Privacy Policy.

Introduction

Vortex IQ Ltd (“Vortex IQ”, “we”, “us”) builds the AI Operating System for e-commerce. This policy explains, in plain English, what personal data we handle when you visit our site, talk to our team, or use the platform, and the choices you have.

For the data inside your store that you connect to Vortex IQ, you are the data controller and we act as your processor under a Data Processing Agreement. For your own account and our website, we are the controller.

Information we collect

We keep collection to what we genuinely need to run the service and support you:

• Account & contact details: name, work email, company, and role when you sign up or enquire.
• Commerce & usage data: store, catalogue, and operational data you connect, plus how you use the platform.
• Technical data: IP address, device, browser, and log data collected automatically for security and performance.
• Communications: messages, support tickets, and demo requests you send us.

How we use your information

We use your data to provide and improve the platform, run AI agents that detect, explain, and fix issues in your store, respond to enquiries, keep accounts secure, meet legal obligations, and send relevant product updates. We do not sell your personal data.

Legal bases (UK GDPR)

Where we act as controller, we rely on one of these lawful bases:

• Contract: to deliver the service you have signed up for.
• Legitimate interests: to secure, improve, and market our products, balanced against your rights.
• Consent: for optional cookies and certain marketing, which you can withdraw at any time.
• Legal obligation: where the law requires us to retain or disclose information.

Cookies & tracking

We use cookies and similar technologies to keep the site working, understand usage, and measure marketing. You control non-essential cookies through our consent banner. For the full breakdown of categories and how to manage them, see our Cookie Policy.

Sharing & sub-processors

We share data only where needed to run the service: with vetted sub-processors such as cloud hosting, AI model, analytics, and customer-support providers, all bound by contract to protect your data. We may also disclose information where required by law or as part of a corporate transaction. A current list of sub-processors is available on request.

For store-experience testing (Prism) and the VortexIQ Browser Agent, these providers process test data:

• Anthropic (Claude API): AI model provider. Processes page content and screenshots from tests. Location: United States.
• Microsoft Azure: hosts the test service. Location: United States.
• Amazon Web Services: search index for test results. Location: United States (us-east-1).
• Google Cloud: file storage.

Data retention

We keep personal data only for as long as we need it for the purposes above, or as required by law. Account data is retained while your account is active and for a limited period afterwards; some records are kept longer to meet legal, accounting, or security obligations.

International transfers

We are based in the UK and process data in the UK, the EEA and the United States. The store-testing service and its AI model provider (Anthropic) are in the United States. Where data is transferred outside the UK or EEA, we put appropriate safeguards in place (the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses) so your data stays protected.

Your rights

Under UK GDPR you can request to:

• Access a copy of the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete your data, or restrict and object to certain processing.
• Port your data, and withdraw consent where we rely on it.

To exercise any right, email privacy@vortexiq.ai. You also have the right to complain to the UK Information Commissioner's Office (ICO).

Security

We protect your data with encryption in transit and at rest, access controls, monitoring, and regular testing. Vortex IQ is ISO 27001 certified. You can learn more about our controls in our Trust Centre. No system is perfectly secure, but we work hard to keep your data safe.

Children

Vortex IQ is a business product not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

We may update this policy as the product and the law evolve. When we make material changes we will update the date above and, where appropriate, let you know directly. Please check back from time to time.

Contact

Questions about this policy or how we handle your data? We are happy to help: the details are in the block below.

Ask Viq website assistant

Ask Viq helps you find public information about Vortex IQ. It does not read your connected store, access customer records or perform merchant actions. Please do not enter passwords, API keys, customer data or other sensitive information.

We send your question, limited recent conversation context and eligible public routing options to TypeSafe AI through the Jev API to classify the request. We send your question, limited context and relevant public website content to Google through the Gemini API when an explanation is needed. Gemini can also classify requests when Jev is not configured, unavailable or uncertain. We remove recognisable contact details and URLs and block obvious credentials before model processing, but automated filtering cannot identify every kind of personal information. TypeSafe processes this information under its privacy policy and data processing terms; Google processes it under the Gemini API terms. These website developer APIs are separate from our connected-store platform’s enterprise model services.

Vercel hosts the assistant and processes request and browser signals for rate limiting and bot detection. We also store questions, answers, limited conversation context, page links, timestamps, response status and an anonymous conversation reference for staff quality review, troubleshooting and improving the assistant. Recognisable credentials are omitted and recognisable contact details are redacted, but automated filtering cannot identify every kind of personal information.

These records include the request IP address and approximate country, region and city supplied by Vercel from the IP address. They do not include device GPS coordinates. IP addresses may be shared or masked by a VPN; an IP address or conversation reference does not establish a person’s identity. IP and location metadata are not added to the model prompt.

Conversation records are stored in private Vercel Blob storage in the London region and are accessible only to authorised staff and server processes. They are scheduled for deletion after 30 days by a daily cleanup. Staff exports must be kept access-restricted and removed when their review purpose is complete. Hosting and model providers may retain separate service and security records under their applicable terms.

The visible conversation is kept in browser memory and clears when you refresh or select Clear chat. This resets the visible chat and conversation reference; it does not delete stored review records or information already processed by service providers. You can browse the website without using Ask Viq. To ask about or request deletion of a chat record, contact privacy@vortexiq.ai with the chat reference shown in the panel and its approximate date.

VortexIQ Browser Agent (Chrome extension)

The VortexIQ Browser Agent is an optional Chrome extension that lets Vortex IQ run store-experience tests (for example “search for a product”, “add to basket”, “log in”), tracking and tag checks, and citation tests in your own Chrome browser, when you start a job from the Vortex IQ app. Store-experience tests and tag checks run on your own store. A citation test is the one job that opens a website other than your store: it asks AI assistants your own questions, as described below.

