GDPR Compliance

For a merchant's own account and billing data, Aurevia acts as a data controller. For the shopper and store data a merchant syncs to run the AI widget — catalog, order details, conversation content — Aurevia acts as a data processor, and the merchant is the controller responsible for their own customers' data.

• Contract: processing needed to provide the service a merchant subscribed to.
• Legitimate interests: securing the service, preventing abuse, and improving the product, balanced against your rights.
• Consent: for optional cookies or communications, where applicable.
• Legal obligation: where we must retain or disclose data to comply with law.

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion, subject to legal or contractual retention needs.
• Portability — receive your data in a portable format, where technically feasible.
• Restriction — limit how we process your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing relies on consent, at any time.

Merchants can request account data changes or deletion directly from their dashboard, or by emailing [email protected]. Shoppers who chatted with Aurevia on a merchant's store should first contact that merchant, since they control the underlying customer relationship — but you can also reach us directly and we'll forward the request. We respond within one month, as required by law.

Merchants who need a signed Data Processing Agreement (DPA) for their own compliance review can request one through our contact form or by emailing [email protected].

We use a limited set of sub-processors for hosting, database, AI model inference, and email delivery, each bound by data processing terms consistent with GDPR. A current list is available on request.

Where personal data is transferred outside the UK or EEA — for example to a hosting or AI provider — we use Standard Contractual Clauses or an equivalent legally recognized safeguard.

If a personal data breach occurs that's likely to result in a risk to your rights, we'll notify the relevant supervisory authority within 72 hours where required, and notify affected merchants without undue delay.

If you're unhappy with how we've handled your data, you can lodge a complaint with your local data protection authority — in the UK, the Information Commissioner's Office (ICO).

[email protected] — Aurevia Artificial Intelligence Ltd.