Privacy Policy

Last updated: August 30, 2026

This Privacy Policy describes how Devexa ("Company", "we", "us", or "our") collects, uses and protects information when you use the Devexa Platform ("Platform") and related services.

1. Our Role, and Yours

Two different relationships are covered by this policy, and the distinction matters:

Your account with us. For the data you give us to open and run a subscription — your name, email, company, domain, billing status — we are the controller.
Your shoppers' data. For everything that flows from your storefront through our services — search queries, browsing events, form signals, uploaded photographs — you are the controller and we are your processor. We act on your instructions, which are the settings you choose and the features you enable. Your own privacy notice and cookie consent are what cover your shoppers, because it is your storefront they are visiting.

2. Information We Collect

2.1 Account information

Full name
Email address
Company or store name
Store domain
Password (stored as a secure hash; we never store plain-text passwords)

2.2 Store and shopper event data

AI Recommendations: product views, add-to-cart events, purchase events, product IDs, category associations, and a visitor identifier (see §7).
Smart Search: search queries, result clicks, zero-result queries and search session data.
SmartShield: form submission metadata, IP addresses, user-agent strings, behavioural signals (typing rhythm, mouse movement, time on page, scroll behaviour) and hidden-field interactions, used to tell a shopper from a script.
AI Studio: the product attributes you select, your product names, categories and existing descriptions, and your product photographs — sent so that copy and lifestyle images can be produced for those products.
AI Visualizer: a photograph uploaded by a shopper of their room or of themselves. See §3, which is written specifically about this.

2.3 Shopper signals sent with AI requests

To tell a real shopper from an automated script, our modules send a short description of the request alongside it. This is deliberately coarse:

The IP address is truncated before it leaves your store — the last octet of an IPv4 address is dropped, and an IPv6 address is cut to its first 48 bits. We receive a neighbourhood, not an address.
The session identifier is a salted hash, not the session id itself. It gives continuity within a visit and identifies nobody.
A page-view counter, the browser's user-agent and language, and the referring page.

2.4 Technical data

IP addresses of API requests from your server
API request timestamps and response times
Platform usage analytics (dashboard visits, feature usage)

2.5 Payment information

Payment processing is handled by Stripe. We do not store card numbers or bank details on our servers. We receive transaction confirmations and subscription status only.

3. Photographs Uploaded by Shoppers

The AI Visualizer asks a shopper to upload a photograph of their room, or of themselves. This is the most personal data the Platform handles, and it is treated accordingly:

Used once. The photograph is used to produce that one image and nothing else.
Discarded immediately afterwards. Once the image has been produced, the uploaded photograph is deleted from the job record. It is not archived, and it is not kept "in case".
Never shown to anyone. It does not appear in your Magento admin, and it does not appear in our platform admin. The resulting composite is likewise excluded from the image galleries our staff can browse.
Not used for training. Neither we nor our AI providers use it to train models.
Reachable only by an unguessable address. The generated result is served from a random identifier and is not listed, linked or indexed anywhere.
Deleted on a timer. The generated result expires and is deleted automatically; the retention period is shown in your dashboard settings.
Never linked to a customer account. The photograph is not associated with a named customer, an order, or a marketing profile.

The shopper is told this in the panel before they upload anything.

4. How We Use Information

Service delivery: producing recommendations, computing risk scores, answering searches, writing copy and generating images.
Account management: authentication, authorisation, billing and support.
Service improvement: aggregated, anonymised usage patterns only. We do not read your catalogue, your shoppers' searches or their photographs to improve our own products.
Communication: service notifications, billing receipts, security alerts and — with your consent — product updates.
Security: detecting and preventing fraud, abuse and unauthorised access.

5. Sub-processors and Data Sharing

We do not sell, rent or trade personal information or store data.

Delivering the services requires a small number of sub-processors:

AI providers. Producing text or an image means sending the request to an AI provider (currently OpenAI; Anthropic where a text provider is configured). What is sent is what is needed to produce the result: for copy, the product attributes and text you selected; for images, the product photograph and — for the Visualizer — the shopper's uploaded photograph. Content sent through our platform account is not used by the provider to train models. Requests may be retained briefly by the provider for abuse monitoring under their terms.
Stripe — payment processing (name, email, subscription details).
Infrastructure providers — hosting and CDN, under data processing agreements.
Legal authorities — where required by law, court order, or to protect our legal rights.

We will give notice before adding or changing a sub-processor that handles shopper data.

6. Data Retention

Shopper photographs (Visualizer): deleted as soon as the image has been generated.
Generated images: held as a staging area and deleted automatically after the retention period configured for your account (30 days by default). Images you attach to a product are copied into your own Magento media, where retention is yours to decide.
Account data: duration of your active account plus 90 days after closure.
Event data: duration of your active subscription plus 90 days.
API logs: 30 days, for debugging and analytics.
Billing records: 7 years, as required by tax and accounting law.

7. Cookies and Local Storage

On the Platform (ai.devexa.ro) we use essential cookies for session management and authentication. We use no third-party tracking or advertising cookies.

On your storefront, our modules set the following in your shoppers' browsers:

devexa_visitor_id — a first-party cookie holding a random identifier, with a lifetime of two years, set with SameSite=Lax and Secure over HTTPS. It is what allows recommendations to reflect what a returning visitor has looked at, and it is used to keep A/B measurement groups stable. It contains no name, email or address, and it is not shared with any advertising network.
The same identifier is also kept in localStorage, so that a visitor who clears one is not immediately counted as two people.
Smart Search keeps recent searches in localStorage, in the visitor's own browser. That list is never sent to us.

This is a matter for your cookie consent. A two-year identifier used for personalisation is not strictly necessary for your storefront to function, so in the EU and UK it generally requires consent before it is set. You are the controller for your storefront: our modules should be placed in the appropriate category in your consent manager, and the AI Recommendations tracker should be loaded only once consent has been given. We can be configured accordingly — contact support if you need help wiring it to your consent tool.

8. Data Security

All data in transit is encrypted using TLS 1.2 or higher.
Sensitive data at rest is encrypted.
Access to production systems is restricted and monitored.
Requests carrying shopper signals are cryptographically signed per tenant, so one store cannot impersonate another.
Tenant data is logically separated; generated files are stored per tenant.
Regular security review of the API surface and its guards.

9. Your Rights

Under applicable data protection law, including the GDPR, you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — request correction of inaccurate data.
Erasure — request deletion, subject to legal retention requirements.
Portability — request an export in a machine-readable format.
Objection — object to processing for specific purposes.
Withdraw consent — at any time, where processing is based on consent.

Where we act as your processor, a request from one of your shoppers should come to you as the controller; tell us and we will act on it without undue delay. To exercise your own rights, contact support@devexa.ro.

10. Children's Privacy

The Platform is not intended for use by individuals under the age of 16, and we do not knowingly collect personal data from children.

11. International Data Transfers

Platform data is processed in the European Union. AI providers used to produce text and images may process a request outside the EU, including in the United States; where that happens, transfers are covered by Standard Contractual Clauses and the provider's own transfer safeguards.

12. Changes to This Policy

We may update this Policy from time to time. We will notify registered users of material changes by email at least 14 days before they take effect.

13. Contact

For privacy enquiries: support@devexa.ro, or via our Contact page.