Obsedia Email Privacy Policy
Version 1.1 · Last updated: 22 October 2026 · Effective from first publication
1. Who we are and how to contact us
Obsedia Email is provided by Genius Nutrition SRL, trading as OBSEDIA, VAT number RO35355847, with its registered business address at Tamasi nr. 20, Buftea, Ilfov, Romania. In this policy, “OBSEDIA”, “we”, “us” and “our” refer to that company.
Privacy requests: privacy@obsedia.ai. Service and account support: support@obsedia.ai. Our website is www.obsedia.ai.
This policy covers the Obsedia Email Shopify application, its email creation and delivery features, enabled storefront components, support and related service administration. Other OBSEDIA products and independently operated merchant stores have their own notices. A third-party website, email provider or Shopify service is not governed by this policy merely because the application links to it.
2. Our role and the merchant's role
Merchant customer information. The merchant ordinarily determines why its customers' information is used, which customers are eligible for a campaign, its content and the automations to enable. The merchant is the controller and OBSEDIA processes this information on its documented instructions. If the merchant itself acts as a processor for another organisation, it must have authority to appoint us as a subprocessor. Our Data Processing Agreement sets out these obligations.
Our own business information. We act as a controller for information necessary to manage our business relationship with merchants and their representatives, provide support, secure our service, administer our own financial records, prevent abuse and comply with law. A service record does not become our own controller data simply because we store it: identifiable customer lists, email engagement and campaign content remain subject to the merchant's instructions and the DPA.
If you receive a merchant's email, its privacy notice explains its purposes and legal basis. Contact that merchant first about its campaigns, purchases or customer records. You may also contact us; we will route and assist with a request as appropriate and respond directly when required by law.
3. Information processed by the application
The information processed depends on permissions granted by Shopify, available store data and features the merchant actually uses.
Merchant accounts and representatives: store domain and identifiers; account and authorised-user identifiers; business contact information provided to us; installation status, authorisation scopes and authentication/session records; store settings, sending-domain configuration, sender name, Reply-To, business postal address and footer configuration; support communications; usage, credit balances and Shopify billing references. We do not receive or store payment-card numbers used to pay Shopify.
Contacts and marketing preferences: email address; first and last name when available; Shopify customer identifier; country, tags and audience membership; email-marketing subscription status, source and date; opt-outs, suppression reason and related eligibility evidence; relevant order count and spending aggregates. CSV imports are merchant-supplied data, not independently verified permission to market.
Campaigns and creative material: briefs, chat messages, uploaded images, generated content, subject lines, preheaders, HTML, revisions, saved templates, selected products, prices, product links, offers and discount references. These may contain personal information if a merchant includes it. Do not upload confidential personal documents or sensitive images for use as email creative.
Commerce and lifecycle information: authorised product and variant information; limited customer, order, checkout and recovery information; purchase and fulfilment events; product-interest preferences; relevant product, browse or cart activity and timestamps; automation settings, eligibility checks, runs and delivery records. Depending on an enabled workflow, this can include customer and order identifiers, email address, order value/currency, product identifiers, last-order date, recovery links and event facts. Historical-order access is used for authorised lifecycle functions, including longer winback periods, rather than an unrestricted secondary use of a store's order history.
Delivery and engagement: recipient and campaign references; sending and delivery timestamps; provider message identifiers; submission results; delivery, hard-bounce and complaint events; unsubscribe actions; email opens and clicks where tracking is included; attribution records associated with relevant store orders. Email tracking can reveal that a message was opened or a link followed. Privacy proxies, image caching and automated scanners affect its accuracy; it is not a reliable record of a person's intentions.
Technical and security information: request and authentication metadata, IP addresses where received by our infrastructure, browser or user-agent information where supplied, access records, status/error codes, timestamps, operational counters and abuse/security reports. Our authenticated application access journal records the acting user, store, route category, action and outcome; it is not designed to copy request bodies, contact lists or authentication headers into that journal.
We do not require payment-card details, government identifiers, account passwords, medical records or special-category personal data to create marketing emails. Merchants must not submit these categories, or personal data about children, unless separately agreed in writing with all required safeguards. Product descriptions concerning health or cosmetics must not be used to infer or record a particular recipient's medical condition.
4. Where information comes from
Sources include the merchant and its authorised users; Shopify APIs and authenticated webhooks; consented storefront interactions when enabled; recipient unsubscribe, open and click actions; delivery-feedback services; our hosting/security systems; support correspondents; and public product or website content requested by the merchant. We do not obtain campaign audiences by buying lists from data brokers.
