EmerceWork with me

Emerce legal

Privacy Policy

Emerce Agency LLC | emerce.agency, ios.emerce.agency, Emerce hosted software and related pages

Effective date: October 7, 2026

Our Terms of Service govern use of the Offerings: https://emerce.agency/terms

Emerce Agency LLC (“Emerce,” “we,” “us” or “our”) respects your privacy. This Policy explains how we collect, use, disclose and protect information when you visit our websites, contact us, receive communications, buy or access the Inbox Operating System™ (“IOS”) or other digital products, use our hosted retention-marketing software, participate in its controlled beta, or engage our freelance or consulting services (the “Offerings”).

For our own account administration, inquiries, billing, website operations and marketing, Emerce generally decides why and how information is processed. When we process information from a client’s authorized systems or content on that client’s behalf, we generally act as its processor or service provider under the applicable agreement and documented instructions. The client remains responsible for the lawful collection and use of its information, required notices and permissions. This Policy describes our practices and does not replace any required data-processing agreement or the client’s privacy notice.

We collect contact and inquiry details, including names, business email addresses, telephone numbers, company information, store URLs and messages; business qualification information such as goals, budget, timing and approximate store revenue; and proposals, contracts, invoices, approvals, meeting notes and support records.

For software accounts, we may collect user identity, authentication and access information, tenant and Brand membership, role permissions, preferences and account activity. You may provide Brand guidance, voice and messaging rules, product and business context, briefs, campaign dates and offers, approved assets, reference emails, instructions, business contact and footer details, and feedback. We also retain drafts, generated content, editing and approval history, and relevant decision, evidence and outcome records used to provide the service.

Free text, reference emails and uploaded assets can contain personal information. Please avoid customer names, email addresses, identifiers, order details, sensitive personal information and other unnecessary personal information, particularly when using AI features. Do not submit regulated or sensitive information unless necessary, lawful and expressly agreed in writing.

We collect order and product-access information, including product, price, currency, date, status, discounts, taxes, access activity and support history. Payment providers process card and bank details; we generally receive confirmations and limited billing details rather than full card numbers. We collect newsletter preferences, consent records, interests, engagement and unsubscribe or suppression records, and feedback, survey responses and testimonials you provide.

We and our providers may collect IP addresses, browser and device information, operating system, referring pages, pages viewed, links clicked, timestamps, approximate location derived from IP address, cookie identifiers and software usage information. Software operational records may include authentication, access, errors, sync activity and security events. Email and digital-delivery tools may record opens, clicks and access activity.

We may receive information from payment, digital-delivery, email, analytics and advertising providers, referral partners, social networks, public business sources, clients and authorized connected services. A purchaser or referral contact may provide your contact details.

Customers choose whether to authorize a connection and must have authority to grant access. Information available depends on permissions, provider capabilities and the applicable service agreement. Agency engagements may involve broader access to client systems where separately authorized; the following limits describe the current hosted-software beta connectors.

The current OAuth connection is read-only. Emerce stores account identity/basic configuration; campaigns and metadata; flows, actions/messages, timing and structure; aggregate campaign and flow performance; metric definitions; list/segment metadata; available tracking/UTM settings; and sync state, coverage and provenance.

Active beta ingestion does not request or ingest individual customer profiles, individual behavioral events, individual orders, list members or full customer databases. Imported Klaviyo connector records remain in Emerce’s normalized/deterministic processing layer and are not currently submitted to OpenAI.

Shopify is optional catalog enrichment. Emerce can be used with Klaviyo and Brand/website context without Shopify access. Connector V1 requests only read_products and may receive store identity/basic context, products, variants, collections, product/variant media metadata, prices and compare-at prices, availability/status, available aggregate inventory, and provenance/sync state.

The current Shopify connector does not request customer records, orders, checkout data, protected customer-data scopes or write permissions. Imported Shopify connector records are not currently submitted to OpenAI.

We may offer additional integrations. Before materially expanding permissions or information use, we will explain the relevant connection and update notices or obtain authorization where required. The present beta limits are not a representation that all future connectors will have identical capabilities.

We use information to provide and maintain accounts, tenant/Brand workspaces and the Offerings; analyze retention-marketing performance; identify and prioritize opportunities; retain relevant decision evidence; plan campaigns and flows; assist content creation; and support measurement and learning within the contracted service.

