Privacy Policy.

Introduction

Vortex IQ Ltd (“Vortex IQ”, “we”, “us”) builds the AI Operating System for e-commerce. This policy explains, in plain English, what personal data we handle when you visit our site, talk to our team, or use the platform, and the choices you have.

For the data inside your store that you connect to Vortex IQ, you are the data controller and we act as your processor under a Data Processing Agreement. For your own account and our website, we are the controller.

Information we collect

We keep collection to what we genuinely need to run the service and support you:

• Account & contact details: name, work email, company, and role when you sign up or enquire.
• Commerce & usage data: store, catalogue, and operational data you connect, plus how you use the platform.
• Technical data: IP address, device, browser, and log data collected automatically for security and performance.
• Communications: messages, support tickets, and demo requests you send us.

How we use your information

We use your data to provide and improve the platform, run AI agents that detect, explain, and fix issues in your store, respond to enquiries, keep accounts secure, meet legal obligations, and send relevant product updates. We do not sell your personal data.

Legal bases (UK GDPR)

Where we act as controller, we rely on one of these lawful bases:

• Contract: to deliver the service you have signed up for.
• Legitimate interests: to secure, improve, and market our products, balanced against your rights.
• Consent: for optional cookies and certain marketing, which you can withdraw at any time.
• Legal obligation: where the law requires us to retain or disclose information.

Cookies & tracking

We use cookies and similar technologies to keep the site working, understand usage, and measure marketing. You control non-essential cookies through our consent banner. For the full breakdown of categories and how to manage them, see our Cookie Policy.

Sharing & sub-processors

We share data only where needed to run the service: with vetted sub-processors such as cloud hosting, AI model, analytics, and customer-support providers, all bound by contract to protect your data. We may also disclose information where required by law or as part of a corporate transaction. A current list of sub-processors is available on request.

For store-experience testing (Prism) and the VortexIQ Browser Agent, these providers process test data:

• Anthropic (Claude API): AI model provider. Processes page content and screenshots from tests. Location: United States.
• Microsoft Azure: hosts the test service. Location: United States.
• Amazon Web Services: search index for test results. Location: United States (us-east-1).
• Google Cloud: file storage.

Data retention

We keep personal data only for as long as we need it for the purposes above, or as required by law. Account data is retained while your account is active and for a limited period afterwards; some records are kept longer to meet legal, accounting, or security obligations.

International transfers

We are based in the UK and process data in the UK, the EEA and the United States. The store-testing service and its AI model provider (Anthropic) are in the United States. Where data is transferred outside the UK or EEA, we put appropriate safeguards in place (the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses) so your data stays protected.

Your rights

Under UK GDPR you can request to:

• Access a copy of the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete your data, or restrict and object to certain processing.
• Port your data, and withdraw consent where we rely on it.

To exercise any right, email privacy@vortexiq.ai. You also have the right to complain to the UK Information Commissioner's Office (ICO).

Security

We protect your data with encryption in transit and at rest, access controls, monitoring, and regular testing. Vortex IQ is ISO 27001 certified. You can learn more about our controls in our Trust Centre. No system is perfectly secure, but we work hard to keep your data safe.

Children

Vortex IQ is a business product not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

We may update this policy as the product and the law evolve. When we make material changes we will update the date above and, where appropriate, let you know directly. Please check back from time to time.

Contact

Questions about this policy or how we handle your data? We are happy to help: the details are in the block below.

Ask Viq website assistant

Ask Viq helps you find public information about Vortex IQ. It does not read your connected store, access customer records or perform merchant actions. Please do not enter passwords, API keys, customer data or other sensitive information.

We send your question, limited recent conversation context and eligible public routing options to TypeSafe AI through the Jev API to classify the request. We send your question, limited context and relevant public website content to Google through the Gemini API when an explanation is needed. Gemini can also classify requests when Jev is not configured, unavailable or uncertain. We remove recognisable contact details and URLs and block obvious credentials before model processing, but automated filtering cannot identify every kind of personal information. TypeSafe processes this information under its privacy policy and data processing terms; Google processes it under the Gemini API terms. These website developer APIs are separate from our connected-store platform’s enterprise model services.