5. Purposes and legal bases
For customer data processed on behalf of a merchant, we provide the service on its documented instructions. The merchant must identify the lawful basis, provide notices and obtain any necessary marketing and tracking consent. Installing the application is not consent from the merchant's customers.
For our controller activities, we rely on the following bases, as applicable:
- Performing a contract with an individual merchant, or steps that person requests before a contract, for account administration and requested services.
- Legitimate interests in managing business relationships with a merchant's staff, answering support requests, protecting our systems, preventing fraud, maintaining proportionate operational evidence and establishing or defending legal claims. We consider the effects on individuals and do not treat this basis as permission for unsolicited customer campaigns.
- Legal obligations for accounting, tax, regulatory requests and other mandatory records.
- Consent where required for optional marketing or nonessential technologies. Consent can be withdrawn without affecting earlier lawful processing.
We use store information to synchronise authorised data, build and edit emails, manage templates, evaluate selected audiences, provide requested automations, send merchant-authorised messages, process feedback and opt-outs, report campaign results, administer usage and support privacy requests. We may use information rendered genuinely anonymous for service reliability and statistics. Pseudonymised customer identifiers remain protected personal data where they can be linked to a person.
6. Consent, unsubscribe and storefront features
The service's marketing eligibility requires recorded email-marketing consent and excludes unsubscribed or suppressed contacts. A purchase, account creation, product-alert sign-in or CSV row alone does not establish consent. Where a storefront form also requests marketing subscription, its wording must make that choice clear and the required affirmative action must be recorded.
Merchants must identify themselves, maintain accurate company and postal information, honour objections and retain evidence supporting each audience's permission. They must not remove or disguise the service's unsubscribe mechanism or use a new import to evade an opt-out. A suppression may also protect against hard bounces, complaints, privacy requests or abuse.
An unsubscribe stops marketing eligibility; it is not necessarily a request to erase every record, cancel an order or unsubscribe from another merchant. A minimal suppression record may be kept to honour that choice. To opt out of a merchant's emails, use its email's unsubscribe link or contact the merchant. Contact us if that mechanism does not work.
Where storefront activity collection is enabled, the application verifies the Shopify customer context and relevant consent/permission signals before accepting eligible activity. Product interests and preferences are used for the merchant's requested functions. Merchants are responsible for the wording and placement of their notices and for complying with laws governing tracking pixels, similar technologies and electronic marketing. A marketing subscription is not represented as consent to unrelated tracking.
7. AI-assisted creation
When a merchant uses AI features, relevant instructions, chat history, the current email draft, selected store facts and any requested image references may be transmitted to our listed AI service provider to produce or edit content. The campaign assistant's ordinary tools do not provide a full recipient list or unrestricted customer order records to the text model. Nevertheless, content typed or uploaded by a user can contain personal data; users must minimise it.
We do not authorise the training of general-purpose AI models on merchant customer data, sell such data, or reuse one merchant's identifiable information to create campaigns for another merchant. Provider processing, security monitoring and temporary storage are governed by the applicable provider terms and transfer safeguards. The use of a nonstored response option does not mean every provider log or temporary processing copy is immediately erased. We do not promise a zero-data-retention or EEA-only AI configuration unless separately agreed and verified for the relevant service.
AI suggestions require merchant review. The service does not make decisions with legal or similarly significant effects about recipients. Audience rules and lifecycle eligibility may constitute ordinary marketing segmentation or profiling; the merchant is responsible for explaining its own use and honouring the right to object to direct marketing.
8. Recipients and service providers
We disclose data only where needed to operate the requested service, comply with law or protect legitimate legal interests. Recipients include authorised merchant users; contracted infrastructure, delivery, AI, operational monitoring and other service providers; professional advisers under appropriate confidentiality; authorities with a lawful basis; and a successor in a merger, reorganisation or transfer of the relevant business subject to applicable safeguards.
Our Subprocessor List identifies core providers and their functions. Shopify has its own legal relationship with the merchant and processes platform, identity and billing information under its own terms. The recipient's mailbox service, internet providers and operators of links or external images also receive information through the normal operation of email and the merchant's content.
Images intended for email delivery can be accessible through public, unguessable asset URLs so that recipients' email clients can display them. An unguessable URL is not access control for confidential information. Email can be forwarded, downloaded, cached or retained by a recipient; those copies cannot be remotely recalled by OBSEDIA.
