Privacy Policy

Last updated: October 15, 2026

This Privacy Policy explains how Retainly Inc. (“Retainly”, “we”, “us” or “our”) collects, uses, shares and protects personal information when you visit retnly.ai (the “Website”), request a demo, install the Retainly Shopify app, or otherwise use our AI retention agents and related services (together, the “Services”). It should be read together with our Terms of Service.

1. Who this policy covers

We handle personal information about three groups of people:

• Website visitors and prospects who browse the Website, request a demo or contact us.
• Merchants: the businesses that install the Retainly Shopify app or subscribe to the Services, and the staff who use their accounts.
• Merchants’ customers: shoppers of the stores that use Retainly. We process their information on behalf of, and under the instructions of, the merchant. For these individuals the merchant is the “controller” (or equivalent) and Retainly acts as a “processor” or “service provider”. See section 8.

2. Information we collect

Information you give us

• Demo requests: your first and last name, business email address, phone number and country, company name, job title, industry, how you heard about us, and whether you agree to receive marketing from us.
• Communications: the content of emails, messages, call notes and support requests you send us, and any details you choose to share in them.
• Account and billing details: when you subscribe, the name and contact details of account owners and users, your store name and domain, plan selections and billing information. Payments are processed by our payment processor, Stripe. Stripe collects your card and payment details directly under its own privacy policy; we do not receive or store full payment card numbers. Stripe shares with us limited details such as the card brand, last four digits, expiry date and payment status.

Information we receive from Shopify and connected tools

When a merchant connects their Shopify store, we access the store data the merchant authorises during installation. Depending on the permissions granted, this can include:

• store details such as shop name, domain, currency, time zone and staff contacts;
• customer records such as names, email addresses, phone numbers, shipping and billing addresses, tags and marketing consent status;
• orders, products, refunds, discounts, loyalty and subscription data;
• engagement and behavioural data, such as message opens, clicks, replies, unsubscribes and on-site activity signals.

If a merchant connects other channels or tools (for example an email, SMS, WhatsApp or push messaging provider), we receive the data needed to send messages and measure their results through that connection.

Information collected automatically

• Technical data: our hosting and infrastructure providers record standard server logs, such as IP address, browser type, device information, pages requested, referring URL and timestamps, to deliver the Website and keep it secure.
• Local storage: the Website stores your light or dark theme preference in your browser’s local storage. See section 12.
• Voice previews: when you play an agent voice preview, our server requests the audio from a text-to-speech provider. That request contains only the preview script, not information about you.

3. How we use information

• to respond to demo requests, schedule and run demos, and answer your questions;
• to provide the Services, including connecting your store, building customer segments, generating retention plans and campaigns, and delivering messages across the channels you enable;
• to run our AI agents on your store data so they can analyse churn risk, lifecycle stage and loyalty behaviour, and recommend or take the actions you have authorised;
• to report results, attribute revenue and show performance in your dashboards;
• to manage accounts, process payments and provide customer support;
• to secure the Services, prevent fraud and abuse, debug errors and enforce our Terms of Service;
• to improve and develop the Services, including by using aggregated or de-identified information that does not identify you, a merchant or a merchant’s customers;
• to send product updates and marketing, where you have opted in or where the law otherwise allows it; and
• to comply with legal obligations and respond to lawful requests.

4. Legal bases for processing

Where the EU or UK General Data Protection Regulation (GDPR) or similar laws apply, we rely on:

• contract: to provide the Services you or your company signed up for;
• legitimate interests: to respond to enquiries, run and secure our business, and improve the Services, where those interests are not overridden by your rights;
• consent: for optional marketing communications, which you can withdraw at any time; and
• legal obligation: where we must keep or disclose information by law.

5. AI agents and automated processing

Retainly uses AI models to analyse store data and to draft, schedule and personalise retention campaigns. Merchants choose whether agents queue campaigns for approval or run them autonomously, and they control which channels, offers and audiences agents may use.

