Privacy Policy

1. Who controls your data

Seyaq is operated by Seyaq LLC, a limited liability company formed in the Sharjah Media City free zone under licence No. 2648808.01 issued by the Sharjah Media City Free Zone Authority (Shams), with its registered address at Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, United Arab Emirates. Your contract for the Service is with Seyaq LLC.

Seyaq LLC is not registered for UAE VAT, so no UAE VAT is added to our fees. Where any sales tax, VAT or equivalent applies in your own country, it is shown at checkout whenever we are required to collect it.

Legal notices and questions: legal@seyaq.ai

Privacy requests: privacy@seyaq.ai

2. Data we collect

Account data: your name, email, business name and locale. If you sign in with Google, Google shares your Google account identifier, name and email address with us, and we use them only to sign you in and keep your account linked. Store data: catalog content, prices, availability, store domain and the OAuth/access tokens you authorize (stored encrypted). Usage data: logs of API and MCP tool calls (with arguments redacted) and audit results.

3. How we use it

To provide the Service — sync your catalog, publish machine-readable assets, run audits — and to secure, monitor, and improve it. We send transactional emails (verification, plan activation, billing notices) related to your account.

4. Payment data

We never receive or store card details. Payments are processed by Stripe as our payment processor; checkout for your shoppers happens on your own store.

5. Sharing and sub-processors

We share data only with service providers that help us run Seyaq — hosting, Stripe for payments, our email provider (Resend), the AI provider used to generate audits (Anthropic), and Google for analytics and ad measurement as described in the next section — under appropriate safeguards. We do not sell personal data.

The machine-readable assets you enable are, by design, public so AI assistants can read them; do not include private data in your catalog fields.

6. Where your data is processed

Seyaq runs on cloud infrastructure that may be located outside the United Arab Emirates, and the sub-processors above may process data in other countries. Where personal data leaves the UAE we rely on the safeguards permitted by the applicable data protection law, including the providers’ own contractual commitments.

7. Cookies, analytics and ad measurement

We use Google Tag Manager and Google Analytics to understand how Seyaq is used — for example which pages are visited, which features are used, and where signups come from. Analytics cookies are set only after you choose “Continue” in the cookie banner. Until you choose, and if you decline, no analytics cookies are stored on your device.

Analytics data is limited to usage events and technical context (pages, actions, device and browser type, and the approximate location Google derives). We configure analytics so that it does not receive your name, email address, store name or store URL. Confirmed billing events (for example a completed subscription payment) are reported to Google Analytics from our servers with a transaction reference and amount, linked to your browser’s analytics identifier if you accepted analytics — never card details.

If you accept, we also use Google Ads to measure which of our ads led to a signup or a subscription. We do not use your data for personalized advertising.

You can change or withdraw your choice at any time by clearing this site’s data in your browser; the consent banner will appear again on your next visit. Google processes analytics data on our behalf as a service provider.

8. Security

Store tokens are encrypted at rest. Access is scoped per store (tenant isolation). We apply reasonable technical and organizational measures, though no system is perfectly secure.

9. Retention

We keep account and store data while your account is active and for a reasonable period afterwards as needed for legal, accounting and security purposes, then delete or anonymize it.

10. Your rights

Subject to applicable law, you may access, correct, export or delete your personal data, and object to or restrict certain processing. Contact us to exercise these rights.

11. Seyaq Shopping Assistant

For your Seyaq account and subscription, Seyaq LLC is the controller, as in the rest of this policy. For your shoppers' data in the Seyaq Shopping Assistant, the store is the controller and Seyaq processes it on the store's behalf under the Data Processing Agreement (seyaq.ai/en/shopping-assistant/dpa); shoppers exercise their rights with the store, which Seyaq helps.

What the Assistant processes for a store: shopper messages and the Assistant's replies (card numbers, codes and passwords are hidden before they are stored or sent to AI), kept 30 days by default — the store can shorten this or extend it up to its plan's limit of 30, 90 or 180 days; a pseudonymous shopper id (a one-way hash made by the store's plugin, with no name or email), kept 30 days after the last activity; the cart the shopper's browser reads from the store, not kept beyond the reply; photos a shopper sends, with their metadata removed, used once and deleted within 10 minutes — a photo that is not a product is refused and nothing of it kept; voice messages, turned into text for the shopper to check and send, the audio not kept; requests a shopper sends to the store, kept until resolved plus 1 year or deleted earlier on request; pseudonymous usage events that follow the store's cookie consent, kept 90 days (totals 25 months); records of cart actions and security events, kept 1 year.

The Assistant takes no payments, sees no card details and sells no data.

Service providers for the Assistant: OpenAI, United States (replies, search, reading shopper photos and speech to text — sent without the shopper's identity; OpenAI's API terms do not use this data to train its models); DigitalOcean, Frankfurt, Germany (hosting, database and file storage); Stripe (subscription payments, merchants only); and Resend (email to merchants and store teams).

Shoppers ask the store to see, correct or delete their data; the store can export or delete a shopper's data from WordPress, and Seyaq completes it within 30 days. Backups expire within 35 days, and a deletion is re-applied if a backup is restored. When a store's account closes, its shopper data is deleted within 30 days.

Security reports: security@seyaq.ai (seyaq.ai/en/security).

12. Contact

Privacy questions or requests: privacy@seyaq.ai