We do not sell personal data or share it for another business's cross-context behavioural advertising. We do not disclose merchant customer lists to third parties for their independent marketing.
9. International processing
OBSEDIA is established in Romania. The application and database currently use a European hosting deployment, and the configured email sending service uses AWS's Ireland region. This does not mean every service provider, support operation, image-processing operation or recipient mailbox is located exclusively in the EEA.
Where a restricted international transfer occurs, we must use an applicable adequacy decision or appropriate safeguards, such as the European Commission's relevant standard contractual clauses and additional measures where necessary. We assess the actual recipient and transfer rather than treating a provider's general certification as proof that every transfer is covered. UK or Swiss rules apply where relevant. Contact privacy@obsedia.ai for information about the safeguards that apply to your data, including a copy subject to appropriate redactions.
10. Retention, deletion and backups
We retain information only for an identified service purpose, a valid instruction, a legal requirement or a proportionate need to resolve security, billing or legal matters. The Retention and Deletion Policy gives the criteria, limits and exceptions for different records.
Shopify uninstall and privacy events have different functions. An uninstall stops authorised store activity; it does not itself establish that every data copy has already been erased. Authenticated Shopify customer-erasure and shop-redaction requests are processed with safeguards for identity, reinstallations and incomplete delivery or accounting outcomes. Where an outcome needs reconciliation, affected sending is blocked and the outstanding issue must be reviewed. A hold is not a completed deletion and cannot be used to retain unrelated customer information indefinitely.
Privacy exports expire after seven days. Identifying fields and payloads are removed from completed privacy-request receipts; residual deduplication receipts expire after 30 days. Limited tenant-specific deletion-prevention hashes may remain while needed to prevent unlawful reimport. Backups and provider-controlled records follow their applicable lifecycle and restricted-use rules. A restored backup must not reactivate erased or opted-out contacts. We cannot delete a recipient's independent email copies or guarantee that an external email client's image cache is immediately refreshed.
11. Security
We apply technical and organisational measures proportionate to the data and risks, including authenticated store access, tenant-scoped operations, checks on signed integrations, protected credentials, access records and controls over privacy and delivery workflows. Public application traffic uses HTTPS. The Security Overview describes the application controls and each party's responsibilities.
No service can guarantee absolute security, uninterrupted availability or immunity from unauthorised access. A supplier's certification is not a certification of OBSEDIA. We do not claim an OBSEDIA ISO 27001, SOC 2, HIPAA certification or independently audited restoration guarantee on the basis of using a certified supplier.
12. Your rights
Depending on the applicable law and our role, individuals may request access, correction, erasure, restriction, portability, information about disclosures or an objection to processing. Where we rely on consent, they may withdraw it. Where information is used for direct marketing, they may object to that use, including related profiling.
Send a request to privacy@obsedia.ai and identify the relevant store if known. We may request proportionate information to verify identity and authority, without requiring excessive identification. An authorised representative may act where law permits. When a merchant controls the information, we will assist it rather than independently change its lawful records without authority. We will explain any applicable exemption, refusal or need for more time and respond within the legally required period. Exercising a right does not require purchasing a service.
You may complain to your competent data-protection authority. Our Romanian supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP). This does not restrict your right to contact an authority in your place of residence or work, or to seek a judicial remedy.
For residents covered by US state privacy laws, we act as a service provider or contractor for merchant customer information as applicable and as a business/controller for our own account operations. Applicable rights may include access, deletion, correction, portability, a permitted appeal and freedom from unlawful discrimination. We do not sell or share information for cross-context behavioural advertising, so we do not offer such an activity as a default feature. We will honour legally applicable preference signals and rights rather than treating this notice as a waiver. This paragraph does not assert that every state law applies to our business.
13. Cookies and similar technologies
Shopify and the application use necessary authentication, request-security and interface-state technologies. Enabled email tracking and storefront components are described above. This application notice does not state that all technologies on the separate www.obsedia.ai website are necessary or cookie-free; the website's own notices and consent settings govern those technologies. Optional analytics or advertising technologies require a separate assessment and any legally required choice before deployment.
14. Changes and contact
We will update this policy when relevant processing changes and show the revised date. Material changes will receive additional notice where required. A change does not retrospectively authorise incompatible processing or replace legally required consent.
Contact: Genius Nutrition SRL / OBSEDIA, Tamasi nr. 20, Buftea, Ilfov, Romania. Privacy: privacy@obsedia.ai. Support: support@obsedia.ai.