Privacy Policy

Section 01

Information We Collect

We collect data to perform the functions of our Visual Commerce Operating System.

• Data from Commerce Platforms:If you connect a store (e.g., Shopify, WooCommerce), we access your product catalog (Titles, Images, Descriptions) via the platform's API subject to their specific data permissions.
• Direct Uploads: If you use Epox via the web without a connected store, we collect the files you manually upload.
• User Info:We collect Name, email, phone, Store URL (if applicable), and billing information. Please note that full payment details (such as credit card numbers) are collected and processed directly by our authorized third-party payment processors and Merchants of Record (e.g., Tranzila, Lemon Squeezy), and are not stored on Epox's servers.

Section 02

How We Process Your Data

2.1 The Workflow

• Ingestion: We sync or upload your raw product photos.
• Processing: Assets are processed through our AI engine to generate Lifestyle Images and Videos.
• Storage: We store generated assets in our secure cloud storage to allow you to access your history and library.
• Delivery: Optimized versions are downloaded or pushed back to your store.

2.2 Use of Third-Party AI Sub-Processors

We utilize industry-leading third-party AI APIs (primarily Google Gemini via Google Cloud Vertex AI) to perform generation tasks. We only send the specific data points required for the generation task to these providers.

Epox maintains a current list of all third-party sub-processors utilized for the Service. By using the Service, you grant general authorization for Epox to engage these sub-processors. Epox will provide merchants with commercially reasonable notice (e.g., via email or dashboard notification) of any intended changes concerning the addition or replacement of AI sub-processors, giving you the opportunity to object to such changes by terminating your subscription.

2.3 AI Training & IP Protection (Your "Paid Tier" Guarantee)

Your Data Remains Yours. Epox utilizes the Enterprise/Paid tier of our AI partners.

• No Training on Merchant Data: Consistent with the data privacy commitments of our Enterprise AI partners (including Google Cloud), Epox does not use your proprietary product images or Input Data to train the foundation models of our third-party AI providers.
• Isolation: Your brand assets are processed in isolated instances. Your data is used strictly to generate your requested assets and is not shared with other merchants.

Section 03

Data Retention

• Asset Library: We retain your assets in our Cloud Storage as long as your subscription is active.
• Security: Assets are stored using enterprise-grade encryption (AES-256).

Section 04

Platform Compliance & Data Rights (GDPR/CCPA)

We respect your rights under GDPR and CCPA. The method of data deletion depends on your platform:

4.1 For Shopify Merchants (Mandatory Webhooks)

We strictly adhere to Shopify's API mandates regarding data retention. We process the following mandatory webhooks:

• customers/data_request: If a customer requests their data, we will provide any data we hold regarding that customer to Shopify.
• customers/redact: If a customer requests deletion, we will purge their personal information within 30 days.
• shop/redact (App Uninstall): If you uninstall the Epox App from your Shopify store, we receive this webhook and will permanently delete all your store data and generated assets within 48 hours.

4.2 For Non-Shopify Merchants (WooCommerce/Web)

• Right to be Forgotten: To request the deletion of your account and all associated data, email privacy@epox.ai.
• Grace Period: Unlike Shopify uninstalls, we typically retain your data for 30 days after cancellation to allow for account reactivation, unless you explicitly request immediate deletion.

Section 05

International Data Transfers

Your information may be transferred to computers located outside of your state or country. We ensure appropriate safeguards are in place for cross-border transfers.

Section 06

Sharing Your Information

We do not sell your personal data. We share information only with:

• Cloud Infrastructure: (e.g., AWS, Google Cloud) for hosting.
• AI Sub-Processors: (e.g., Google Gemini) strictly for content generation.
• E-commerce Platforms: To sync data back to your store (e.g., Shopify, WooCommerce).
• Payment Processors & Merchants of Record: (e.g., Tranzila, Lemon Squeezy) strictly to securely process your subscription payments, handle tax compliance, and manage financial transactions.
• Bot Protection: Cloudflare Turnstile verifies that Try-On requests come from real visitors, without showing a visible challenge. See Cloudflare's Turnstile Privacy Addendum.

Section 07

Changes to This Privacy Policy

We may update this policy to reflect operational or legal changes. Updates will be posted with a revised "Last Updated" date.

Section 08

Contact Us

For privacy inquiries:

• Email: privacy@epox.ai
• Address: Sapir St 7, 1. Gan Yavne, Israel

FAQ

Common questions about your data

Short answers in plain language — each links to the binding clause above.