Privacy policy

Here we explain, with no small print, what data EmpactAI processes, why, for how long, who with, and how you can decide about it. It applies to this website, the dashboard and the connections to your tools.

Data controller

EPX DIGITAL, S.L. (Empact), Tax ID (CIF) B88672217, Avenida Maisonnave, 41, 3º, 03003 Alicante (Spain). For anything about your data: argos@empact.es.

What data we process and why

Your account

• Name, email, brand and password (stored encrypted as a hash; nobody at Empact can see it).
• To give you access to the dashboard, keep you logged in, notify you by email (requests, replies, payments) and provide support. Legal basis: performance of the contract you accept when you sign up.
• Your phone number, only if you ask us to call you when choosing a plan (it's optional). We use it solely to help you sign up and to provide support, by phone or WhatsApp: never for sales calls, and we never share it with anyone. Legal basis: your consent when you ask us; you can ask us to delete it at any time.
• When you use the dashboard or the website while signed in, we note that your store is online and which screen you have open (not what you do in it), so the Empact team knows you're online and can help you. It's deleted after 30 days. Legal basis: our legitimate interest in giving you support.

Payment and billing

• Plan, billing frequency, payment method, amounts and bank transfer reference. Card details are processed directly by Stripe: they never pass through our servers.
• To charge for the service and meet our tax and accounting obligations. Legal basis: performance of the contract and compliance with a legal obligation.

Your store's and channels' data

• Whatever you authorise when you connect each tool: orders, products, inventory and customers from Shopify; sessions and conversion from Google Analytics; search queries and pages from Search Console; Google Ads and Meta campaigns; Klaviyo flows and campaigns; Merchant Center products and diagnostics; behaviour metrics from Microsoft Clarity.
• To show you your dashboard, have the agents suggest plays, measure what you do, send you alerts and reports, and let ArgosAI answer you. Legal basis: performance of the contract.
• Shopify orders may include data about your customers. For that data you are the data controller and EPX DIGITAL, S.L. acts as data processor: we only use it to provide you with the service, following your instructions and the provisions of the Terms of service.
• The access credentials for each tool (OAuth tokens and API keys) are stored encrypted and are only used to read the data the service needs. They're deleted when you disconnect a source.

Website chat and requests

• What you write in the website chat, your email and name if you leave them, and the page you're writing from. To reply to you (first ArgosAI, then the team) and to email you if you leave. Legal basis: your consent when you write to us.
• What you tell us in dashboard requests, in order to resolve them. Legal basis: performance of the contract.
• Images you attach for ArgosAI (in the dashboard or in the website chat) are sent to our AI provider solely to answer you; from the website chat we keep a thumbnail with the conversation. Voice dictation uses your own browser's speech recognition, which may process the audio on its maker's servers (Google, Apple…): only the text you send reaches us.

«Your score in 60 seconds»

• When you ask for a store's score, we store its address and the result (the score, the sections and the example plays) or the reason it couldn't be read. We only look at what any visitor can see and, for real-world speed, we query Google (Chrome data) with the store's address, nothing else. We keep it so we don't have to read the store again on every request and to count how many scores are requested. Your IP is only used to limit abuse: it isn't stored with the score. Legal basis: our legitimate interest in offering the score and preventing abuse.
• If you press «Send it to me», we store your email, the store, its score, the language you asked in, the version of the text you accepted and the date. We use them to send you the score and so the Empact team can write to you about it. Legal basis: your consent, by ticking the box on the form; if you don't tick it, we store nothing.
• You can withdraw your consent and ask us to delete that data at any time: reply to the score email or write to argos@empact.es. If you don't tell us anything, it's deleted automatically 12 months after the last time you asked for the score.

Where you came to the website from

• Only if you accept the argos_origen cookie: the utm tags of the link you came through, the domain of the website you came from, the first page you saw, the date and whether you went through «Your score in 60 seconds» or the demo. To know which channels bring us customers. Legal basis: your consent, which you can change whenever you like in the cookie policy.
• If you sign up having accepted the cookie, we copy that data to your account and delete the cookie. If you don't accept it, your account is created just the same, without that data. Rejecting it later deletes the cookie, but not what's already in your account: if you want us to remove it, write to argos@empact.es.

Google data: limited use

EmpactAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We only request read permissions for Analytics, Search Console and Google Ads, and the Merchant Center permission to read your products and their diagnostics. We use them solely for the Argos features you see in your dashboard.
• We don't sell that data, we don't use it for advertising and we don't use it to train AI models.
• Nobody on the team reads it unless you ask us to in order to support you, for security reasons or because the law requires it.
• You can revoke access at any time from Settings → Connections or from your Google account (myaccount.google.com/permissions).

Who we share it with

We don't sell or transfer data. To provide the service we use providers that process it on our behalf, under a data processing agreement and with the safeguards required by the GDPR:

Transfers outside the European Economic Area are made under the European Commission's standard contractual clauses or, where the provider is certified, under the EU-US Data Privacy Framework.

How long we keep it

• Account and store data: for as long as you have an account. When you close it, we delete it within 30 days.
• Billing data: for as long as the law requires (generally, 6 years).
• Website chat conversations: 12 months from the last message.
• People who ask for their score by email: 12 months from the last time they asked, or until they ask us to delete it.
• Each store's score result: 90 days.
• Where you came from: 30 days in the argos_origen cookie and, if you sign up having accepted it, for as long as you have an account.
• Credentials for each tool: until you disconnect it.

Your rights

You can ask us for access to, rectification, erasure, restriction of processing and portability of your data, object to its processing, and withdraw your consent at any time, by writing to argos@empact.es. We'll reply within one month. If you believe we haven't handled it properly, you can lodge a complaint with the Spanish Data Protection Agency, AEPD (aepd.es).

How to delete your data from Meta, Google and your other tools

You can remove Argos's access to any tool and delete whatever it imported from it at any time:

1. In your EmpactAI dashboard, go to Settings → Connections and click Disconnect on the tool (for example, Meta Ads). We immediately delete its credentials and the data we had imported from it.
2. If you also want to remove the permission on Meta's side: on Facebook, go to Settings & privacy → Settings → Business integrations, choose Argos Commerce and click Remove. On Google, go to your Google account → Third-party apps & services.
3. To delete your entire account and all its data, write to us at argos@empact.es from your account's email address: we'll delete it within 30 days at most and confirm it by email.

Security

Everything travels encrypted (HTTPS). Your tools' credentials are stored encrypted, each store only sees its own data, the database can't be accessed from outside and every action the Empact team takes on your account is logged.

Changes

If we change anything important in this policy, we'll let you know by email or in the dashboard before it takes effect.