AI Chat Agent for Supplements & Cosmetics

Privacy Policy — AI Chat Agent for Supplements & Cosmetics

Version dated 19 October 2026. This version applies from publication. We give advance notice of material changes as described below.

1. Who we are and what this policy covers

Genius Nutrition SRL, trading as OBSEDIA ("OBSEDIA", "we", "us"), provides AI Chat Agent for Supplements & Cosmetics through the Shopify application AI Chat Agent for Supplements & Cosmetics, its storefront chat widget and the related AI chat pages at https://www.obsedia.ai/.

Registered address: Tamasi nr. 20, Buftea, Ilfov, Romania.
VAT identification number: RO35355847.
General enquiries and support: support@obsedia.ai.
Privacy enquiries and rights requests: privacy@obsedia.ai.

This policy covers that AI chat service and those related pages. Other OBSEDIA products, including any separately offered messaging or marketing apps, are covered by their own notices. A merchant's storefront, Shopify and other third-party services have their own privacy notices.

2. Our role and the merchant's role

We are a controller when we decide how to handle our business contacts, merchant account administration, our own billing and legal records, website enquiries and the security of our business.

For personal data processed to provide a merchant's shopper chat service, the merchant normally determines the purposes and acts as controller. We act as its processor, following documented instructions under the Data Processing Addendum in our Terms of Service: https://www.obsedia.ai/terms/supplements. Where a merchant itself acts as processor for another controller, it must have authority to appoint us as a subprocessor.

The merchant is responsible for telling shoppers how its chat service uses personal data, choosing the applicable lawful basis, obtaining consent where required, setting appropriate permissions and handling shoppers' rights. This policy supports, but does not replace, the merchant's own privacy notice.

3. Information we process and where it comes from

Merchant and store information comes from Shopify, the merchant and authorised staff. Depending on the installation and enabled functions, this includes store identifiers and domain, store contact details made available to the app, locale and currency, authenticated sessions and access credentials, configuration, published product information, selected store content and policies, subscription status, usage and related billing records. Shopify handles its own merchant payment process; we do not receive full payment-card details through our app billing integration.

Shopper chat information comes from the shopper's interactions with the widget and the merchant's store. It includes messages, generated replies, relevant recent conversation context, random or pseudonymous conversation and request identifiers, language and country/market information, and relevant products, product selections or cart actions. The current-product-page feature may send the product identifier for the page being viewed; it does not send the page text, URL query parameters or a full browsing history for that purpose.

When Shopify provides an authenticated logged-in customer ID with a storefront request, we link the associated retained conversation turns to that customer ID. We use this association to help the merchant review conversations and to locate records for data access and deletion requests. An email, name or order reference merely typed in a chat is conversation content and is not proof of the shopper's identity. Guest conversations may remain unlinked to a Shopify customer account.

Messages may contain personal data even where we do not ask for a name or associate the chat with a Shopify customer account. Random identifiers and hashed identifiers do not automatically make a conversation anonymous. A merchant's authorised staff may see retained transcripts where that function is enabled.

Optional functions can process additional data only when available and enabled with the necessary permissions. For example, order support may require order references, contact details used for verification and relevant order or fulfilment information. Optional analytics may use product-line values, counts, timestamps and pseudonymous correlation identifiers. Their availability is not implied by this policy, and a permission granted to the app does not mean every related function is active.

When you contact us, we receive your email address, the details you provide and the correspondence needed to handle the enquiry. Technical requests to our website and service also involve information such as an IP address, browser or device information, request time, authentication or security identifiers and error information, as necessary for delivery, protection and troubleshooting. We seek to keep message content and sensitive information out of general application logs.

4. Why we use information

We process information to:

• Install and authenticate the app, connect the correct merchant store and apply the merchant's settings and permissions.
• Answer shopper questions using relevant store information, maintain conversation continuity, recover interrupted requests and carry out supported shopper actions.
• Make retained conversations available to the same merchant's authorised staff where enabled.
• Administer subscriptions and usage, investigate billing discrepancies and provide support.
• Detect abuse, enforce access controls, diagnose failures and maintain service reliability.
• Respond to privacy requests, carry out deletion and comply with legal obligations.

