Privacy Policy

InStore.ai, Inc. ("we," "us," or "our") wants you to be familiar with how we collect, use, and disclose information. This Privacy Policy describes our practices in connection with information that we collect through:

• Website(s) operated by us from which you are accessing this Privacy Policy
• Software application(s) made available by us for use on or through computers and mobile devices;
• Our social media pages, including LinkedIn or any other social media we may use in the future 
• HTML-formatted email messages that we send to you that link to this Privacy Policy.

Collectively, we refer to the website(s), app(s), social media pages, and emails as the "Services." We also provide business-to-business audio, transcription and technology solutions to retail and other enterprise customers (the "Enterprise Audio Services"). Because the Enterprise Audio Services involve a different role, different data, and different obligations than the Services described above, we address them separately in the section "Our Role for the Enterprise Audio Services" below. Please read that section carefully if your data may have been collected through a retail location using our Enterprise Audio Services.

Our Role for the Enterprise Audio Services

When our enterprise customers (such as retailers) use our Enterprise Audio Services, we process certain information which may include audio recordings, voice data, and information derived from them, on our customers' behalf and according to their instructions. In that relationship, our enterprise customer, not InStore.ai, determines the purposes and means of processing and is responsible for providing notice to, and where required obtaining consent from, the individuals whose information is collected (for example, through in-store signage or their own privacy notice). Notwithstanding our customers' role, we remain responsible for: 

1. processing this information only as instructed by our enterprise customer and for the purposes permitted under our agreement with them;
2. Implementing appropriate technical and organizational security measures for this data, consistent with our SOC 2 controls
3. Not retaining this data longer than necessary to provide the Enterprise Audio Services or as instructed by our customer
4. Engaging subprocessors only under written confidentiality and security obligations at least as protective as this Policy
5. Supporting our enterprise customers in responding to verifiable requests from individuals to exercise applicable privacy rights.

If you believe your voice or other information was collected through the Enterprise Audio Services at a retail location, please contact that retailer first, as they are typically the party best positioned to identify and respond to your request; you may also contact us at privacy@instore.ai or open a ticket at https://support.instore.ai and we will coordinate with the relevant enterprise customer.

Personal Information

"Personal Information" is information that identifies you as an individual or relates to an identifiable individual. The table below summarizes what we collect through the Services, from what source, and why.

How We Collect Personal Information

We and our service providers collect Personal Information:

• Through the Services. For example, when you sign up for a demo, contact customer support, or apply for a job with us, and automatically as described in "Information Collected Automatically" below.
• From other sources. For example, from purchase transaction receipts provided by retailers, or through our Enterprise Audio Services as described above.

We need to collect Personal Information to provide the requested Services to you. If you do not provide requested information, we may not be able to provide the Services. If you disclose Personal Information relating to other people to us, you represent that you have the authority to do so and to permit us to use it as described in this Policy.

Primary purposes (necessary to provide the Services)

• Providing the functionality of the Services and fulfilling your requests, including demos, customer support, and responding to inquiries.
• Sending administrative information, such as changes to our terms, conditions, and policies.
• Operating, securing, and improving the Enterprise Audio Services for our enterprise customers, consistent with our role described above.
• Accomplishing legitimate business purposes, including audits; fraud prevention and security monitoring; developing and improving our products; identifying usage trends; and evaluating the effectiveness of our services.

Secondary purposes (you may opt out: see "Your Choices and Rights")

• Sending marketing communications about our services, new products, and company news.
• Facilitating social sharing functionality you choose to use.
• Matching your activity on the Services with other information held by our online data partners (for example, associating it with your email or home address) so that we or our partners can send you marketing communications. You may opt out of this practice as described in "Your Choices and Rights" below.
• Analyzing your preferences to personalize our interactions with you and tailor content or offers.
• Determining the effectiveness of our promotional campaigns.

We may also aggregate and/or de-identify Personal Information so that it no longer identifies you; we may use and disclose this de-identified data for any purpose, and we will not attempt to re-identify it except as permitted by law.