Our agents make marketing decisions such as which segment a shopper belongs to, which channel to use and when to send a message. These decisions do not produce legal or similarly significant effects for individuals. Shoppers who would like a human to review how their data is used should contact the merchant they bought from.

We may use AI model providers to power these features. They process data only to provide their services to us, under contractual confidentiality and security obligations.

6. How we share information

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share it only as follows:

• Service providers that help us run the Services, such as cloud hosting and infrastructure, AI model providers, messaging delivery providers (email, SMS, WhatsApp and push), customer support and communication tools, and our payment processor, Stripe. They may use the information only to provide services to us.
• Shopify and platforms you connect, to install and operate the app and the integrations you enable.
• Professional advisers, such as lawyers, accountants and auditors, under confidentiality obligations.
• Legal and safety reasons: where required by law, court order or government request, or to protect the rights, property or safety of Retainly, our users or the public.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this Privacy Policy.
• With your permission, or at your direction.

7. International transfers

We operate from the United States and Australia, and our service providers may process information in those and other countries. Where we transfer personal information out of the European Economic Area, the United Kingdom or another region with transfer restrictions, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

8. Merchants’ customers

When we process shopper data for a merchant, we do so under that merchant’s instructions and our agreement with them. Merchants are responsible for providing their own privacy notice to shoppers and for collecting any consent required to send marketing by email, SMS, WhatsApp or push.

If you are a shopper and want to access, correct or delete your information, please contact the store you purchased from. We will help that merchant respond to access, correction and deletion requests about the data we hold for them. If you contact us directly, we will pass your request to the merchant or, where appropriate, act on it ourselves.

9. Data retention

• Demo and sales information is kept for as long as we have an active or potential business relationship with you, and generally no longer than 24 months after our last interaction, unless you ask us to delete it sooner.
• Merchant store data is kept for as long as the merchant uses the Services and for a period afterwards, so an account can be restored if the merchant returns. A merchant can ask us at any time to delete their store data, and we will delete or de-identify it unless we need to keep it to meet a legal obligation.
• Billing and transaction records are kept for as long as tax, accounting and other legal obligations require.

10. Security

We use administrative, technical and organisational measures designed to protect personal information. These include encryption in transit, access controls based on least privilege, and limiting access to the staff and providers who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as the law requires.

11. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct information that is inaccurate or incomplete;
• delete your personal information;
• object to or restrict certain processing, including direct marketing;
• receive your information in a portable format; and
• withdraw consent at any time, where we rely on consent.

California residents have the right to know what personal information we collect, use and disclose; to delete and correct it; and to opt out of its sale or sharing (which we do not do). We will not discriminate against you for exercising these rights.

Australian residents can access and correct their information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are unhappy with how we handle a complaint, you can contact the Office of the Australian Information Commissioner (OAIC).

EEA and UK residents can also complain to their local data protection authority.

To exercise any of these rights, email asad@retnly.ai. We may need to verify your identity before acting on a request, and we will respond within the time the law requires.

12. Cookies and local storage

The Website does not use advertising cookies or third-party analytics. It stores one item in your browser’s local storage: your light or dark theme preference. You can clear it at any time in your browser settings. If we add analytics or similar technologies in the future, we will update this policy and ask for consent where the law requires it.

13. Marketing communications

We send product updates and marketing only if you opt in, for example by ticking the box on our demo request form, or where the law otherwise allows it. Every marketing email includes an unsubscribe link, and you can also opt out by emailing asad@retnly.ai. We will still send you service-related messages, such as replies to your demo request or account notices.

14. Children

The Services are built for businesses and are not directed to children under 16. We do not knowingly collect personal information from children for our own purposes. If you believe a child has given us personal information, please contact us and we will delete it.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version on this page and change the “Last updated” date. If a change is material, we will give merchants reasonable notice by email or in the app before it takes effect.

16. Contact us

For privacy questions or requests, contact Retainly Inc. at asad@retnly.ai, or reach our team here. We have offices in New York and Sydney.