Privacy policy

This policy explains what Hephon Commerce does with personal data. Hephon Commerce is a shopping assistant that retailers put in their apps, websites and chat channels. It is operated by Hephon ("we", "us").

Who is responsible for your data

• If you shop with a retailer through its assistant, the retailer is the controller of your data and decides why it is collected. We process it on the retailer's behalf, under a data processing agreement (DPA), and only to run the assistant for that retailer. Questions about your shopping data, your orders or your account with the retailer go to the retailer first; we help them answer.
• If you work for a retailer and sign in to the admin, we are the controller of your account data (name, email, sign-in records).

What we process for shoppers

• Messages you send to the assistant, by text or voice, and its replies. Voice is turned into text by a speech service and the assistant works from that text.
• Basket and order activity: products you look at, add or remove, and what you hand to the retailer at checkout.
• Identifiers the retailer passes to us, such as its own customer id for you, so the assistant can continue a conversation on another device. We do not ask for your name, address or payment details.
• Technical data: IP address (used for an approximate city and to stop abuse), browser type and timestamps.
• Preferences you agree to have remembered, such as dietary needs, only if the retailer turns this on and you say yes.

Phone numbers and email addresses you type in a message are masked in the stored copy when the retailer keeps masking on, which is the default.

Why we process it

• To answer your questions, search the retailer's catalog and fill your basket.
• To hand a conversation to a person at the retailer when you ask for one.
• To keep the service secure and stop abuse (rate limits, fraud signals).
• To measure and improve the assistant for that retailer: reply quality, failed searches, speed. We do not use your conversations to train AI models, and we do not sell your data or use it for advertising.

Who sees it

• The retailer you are shopping with, through its admin and its systems.
• Our subprocessors, only as far as each needs to provide its part of the service. The current list is on the subprocessors page.
• Authorities, when the law requires it.

How long we keep it

• Conversations, baskets and the insights drawn from them: 365 days after the last message by default. Each retailer can set a shorter period.
• Usage and billing records (no message content): 25 months.
• Traces used to debug the assistant: kept by our tracing provider for the shortest period it offers, and deleted with the conversation.
• Backups roll over within 30 days.

Your rights

Depending on where you live (for example the EU GDPR, Saudi Arabia's PDPL, the UAE's data protection law or Lebanon's Law 81/2018), you can ask to access, correct or delete your data, or object to how it is used. Ask the retailer, or write to us and we will pass it on. When a retailer asks us to delete a shopper's data, we delete the conversations, profile and traces within 30 days, and tell the retailer's connected systems that the data was deleted.

Transfers

Some subprocessors are outside your country, including in the United States and the European Union. We rely on the safeguards each one offers (such as standard contractual clauses) and send each only the data it needs.

Security

Data is encrypted in transit, secrets and connector credentials are encrypted at rest, and access to production is limited to the staff who run it. Each retailer's data is kept apart from every other retailer's.

Children

The assistant is meant for adults shopping. It does not knowingly collect data from children.

Contact

Email privacy@hephon.ai with any question about this policy or your data. We answer within 30 days.

We will post changes here and update the date above. Material changes are announced to retailers in advance.