Introduction

Podvector is a print-on-demand business analytics platform with an AI assistant ("Victor") that helps you interpret your sales, ad, and product data and propose changes to your connected stores for your approval. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have. It applies to all users of podvector.ai and its associated services.

Information We Collect

• Account information. Your email address, name, and authentication credentials provided when you sign up or sign in (including via third-party identity providers).
• Connected platform data. When you connect Shopify, Meta Ads, Google Ads, Printify, or Printful, we receive the data those platforms expose under the OAuth scopes you grant — including orders, products, customers, inventory, fulfillments, payments, ad spend, ad performance, and shop metadata.
• AI conversation data. When you chat with Victor, we store your messages, Victor's responses, any charts or proposals Victor generates, and feedback you provide (including decline reasons and notes you attach when rejecting a proposed action).
• Action ledger. When Victor proposes an action on a connected platform (e.g., a Shopify price update or discount), we record the full lifecycle of that proposal — what was proposed, when, who approved or declined it, the outcome of execution, and any error details — in both Firestore and a BigQuery audit log. This ledger exists for safety, support, and accountability.
• Billing information. Subscription status and customer/subscription identifiers from our payments processor (Stripe). We do not store full payment-card numbers on our systems; Stripe handles cardholder data.
• Usage and telemetry data. Basic information about how you use the platform (page visits, feature usage, errors, performance) to operate and improve the service.

How We Use Your Information

• To provide analytics, dashboards, and insights for your business.
• To power Victor's analysis and action proposals, including sending relevant portions of your data to the large language model providers listed under Sub-Processors.
• To execute actions on your connected stores only after you explicitly approve them in the Victor interface.
• To sync, refresh, and maintain your connected platform integrations.
• To process billing and manage your subscription.
• To monitor service health, prevent abuse, and improve the product.
• To communicate with you about your account, service updates, and support.

AI Processing and Automated Decision-Making

• Victor uses third-party large language models (currently Google Vertex AI) to interpret your data and generate responses. To do this, we send relevant portions of your business data and your chat messages to the model provider for the duration of your request.
• Victor may propose actions on your connected stores (such as updating product prices, creating discounts, or modifying collections). These are proposals only. No action is executed against your store until you explicitly approve it in the Victor interface.
• We do not make solely-automated decisions that produce legal or similarly significant effects on you without your involvement. The approval gate ensures a human-in-the-loop for every write action.
• Action proposals, approvals, declines, and outcomes are logged as described under "Action ledger" for safety, audit, and product improvement.
• Model training. We do not provide your chat content or business data to third-party AI providers for training their general models, beyond the inference-time processing described above. We may use anonymized or aggregated information about how features perform to improve our own service.

Sub-Processors

We use the following third-party service providers to deliver the platform. Each is bound by terms that protect your data:

• Google Cloud Platform (including Firebase Authentication, Firestore, BigQuery, Cloud Functions, and Vertex AI) — hosting, data storage, analytics warehouse, and large language model inference.
• Stripe — subscription billing and payment processing.
• Connected platforms you authorize — Shopify, Meta, Google Ads, Printify, and Printful are not sub-processors but are sources of data you grant us access to. They process your data under their own privacy policies.

Data Sharing and Security

• We do not sell your personal data, and we do not share it with third parties except (a) the sub-processors listed above, strictly to operate the service, (b) to comply with valid legal process, or (c) to protect the rights, property, or safety of Podvector, our users, or the public.
• Your data is encrypted in transit (TLS) and at rest.
• Access to production data within Podvector is limited to authorized personnel who need it to operate or support the service.
• When you disconnect an integration, we stop ingesting new data from that platform and honor the platform's data-deletion expectations (for example, Shopify merchant data is purged in response to Shopify's GDPR webhooks customers/redact, customers/data_request, and shop/redact).

Data Retention

We retain your account information, connected platform data, and AI conversation history for as long as your account is active. The action ledger is retained as an audit record for the lifetime of the account. When you delete your account or disconnect an integration, we delete or anonymize the associated data within a reasonable period, except where retention is required for legal, billing, or security purposes.

Your Rights and Choices

Depending on where you live, you may have the following rights with respect to your personal data. To exercise any of them, contact us at the email address below.

• Access. Request a copy of the personal data we hold about you.
• Correction. Request that we correct inaccurate or incomplete information.
• Deletion. Request deletion of your account and associated data. You can also disconnect any integration at any time from your account settings.
• Portability. Request a machine-readable export of your personal data.
• Restriction and objection. Request that we restrict or stop certain processing of your data.
• Withdraw consent. Where processing is based on consent, you may withdraw it at any time.
• California residents (CCPA/CPRA). You have the right to know what personal information we collect, request deletion, and opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising.

We will respond to verifiable requests within the time required by applicable law.

International Data Transfers

Podvector and its primary sub-processors operate in the United States. If you access the service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

Children's Privacy

Podvector is not directed to individuals under 18 years of age, and we do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where required, notify you through the service or by email. Your continued use of Podvector after a change takes effect constitutes acceptance of the updated policy.

Contact

If you have questions about this Privacy Policy or want to exercise any of your rights, contact us at company@podvector.ai.