When it is active

The extension does nothing until you agree to the in-extension disclosure and connect it to your Vortex IQ account. After that it only acts while a test you started is running, and only in tabs it opens itself. It only opens the website(s) of the store under test — or, in a citation test, the three AI assistants named below; any other site is blocked during a job.

What it reads during a test, on your store’s pages only

• The page’s text, structure and links, and the labels and values of form fields. Password, payment card and one-time-code fields are hidden and never read.
• Screenshots of the test tab.
• Console and network errors, page load timings and accessibility check results for that page.
• The page address (URL) and title.

What it never reads

Saved passwords, browsing history, bookmarks, or any tab it did not open for a job. It does not run in the background on other websites. It does not read the cookies or stored data of any website other than the store you are testing — and on that store, only during a tracking and tag check, as described below.

Tracking and tag checks

A tracking and tag check is a job you start on your own store, to see whether its analytics and advertising tags are set up correctly. The check walks your store’s buying journey — home page, product page, basket, checkout — and stops at the payment step.

During that check, and on your store’s pages only, the extension additionally reads:

• The analytics and advertising requests your store’s own pages send, including their payloads, so that you can see which tags fire, which are missing and which fire twice.
• Your store’s cookies: the values of analytics and advertising identifiers (for example _ga, _gid, _gcl_*, _fbp, _fbc, _ttp, _uetsid, _shopify_y), and the names only of every other cookie. The value of a login, session, basket or administrator cookie is never read.
• Your store’s cookie-consent state, recorded before and after the cookie banner is accepted, so the check can show which tags fire without consent.

Each visit in a check carries utm_source=vortexiq_tag_audit, so you can exclude these test sessions from your own analytics reports.

You may optionally ask for a fresh pass, which clears your store’s cookies and local storage before the check begins, so that tags are measured as a first-time visitor sees them. A fresh pass signs you out of your own store and empties your basket. It is limited to the store under test; the cookies and stored data of every other website are left untouched.

Analytics and advertising identifiers are not personal details such as a name, address or payment card. They can, however, identify a browser. Vortex IQ uses them only to produce your tracking report, as set out under Limited Use below.

Citation tests

A citation test is a job you start to find out which websites AI assistants point to when they answer buying questions in your category. It is the only part of the extension that opens a website other than your own store.

During a citation test the extension:

• Opens its own tab on chatgpt.com, claude.ai and gemini.google.com — whichever of the three you chose.
• Uses the accounts you are already signed into in that browser. It types a question you wrote and presses Send, as you. It never signs in, never creates an account, and never asks anything you did not write. If you are not signed in to an assistant, those questions are recorded as skipped and nothing is asked.
• Reads the assistant’s page in order to find the answer. That includes your chat list, which is how it tells that its own question has been answered rather than an earlier one. What it sends to Vortex IQ is the answer and the links in it. If it cannot tell the answer apart from the rest of the page — because the assistant’s interface has changed — it records nothing for that question rather than sending the page.
• Shows a notification for as long as the run lasts, and can be stopped at any time, from the Vortex IQ app or by closing the tab.

Each question is asked on your own account with those providers and uses your own usage allowance there. Their handling of what you ask is governed by your agreement with them, not by this policy. Beyond the chat list it reads to locate its own answer, as above, Vortex IQ does not collect or store your other conversations with an assistant, and does not use your assistant accounts for anything other than the citation test you started.

Citation tests run only for the Vortex IQ apps you have allowed in the extension’s settings, and only after you have accepted the in-extension disclosure. Withdrawing that consent revokes every app’s permission to run them.

Login tests

If a test needs to sign in to your store, the login details you saved in Vortex IQ are typed into your store’s login form by our service. They are not shown to the AI model and are not stored in test logs.

Purchases

During a test the extension refuses to press “place order”, “pay now” and similar buttons, so a test cannot complete a purchase. A tracking and tag check stops at the payment step and never enters payment details.

Where the data goes

Test data — including, for a tracking and tag check, the recorded tracking requests, tracking-cookie identifiers and consent states, and, for a citation test, the assistants’ answers and the links in them — is sent over HTTPS to Vortex IQ’s test service and processed by our AI model provider (Anthropic) to run the job and write the results. Results, screenshots and the report are saved to your Vortex IQ account (including your Vortex Memory) so you can review them.

Stored on your device

The extension keeps on your computer: its connection token, your settings and consent, visual comparison baselines, and a short log of the last 50 technical errors (no page content). While a tracking and tag check is running it also holds the captured requests in the browser’s session storage, which Chrome discards when you close the browser. The error log only leaves your device if you choose “Copy for support” and send it to us.

Retention

Screenshots held by the test service are deleted after 30 days. Test results and the copies saved to your Vortex IQ account are kept for 90 days, or until you delete them or close your account.

Your control

You can disconnect the extension in the Vortex IQ app, withdraw consent in the extension’s settings (it then stops connecting), or remove the extension from Chrome at any time. Removing it deletes the data it stored on your device. To delete test data held by Vortex IQ, contact privacy@vortexiq.ai.

Roles

For your store’s pages and any customer data shown on them, Vortex IQ acts as your processor (see section 01).

Limited Use

Data collected by the VortexIQ Browser Agent is used only to provide and improve the store-testing, tag-checking and citation-testing features you use it for. We do not sell it, do not use or transfer it for advertising, credit-worthiness or lending purposes, and do not transfer it to third parties except as needed to provide this feature (the sub-processors in section 06), to comply with the law, or as part of a merger or acquisition. Our people do not read it except with your permission, for security purposes, or to comply with the law. The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.