describing its terms, how to opt in and withdraw, and how its value is estimated]

Shine the Light. We don't disclose personal information to third parties for their own direct marketing purposes (California Civil Code Section 1798.83).

12. Do Not Sell or Share My Personal Information

California law, and the laws of several other states, give you the right to opt out of the "sale" of your personal information and of its "sharing" for cross-context behavioral advertising, meaning ads based on your activity across different websites and apps.

• We do not sell your personal information, and we have not done so in the last 12 months.
• We do not share it for cross-context behavioral advertising. We don't currently use advertising pixels from Meta, TikTok or other ad networks on the Service.
• If this changes, for example if we add Meta or TikTok pixels to measure our ads, we will update this policy before doing so, add a "Do Not Sell or Share My Personal Information" link to every page, and honor opt-out requests and GPC signals.

How to opt out. Even though we don't sell or share personal information today, you can opt out in advance:

• email support@shopclic.ai with the subject "Do Not Sell or Share". We'll record your choice and apply it to your account. You don't need to verify your identity to opt out; or
• turn on Global Privacy Control in a browser or extension that supports it. We'll treat the signal as an opt-out for that browser and, if you're signed in, for your account.

13. Privacy rights in other US states

Depending on where you live (for example in Colorado, Connecticut, Oregon, Texas or Virginia), you may have rights similar to those above: to access, correct and delete your personal data and get a copy of it, and to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. We don't sell personal data, use it for targeted advertising, or use it for that kind of profiling.

To exercise your rights, follow the steps in Section 10. If we decline your request, you can appeal by replying to our decision with the subject "Privacy appeal". We'll respond within the time your state's law requires (generally 45 to 60 days). If you're not satisfied with the outcome of your appeal, you can contact your state attorney general.

Nevada residents: we don't sell covered information as defined by Nevada law. You can still send us an opt-out request using the contact details in Section 16.

14. International users

The Service is intended for users in the United States. [TO COMPLETE: company legal name] is established in the United States [TO CONFIRM], and our service providers store and process information mainly in the United States [TO CONFIRM: hosting and database regions]. Our team may access it from [TO CONFIRM: countries where your team works]. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

[TO CONFIRM WITH COUNSEL: if the business is run from the European Union (for example from France) or targets EU users, the EU GDPR may apply. In that case, add the required GDPR information (legal bases, transfer safeguards, right to complain to a supervisory authority) or a GDPR addendum.]

15. Changes to this policy

We may update this policy from time to time. We'll post the new version on this page with a new effective date, and we'll tell you about material changes by email or in the app before they take effect.

16. Contact us

For privacy questions or to exercise your rights:

• Email: support@shopclic.ai (subject: "Privacy request")
• Mail: [TO COMPLETE: company legal name], [TO COMPLETE: mailing address]

Effective date: [TO COMPLETE: effective date] — version 1.0