We also use information to respond to inquiries, perform agency work, process payments, deliver digital products, manage licences, provide support, send administrative/security notices, send permitted marketing, honor preferences, understand usage, troubleshoot and improve the Offerings, detect abuse and fraud, protect accounts, comply with law and recordkeeping duties, and establish or defend legal claims.

Client information processed on behalf of a client is used within its instructions and agreement. Improving the contracted service does not give us unrestricted permission to sell identifiable client data, train general-purpose models on confidential client content, or disclose one Brand’s confidential information to another Brand.

Defined Creation features use the OpenAI API for campaign planning, subject/preview generation, content generation, bounded field regeneration, scoped editing and advisory quality review. We submit a deliberately limited selection of relevant approved Brand guidance, campaign brief/business context, product facts, intentional user instructions, draft content and applicable approved learnings/context.

Current enabled AI payloads exclude unnecessary customer metadata, contact/footer/address fields, URLs, raw screenshots/image bytes and arbitrary provider payloads. Imported Klaviyo and Shopify connector records remain outside AI input. Legacy email/calendar/image/screenshot AI routes and screenshot-to-AI are disabled during beta. These field limits do not guarantee that personal information intentionally entered into an allowed instruction or draft can never reach the AI provider; please do not enter customer personal information.

Current enabled calls use OpenAI’s Responses API with store:false. OpenAI API data is not used to train or improve its models by default unless the customer opts in; Emerce’s voluntary API data-sharing/model-improvement settings are disabled. Emerce does not have verified Zero Data Retention approval. The store:false setting does not eliminate OpenAI’s standard abuse-monitoring retention, which may include submitted content and generally lasts up to 30 days, subject to applicable exceptions or legal requirements. OpenAI’s applicable terms and data controls govern its processing.

AI outputs can contain errors and require human review. Emerce may retain inputs, outputs and related work history in its own service as described in this Policy even where OpenAI response storage is disabled.

For processing where Emerce acts as controller, applicable bases may include performance of a contract or requested pre-contract steps; legitimate interests in operating the business, responding to business inquiries, security, fraud prevention and protecting legal rights, balanced against individual rights; consent where required, including certain marketing or non-essential cookies; and legal obligations. Consent may be withdrawn without affecting prior lawful processing. Processing on behalf of clients follows their lawful instructions and applicable agreements.

The Emerce agency website uses browser local storage to save campaign plans when you use the Email Marketing Ideas tool. Hosting and security providers may process technical information to deliver and protect the site. The agency website does not currently load embedded Kit forms or first-party analytics or advertising trackers; inquiry and audit-signup links open Kit-hosted forms, which operate under that provider’s privacy practices.

Across the Offerings, we and providers may use cookies, pixels, tags and local storage to operate services, remember choices, secure forms and access, understand usage and measure email performance. Advertising technologies, if enabled in the future, may support personalization or targeted advertising. Where required, non-essential technologies require consent. Browser settings can limit cookies and local storage, although blocking them may affect functionality.

The agency website does not currently offer a cookie-consent banner or advertising opt-out panel because it does not currently enable the optional tracking described above. If covered sale, sharing or targeted advertising is introduced, applicable consent and opt-out controls, including support for legally required Global Privacy Control signals, must be implemented before that processing begins. You can contact hello@emerce.agency with a privacy request. Third-party hosted forms and services may offer their own controls.

We disclose information as reasonably necessary to providers and contractors supporting hosting, authentication, security, databases, storage, payments, digital delivery, email, support, accounting, analytics, project work and professional advice; platforms you authorize; authorities or others where legally required or necessary to protect rights and security; and recipients you direct or authorize.

Current software-related providers include Cloudflare for runtime, authentication, D1 database and R2 storage; OpenAI for defined AI features; Klaviyo as an authorized email/retention source; Shopify as an optional catalog source; and GitHub for code, deployment and testing infrastructure. Not every provider receives every category of information. Connected platforms also process information under their own terms and policies. Provider contracts and any applicable data-processing terms govern their responsibilities.

Information may be disclosed in a financing, merger, reorganization or business transfer subject to appropriate safeguards and applicable law. We do not sell personal information for money or grant a general right to share a Brand’s identifiable confidential data with other Brands. Website analytics or advertising disclosures may constitute sale, sharing or targeted advertising under some state laws; applicable opt-out rights are described here. We do not knowingly sell or share personal information of anyone under 18.

