Privacy Policy
DRAFT — under legal review, not yet finalised.
This policy explains how Sendsmaily OÜ (registry code 12837097, registered address Paldiski mnt 29, 10612 Tallinn, Estonia) ("we", "us", the operator of Smaily Campaign Intelligence, "the Service") handles personal data.
If you are a shopper who received a recommendation email or interacted with a store that uses the Service: the store you bought from is the data controller of your data — we process it on their behalf. Please contact the store first. Section 6 explains how.
1. Who this policy covers
- Merchants — e-commerce stores that connect their catalog, orders and Smaily account to the Service ("you", "the merchant").
- Merchant staff — people who log into the operator/merchant console
(
/admin,/console) on a merchant's behalf. - Shoppers — the merchant's own customers, whose data the Service processes on the merchant's instructions in order to generate recommendations.
- Website visitors — people who fill in the "request early access" form on this website.
2. What data we process, and why
2.1 On behalf of merchants (we are the processor, the merchant is the controller)
To generate and send product recommendations, the Service ingests and stores the following categories of data, scoped to each merchant:
| Category | What it contains | Why we process it |
|---|---|---|
| Product catalog | SKU, name, description, category, price, images, stock status, tags | To know what can be recommended |
| Orders & order items | Purchase history, amounts, discounts | To learn buying patterns and time replenishment reminders |
| Customers | Email address, purchase/engagement history, an inferred segment (e.g. "loyal", "lapsed"), engagement score | To personalise which products are recommended to whom |
| Email events | Opens, clicks, bounces, unsubscribes, complaints from campaigns sent through the merchant's Smaily account | To learn what works and stop recommending to people who disengage |
| Browse events | Product views, category views, searches, cart adds on the merchant's storefront | To improve recommendations before a first purchase (kept for a shorter period — see Section 4) |
| Campaign statistics | Aggregate performance of Smaily campaigns | To report engine-attributed revenue to the merchant |
We never sell this data, and we do not use it for any purpose other than operating the Service for the merchant that supplied it.
Holdout measurement. For merchants who enable it, a small, randomly and permanently assigned share of that merchant's customers (chosen by hashing an internal customer ID, not by any personal characteristic) is deliberately excluded from personalised recommendations for a period, and continues to receive only whatever generic content the merchant already sends. This lets the merchant see the recommendations' actual impact compared to no recommendations, rather than assuming credit for purchases that would have happened anyway. It changes only which content a customer receives, never what data about them we collect or how it is protected.
2.2 Merchant staff accounts
Login is via magic-link email (Supabase Auth). We store an email address and an operator/editor/viewer role per console user. No password is stored by us.
2.3 Website visitors (this website)
The "request early access" form on this website collects your email address and, optionally, your name, a website URL and a message. We use it to follow up about onboarding your store. We do not push this data to any email-marketing platform automatically.
2.4 Recommendation links and cookies
Each product link in a recommendation email carries a short-lived
identifier (a smaily_vt parameter, valid 90 days) that lets us recognise,
when a shopper clicks through and later buys, that the purchase followed
that recommendation. The merchant's store plugin may store this identifier
in a cookie in the shopper's browser between the click and checkout, for
that same attribution purpose. The Service itself does not set any
advertising or cross-site tracking cookie.
3. AI-assisted processing
Three features use a third-party AI model (Anthropic's Claude), always as part of a process a member of your staff explicitly starts, or a scheduled job that only ever sees the data categories described below:
- Product tag enrichment (
claude-opus-4-8) — infers structured tags (e.g. species, pack size) from a product's SKU, name and category. Only product data is sent; no shopper data. - CSV column mapping (
claude-haiku-4-5) — during the onboarding import wizard, suggests how spreadsheet columns map to our schema. Column headers (e.g. "email", "first_name") are sent as-is — they are not personal data — but for customer and order spreadsheets, the sample values from your file are never sent: each column's data type (email, date, amount, ...) is inferred locally on our server, and only synthetic, made-up example values of the same type (e.g.firstname.lastname@example.com) are sent to the AI model to produce mapping suggestions. For catalog spreadsheets (product data — no shoppers involved) real sample values are sent, since there is nothing personal to protect. - Campaign performance AI report — on request, summarises a merchant's
own campaign statistics (send volume, open/click rates, unsubscribes)
and engine-attributed revenue totals (
claude-haiku-4-5). Only campaign-level aggregates are sent; no individual shopper is identified or included.
No shopper or merchant personal data is ever sent to the AI model. Because of that, this processing does not involve an international transfer of personal data, even though Anthropic is a US company (see Section 5).
Under Anthropic's standard commercial API terms, data submitted through the API is not used to train their models. [TODO — Erkki to confirm the current Anthropic API/DPA terms before publishing and link the applicable agreement.]
4. How long we keep data
| Data | Retention |
|---|---|
| Browse events (page/product views) | 90 days, then deleted automatically |
| Email events (opens/clicks/etc.) | 365 days, then deleted automatically |
| Internal decision log (why a recommendation was chosen) | 30 days, then deleted automatically |
| Issued recommendations | 2 years, then deleted automatically |
| Purchase-attribution records | 2 years, then deleted automatically |
| Customers, orders, catalog | Kept for as long as the merchant uses the Service, or until deleted under Section 6 |
When a merchant relationship ends, all of that merchant's data across every table we use is permanently deleted in a single operation (a one-time export is kept for the merchant's own records beforehand). A minimal, hashed record that the deletion happened is kept in our compliance log — it no longer contains a readable email address. See [docs/RUNBOOK_tenant_offboarding.md] internally.
5. Who else processes this data (sub-processors)
| Sub-processor | What they do | Where |
|---|---|---|
| Vercel | Hosts the application and runs the scheduled jobs that compute recommendations | Vercel Inc. (USA) |
| Supabase | Hosts the database, file storage and staff login | Supabase Inc. (USA); this project's database currently runs in the EU (Ireland) |
| Anthropic | Processes the AI requests described in Section 3 — receives only product/catalog data and aggregate campaign statistics, never shopper or merchant personal data | Anthropic PBC (USA) |
| Smaily | The merchant's own email marketing account. We write recommendation data into the merchant's Smaily contacts as custom fields so their campaigns can use it, and we read campaign/email-engagement statistics back from Smaily's API. | Smaily (Estonia) |
[TODO — Erkki: confirm the international-transfer safeguard for Vercel and Supabase (the two non-EU sub-processors that do handle personal data) — e.g. Standard Contractual Clauses / EU-U.S. Data Privacy Framework — and add here. Anthropic is excluded: as described in Section 3, no personal data reaches it.]
6. Your rights
Shoppers: because the merchant is the controller of your data, please contact the store you bought from first. The Service gives every merchant the technical means to, on your request:
- Access — export everything stored about you in JSON format.
- Erasure — permanently delete everything stored about you.
- Object to profiling — opt you out; you will no longer receive personalised recommendations.
If a merchant is unresponsive, you may also contact us directly at info@smaily.com and we will assist, or you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
Merchants and website visitors: contact us at info@smaily.com to access, correct or delete your own account data, or to withdraw consent.
7. Security
Merchant Smaily credentials are stored encrypted, never in plain text. Every database table is scoped per merchant with row-level security, so one merchant's data is never visible to another. API access requires a secret key issued per integration, which can be revoked individually at any time.
8. Changes to this policy
We may update this policy as the Service evolves. Material changes will be reflected here with an updated date at the bottom of the page.
9. Contact
Sendsmaily OÜ Registry code: 12837097 Paldiski mnt 29, 10612 Tallinn, Estonia info@smaily.com
Last updated: 2026-07-24