How We Disclose Personal Information

We disclose Personal Information:

• To service providers and subprocessors who perform services on our behalf (for example, hosting, analytics, text inference, IT infrastructure, customer service, email delivery, and auditing), bound by written confidentiality and security obligations at least as protective as this Policy. (See https://trust.instore.ai for subprocessor list)
• To advertising and marketing partners, for the secondary purposes described above, this may constitute a "sale" or "sharing" of Personal Information under California law; see "Additional Disclosures for California Residents" below for how to opt out.
• Where you elect to disclose it, such as on message boards, chat, or profile pages, where it may become available to other users and the public.
• As required by law, to respond to government or law enforcement requests, to enforce our terms, or to protect our rights, privacy, safety, or property, or that of others.
• In connection with a merger, acquisition, reorganization, bankruptcy, or sale of assets.

Sensitive Personal Information

Through the Enterprise Audio Services, we may process sensitive Personal Information in the form of audio or voice data, as described in "Our Role for the Enterprise Audio Services" above. We limit our use of this data to providing, securing, and improving the Enterprise Audio Services on our enterprise customers' instructions, and we do not use it to infer characteristics such as racial or ethnic origin, health, or religious or political beliefs. We make a good faith effort to identify and remove all sensitive Personal Information data collected via this process before collected transcripts are shared with any third party or our Enterprise clients. Outside of the Enterprise Audio Services, we ask that you not send us sensitive Personal Information (for example, Social Security numbers, government ID numbers, health information, or information about racial or ethnic origin, religion, or criminal background) through the Services unless we specifically request it.

Data Retention

We retain Personal Information for as long as necessary to fulfill the purposes described in this Policy, including to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements.  Audio recordings are available for retrieval from the application for six months, after which they're no longer retrievable through the app, and are fully deleted after twelve months. Obfuscated recordings which have been to modify the speaker’s voice pattern follow the same pattern on a longer timeline: retrievable for twelve months, then no longer accessible through the app, with deletion at two years. Transcripts are retrievable for thirteen months and are deleted at two years, though the text remains searchable through derived data even after that. Derived anonymized data are retained indefinitely to support longer period trend analysis.

Security and Incident Notification

We maintain organizational, technical, and administrative safeguards designed to protect Personal Information, including encryption in transit and at rest, robust access controls, SDP and IDS systems as well as ongoing employee training. No system can be guaranteed 100% secure. If we become aware of a security incident affecting your Personal Information, we will notify affected individuals and/or our enterprise customers, and any required regulators, without undue delay and in accordance with applicable law. 

Your Choices and Rights

You may opt out of marketing emails at any time by writing to privacy@instore.ai; we may still send you administrative messages related to the Services. To update Personal Information you have provided to us, write to privacy@instore.ai or open a ticket at https://support.instore.ai.

Additional Disclosures for California Residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), gives you the rights described below, in addition to the rest of this Policy.

Categories we collect, use, and disclose

See the "Personal Information We Collect" table above, which reflects our collection over the preceding 12 months. We disclose these categories to service providers for the business purposes described in "How We Disclose Personal Information," and we share certain identifiers and internet/network activity with advertising partners as described above, which may constitute "selling" or "sharing" under the CCPA.

Your rights

• Right to Know the specific pieces and categories of Personal Information we have collected about you.
• Right to Delete Personal Information we have collected from you, subject to certain exceptions.
• Right to Correct inaccurate Personal Information.
• Right to Opt Out of the sale or sharing of your Personal Information.
• Right to Limit the Use of Sensitive Personal Information, to the extent we use it beyond purposes permitted without opt-out.
• Right to Non-Discrimination for exercising any of these rights.