We do not sell personal data or use shopper chat content for cross-context behavioural advertising. We do not use merchants' catalogues, store content or raw shopper conversations to train public AI models. Personal data from one merchant's service is not made available to another merchant through the app.

5. Lawful bases

For processing where we are controller, our bases under the GDPR, where applicable, are:

• Contract: providing and administering a service requested by an individual who is personally a party to the agreement, or taking requested steps before that agreement.
• Legitimate interests: administering relationships with business customers and their staff, answering enquiries, protecting the service, preventing fraud and resolving disputes, balanced against the affected person's rights.
• Legal obligations: applicable accounting, tax, regulatory and legally required disclosure or retention duties.
• Consent: where a particular optional activity requires it. Consent can be withdrawn without affecting earlier lawful processing.

When we act as processor, we follow the merchant's instructions. The merchant must determine and explain the lawful basis for its shopper processing; accepting these policies is not itself a shopper's consent or a lawful basis for every use of chat data.

Please do not enter medical records, diagnoses, other sensitive health information, payment-card details, identity documents or other highly sensitive information into chat. The app is not a healthcare service. We cannot guarantee that every sensitive detail typed into free text will be detected or removed before processing or storage. Tell the merchant or contact privacy@obsedia.ai if you need help with information already submitted.

6. Who receives information

Information is available only as needed for the stated purposes, including to:

• The merchant and its authorised staff, for their own store's chat service.
• OpenAI, which processes messages, necessary conversation context and relevant store facts to generate AI responses.
• Railway, which provides application hosting and associated database, queue and recovery infrastructure.
• Shopify, for installation, authentication, store integration, privacy workflows and applicable app billing. Shopify also has its own relationship with the merchant.
• Providers supporting our website, business communications and professional administration, for the technical or contact data needed for their services.
• Authorities or professional advisers where disclosure is legally required or necessary to establish, exercise or defend legal claims.

We limit access to what is needed and require appropriate data-protection obligations when a provider acts on our behalf. The merchant processing terms identify the AI service's principal subprocessors and explain notice of changes. Contact privacy@obsedia.ai for the applicable list and transfer information.

7. AI provider processing and international transfers

Our service sends relevant content to OpenAI's API. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer explicitly opts in. We do not authorise such sharing for merchant or shopper content. OpenAI may nevertheless retain content for service security and abuse monitoring, normally for up to 30 days, with longer retention in circumstances described in its applicable policy, such as legal requirements or protection from harm. Our app's own retention limits do not override the provider's rules. See OpenAI's data controls information: https://developers.openai.com/api/docs/guides/your-data.

Providers and authorised support operations may process data outside your country, including in the United States. We do not promise EU-only processing. Where a transfer is restricted by applicable data-protection law, an applicable adequacy decision or appropriate contractual safeguards, such as the European Commission's standard contractual clauses and relevant supplementary protections, must cover that transfer. We provide information about the applicable safeguards, and a copy where required, on request; confidential details may be redacted.

8. Retention and deletion

Different copies serve different purposes:

• Operational chat recovery: encrypted request and result payloads normally have a one-hour recovery window. Related encrypted context and display history can remain available for up to 24 hours, according to their own expiry. They are separate from merchant transcripts.
• Merchant transcripts, where enabled: up to the latest 30 conversation threads, with at most 20 messages per thread. A thread expires 25 days after its first captured turn; adding messages does not extend that expiry. Capacity limits can remove data sooner. The association between a conversation turn and an authenticated Shopify customer ID is retained for up to 25 days from when that turn is accepted and can be removed earlier when a verified deletion request applies. Separate request and deletion records used to prevent duplicate processing do not contain the customer ID or the conversation text.
• Opaque chat deduplication records and certain usage or technical receipts: normally up to 30 days. These records are separate from retained message text. Other minimal security, deletion or legal records may need a different period to fulfil their specific purpose.
• Merchant settings, integration data and relevant store content: while needed to provide the installed service, subject to refresh, deletion and applicable legal duties.
• Support, contract and accounting records: only for as long as needed to resolve the matter, meet applicable legal retention requirements or establish, exercise or defend legal claims.

Expiry restricts live access and expired records are removed through retention processing. Uninstallation and applicable Shopify deletion requests initiate revocation and cleanup of service data. We may retain records that the law requires and minimal evidence needed to honour deletion or security obligations. We do not treat acceptance of a deletion request as proof that every downstream copy has already been erased.