Vercel hosts the assistant and processes request and browser signals for rate limiting and bot detection. We also store questions, answers, limited conversation context, page links, timestamps, response status and an anonymous conversation reference for staff quality review, troubleshooting and improving the assistant. Recognisable credentials are omitted and recognisable contact details are redacted, but automated filtering cannot identify every kind of personal information.

These records include the request IP address and approximate country, region and city supplied by Vercel from the IP address. They do not include device GPS coordinates. IP addresses may be shared or masked by a VPN; an IP address or conversation reference does not establish a person’s identity. IP and location metadata are not added to the model prompt.

Conversation records are stored in private Vercel Blob storage in the London region and are accessible only to authorised staff and server processes. They are scheduled for deletion after 30 days by a daily cleanup. Staff exports must be kept access-restricted and removed when their review purpose is complete. Hosting and model providers may retain separate service and security records under their applicable terms.

The visible conversation is kept in browser memory and clears when you refresh or select Clear chat. This resets the visible chat and conversation reference; it does not delete stored review records or information already processed by service providers. You can browse the website without using Ask Viq. To ask about or request deletion of a chat record, contact privacy@vortexiq.ai with the chat reference shown in the panel and its approximate date.

VortexIQ Browser Agent (Chrome extension)

The VortexIQ Browser Agent is an optional Chrome extension that lets Vortex IQ run store-experience tests (for example “search for a product”, “add to basket”, “log in”) in your own Chrome browser, on your own store, when you start a test from the Vortex IQ app.

When it is active

The extension does nothing until you agree to the in-extension disclosure and connect it to your Vortex IQ account. After that it only acts while a test you started is running, and only in tabs it opens itself. It only opens the website(s) of the store under test; any other site is blocked during a test.

What it reads during a test, on your store’s pages only

• The page’s text, structure and links, and the labels and values of form fields. Password, payment card and one-time-code fields are hidden and never read.
• Screenshots of the test tab.
• Console and network errors, page load timings and accessibility check results for that page.
• The page address (URL) and title.

What it never reads

Cookies, local storage of websites, saved passwords, browsing history, bookmarks, or any tab it did not open for a test. It does not run in the background on other websites.

Login tests

If a test needs to sign in to your store, the login details you saved in Vortex IQ are typed into your store’s login form by our service. They are not shown to the AI model and are not stored in test logs.

Purchases

During a test the extension refuses to press “place order”, “pay now” and similar buttons, so a test cannot complete a purchase.

Where the data goes

Test data is sent over HTTPS to Vortex IQ’s test service and processed by our AI model provider (Anthropic) to run the test and write the results. Results, screenshots and the test report are saved to your Vortex IQ account (including your Vortex Memory) so you can review them.

Stored on your device

The extension keeps on your computer: its connection token, your settings and consent, visual comparison baselines, and a short log of the last 50 technical errors (no page content). The error log only leaves your device if you choose “Copy for support” and send it to us.

Retention

Screenshots held by the test service are deleted after 30 days. Test results and the copies saved to your Vortex IQ account are kept for 90 days, or until you delete them or close your account.

Your control

You can disconnect the extension in the Vortex IQ app, withdraw consent in the extension’s settings (it then stops connecting), or remove the extension from Chrome at any time. Removing it deletes the data it stored on your device. To delete test data held by Vortex IQ, contact privacy@vortexiq.ai.

Roles

For your store’s pages and any customer data shown on them, Vortex IQ acts as your processor (see section 01).

Limited Use

Data collected by the VortexIQ Browser Agent is used only to provide and improve the store-testing feature you use it for. We do not sell it, do not use or transfer it for advertising, credit-worthiness or lending purposes, and do not transfer it to third parties except as needed to provide this feature (the sub-processors in section 06), to comply with the law, or as part of a merger or acquisition. Our people do not read it except with your permission, for security purposes, or to comply with the law. The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.