To exercise your right to know, delete, or correct, submit a request by emailing privacy@instore.ai, opening a ticket at https://support.instore.ai or mailing us at InStore.ai 634 Santa Cruz Avenue, Suite 200, Los Gatos, CA 95030. We will acknowledge your request within 10 business days and respond within 45 calendar days, which we may extend once by an additional 45 days when reasonably necessary; we will notify you of any extension. We will verify your identity before fulfilling your request, using a method proportionate to the sensitivity of the data requested. You may designate an authorized agent to submit a request on your behalf, subject to our ability to verify the agent's authority and your identity. If we deny a correction or deletion request, you may appeal by contacting privacy@instore.ai. To opt out of the sale or sharing of your Personal Information, or to limit the use of your sensitive personal information, click ["Do Not Sell or Share My Personal Information" / "Your Privacy Choices" LINK]. We honor Global Privacy Control (GPC) signals as valid opt-out requests for the browser or device that sent them. These rights extend to job applicants and current or former employees to the extent required by the CCPA/CPRA.

Aviso de Privacidad para Residentes de México (LFPDPPP)

Responsible party

InStore.ai, Inc., with domicile at InStore.ai 634 Santa Cruz Avenue, Suite 200, Los Gatos, CA 95030, is responsible for the use and protection of your personal data (the "responsable").

Purposes of processing

We use your personal data for the primary purposes necessary to provide our Services and, where applicable, the Enterprise Audio Services: (A good faith effort is always employed to remove any collected Sensitive Private Information from data collected via the Enterprise Audio Service. We also use it for secondary purposes, such as marketing communications and analytics, which are not necessary for the underlying relationship. You may object to these secondary purposes at any time by contacting us as described in "How to Exercise Your ARCO Rights" below, or by using the opt-out mechanism offered to you at the time of collection.

Sensitive personal data

If our Enterprise Audio Services are used at a location you visit, audio or voice data may be collected, which is considered sensitive personal data where it can be used to identify you. We (or our enterprise customer, as applicable) will provide notice at the point of collection (for example, through signage) and, where required, obtain your express consent, or express written consent for particularly sensitive uses, before processing this data.

How to exercise your ARCO rights

You have the right to Access, Rectify, Cancel, or Object ("ARCO") to the processing of your personal data. To exercise these rights, contact our Data Privacy Officer at privacy@instore.ai, providing proof of your identity and a clear description of the personal data and rights you wish to exercise. We will respond within 20 business days of receiving a complete request, and will make any approved changes effective within 15 business days thereafter. You may also revoke your consent to our processing of your personal data at any time by contacting us using the same method.

International transfers

We may transfer your personal data to our cloud infrastructure in the United States, for the purposes described in this notice. Where required by law, we will obtain your consent before making such a transfer, particularly for sensitive personal data.

Changes to this notice

If we make material changes to this notice, we will communicate them to you through updates to our website and emails to our retail customers, consistent with Article 16 of the LFPDPPP.

International Users and Cross-Border Transfers

We are located in the United States and may store and process Personal Information in any country where we or our service providers operate, including the United States. By using the Services, you understand your information may be transferred to countries with data protection laws different from those of your country of residence. Where required by applicable law (including the LFPDPPP, as described above), we will provide additional notice and obtain consent for such transfers.

Children's Privacy

The Services are not directed to children under the age of 13 (or 16, where required by applicable state law), and we do not knowingly collect Personal Information from them. If you believe a child has provided us with Personal Information, please contact us at privacy@instore.ai so we can address it.

Third-Party Services

This Policy does not address, and we are not responsible for, the privacy practices of third parties, including any linked website or service, or platforms such as those operated by other app developers, social media platforms, operating system providers, or device manufacturers.

Changes to This Privacy Policy

The "Last Updated" date at the top of this Policy indicates when it was last revised. Material changes will become effective when we post the revised Policy on the Services, and, for our Mexican Aviso de Privacidad, will also be communicated as described in that section.

Contact Us

If you have questions about this Privacy Policy, contact us at privacy@instore.ai, or by mail at InStore.ai is 634 Santa Cruz Avenue, Suite 200, Los Gatos, CA 95030. Please do not include credit card or other sensitive information in emails to us, as email is not always secure.