We retain information for as long as reasonably necessary to provide the Offerings, preserve useful authorized work/decision history, support security, resolve disputes, enforce agreements and meet legal, tax, accounting and audit obligations. Retention depends on information type, purpose, relationship, sensitivity, risk and applicable requirements. Transaction/contract records may require longer retention; limited suppression records help honor marketing opt-outs. Historical evidence does not override applicable deletion rights.

Disconnecting a connector ends usable connection access; it does not automatically erase previously imported records, Brand content or service history. Customers may separately request formal deletion/erasure by contacting us. We verify the requestor’s identity and authority, including Brand-owner authority where relevant, and explain the affected scope and consequences.

The supported beta erasure path removes retained provider/Brand payloads and associated Evidence Foundation copies within the authorized scope. Minimal lawful audit metadata or deletion tombstones may remain where necessary, rather than the erased sensitive payload. Protections prevent stale writes or recovery from silently reactivating erased payloads. V1 erasure permanently retires the affected Brand/provider scope; fresh onboarding after erasure requires a new Brand identity.

We do not promise immediate deletion from every backup, recovery system or third-party provider. Residual copies may remain until their applicable retention/overwrite cycle or required legal retention ends; applicable erasure restrictions must continue to apply if recovery occurs. We address valid requests subject to legal exceptions and within applicable legal deadlines. Where we process data for a client, we assist or route requests according to that client’s instructions and applicable law. Erasure within Emerce does not itself delete records held by Klaviyo, Shopify or another source platform.

We use reasonable administrative, technical and organizational safeguards designed to protect information. Software access is scoped by tenant and Brand membership. OAuth/provider credentials remain server-side, and provider tokens receive additional server-side encryption. No system or transmission is completely secure. We do not guarantee absolute security or claim certifications we have not obtained. Protect your credentials and promptly report suspected unauthorized access.

Emerce is based in the United States. Information may be processed in the United States or other countries where providers operate, with different privacy protections. Where UK/EEA or other applicable law requires a transfer safeguard, an appropriate lawful mechanism must apply, which may include adequacy arrangements or contractual safeguards. Contact us for information about safeguards applicable to your engagement. This Policy itself is not a transfer agreement.

Depending on applicable law, you may have rights to access or confirm processing, receive a portable copy, correct or delete information, restrict or object to processing, withdraw consent, opt out of covered sale/sharing/targeted advertising or certain profiling, and appeal a refusal. These rights are subject to applicable exceptions. We do not discriminate for exercising a legal privacy right.

Email hello@emerce.agency with “Privacy Request” and describe the request and relevant account or Brand. Do not include unnecessary sensitive information. We may request only reasonably necessary identity/authority verification. Authorized agents may submit requests with required proof. Where we process information on a client’s behalf, the client may need to determine the response; we will assist as applicable. To appeal where law provides that right, reply with “Privacy Appeal” and explain your concern. We respond within applicable legal periods.

Where UK/EEA law applies, you may object at any time to direct marketing and may object to legitimate-interest processing, subject to lawful grounds for continued processing. You may complain to the UK Information Commissioner or the relevant EEA supervisory authority. Nothing here limits non-waivable rights. State-law disclosures depend on the law’s scope and thresholds; this Policy does not imply that every privacy law applies to every business contact.

Use the unsubscribe link or contact us to stop marketing emails. Necessary account, service, security and legal communications may continue. We retain limited suppression information to honor opt-outs.

The Offerings are intended for adults and businesses, not children under 18. We do not knowingly collect personal information directly from children using the Offerings. Contact us if a child has submitted information so we can investigate and take appropriate action. Users must not upload unnecessary information about children or other sensitive subjects.

Third-party sites and platforms have their own privacy notices. We are responsible for our applicable obligations when using providers; this Policy does not control those third parties’ independent practices.

We may update this Policy and its effective date. For material changes affecting previously collected information, we provide additional notice or obtain consent where required. Current connector and AI limits describe the beta; material expansion requires the relevant notice and authorization.

Emerce Agency LLC

Privacy email: hello@emerce.agency

Mail: 1630 Welton St, Denver, CO 80202, United States

Website: https://emerce.agency/