Backups and isolated recovery copies have separate lifecycles. Routine daily database backups use a six-day retention schedule. Manual snapshots and volumes retained during recovery may remain longer until the recovery need or legal hold ends and authorised cleanup is completed. They are not used for ordinary chat access. Deleted data must remain subject to deletion controls if a backup is restored. A live one-hour, 24-hour or 25-day limit does not mean all backup bytes disappear within that time.

OpenAI and Shopify may retain information under their own applicable terms and legal duties. Ask privacy@obsedia.ai about a particular record or deletion request rather than assuming the longest period applies to every copy.

9. Browser storage and website choices

The storefront widget uses browser session storage for random conversation identifiers, keys that permit access to that conversation, display preferences and action/recovery state. This supports continuity between pages in the same browsing session and uses a validity period of up to 24 hours for the saved display state. Browser settings, clearing site data or closing the session can remove that state sooner. Blocking storage may affect continuity.

Starting a new chat changes the active conversation; it does not by itself erase a separately retained merchant transcript or provider security logs. For deletion, use the rights process below.

Any non-essential cookies, analytics or marketing technologies added to our AI chat website pages require their own clear disclosure and, where applicable, a consent choice before use. A merchant is responsible for the privacy and consent configuration of its own storefront and other apps. This policy does not grant consent to optional tracking.

10. Security

We use access controls, authenticated merchant access, tenant separation, restricted database permissions, protected transport and encryption for operational recovery content. We minimise sensitive content in logs and restrict access according to operational need. No service can guarantee absolute security. If a personal-data breach affects data processed for a merchant, we notify that merchant without undue delay after becoming aware, and provide available information to support its legal duties.

11. Your rights and how to contact us

Depending on the applicable law and circumstances, you may request access, correction, deletion, restriction, portability or information about processing; object to processing based on legitimate interests; and withdraw consent where processing relies on it. You may also complain to a competent supervisory authority. In Romania this is ANSPDCP; its complaints information is available at https://www.dataprotection.ro/index.jsp?lang=en&page=Plangeri_meniu. You may also contact the authority in your place of habitual residence or work where the GDPR provides that right.

For a merchant account, website enquiry or other information we control, write to privacy@obsedia.ai. For a shopper chat, contact the merchant whose store you used. We assist that merchant and can help direct a request received by us to the right party.

We may need proportionate information to verify a request and locate the relevant record, such as the store domain, approximate chat date and a conversation reference if available. Please do not initially send identity documents, full payment details or sensitive chat content. Where Shopify has supplied an authenticated customer ID, that association can help us locate the relevant conversation records. For guest or otherwise unlinked conversations, a customer's name or email alone may not identify every transcript; we may need the store domain, approximate chat date, conversation reference or other proportionate verification. We resolve uncertain matches before deleting records so that another person's conversations are not removed.

Where we are responsible for responding under the GDPR, we respond without undue delay and normally within one calendar month of receipt. If the law permits an extension for complexity or volume, we explain the reason and timing within that first month. Rights are subject to applicable legal conditions and exceptions.

Providing information necessary to install or authenticate the app, process a chat or answer a support request may be required for that function. You can choose not to supply it, but we may then be unable to provide the requested function. Please use the merchant's human support channel if you prefer not to use AI chat.

12. Children and decisions

The app is a business service for merchants, and the chat is not directed at children under 16. Merchants must assess the age rules applicable to their audiences and must not configure it to solicit sensitive information from children. If you believe a child has supplied personal data inappropriately, contact the merchant or privacy@obsedia.ai.

The chat generates automated recommendations and responses. It is not intended to make decisions that produce legal or similarly significant effects about a person. Merchants must not use it for that purpose or rely on it for medical, employment, credit, insurance or similar consequential decisions without a separately appropriate lawful service and safeguards.

13. Updates and contact

We update this policy when the service, its processing or the law changes. We identify the version on this page and give merchants advance notice of material changes through their contact details or the app. Where the law requires a new notice, consent or other step before a new use of data, publication alone does not replace that step.

For privacy matters, contact Genius Nutrition SRL, trading as OBSEDIA, at privacy@obsedia.ai or Tamasi nr. 20, Buftea, Ilfov, Romania. For general support, use support@obsedia.ai.