Emoatly Privacy Policy
Effective date: July 5, 2026
Last updated: July 5, 2026
This Privacy Policy explains how Whilarza Creative Solutions Inc. ("Whilarza", "we") handles personal data in connection with Emoatly (the "Service"), an AI email-marketing strategist for e-commerce brands.
1. Two Roles: Controller and Processor
- For account data (your email address, billing details, usage of the Service), we act as a data controller.
- For personal data contained in your brand's customer content (e.g. names appearing in reviews you upload or sync), we act as a data processor on your instructions. You are the controller of that data, and our processing is further described in our Data Processing Addendum (available on request at hello@emoatly.com).
2. Data We Collect
Account data: email address (authentication is passwordless via magic link), subscription tier and billing status (payment card details are held by Stripe, not by us), and support communications.
Brand data you provide or connect: website URLs and scraped page content; competitor URLs you nominate; uploaded files (CSV; we deliberately do not accept spreadsheets with executable content); customer reviews, survey responses, and quotes; data synced from integrations you authorize (Klaviyo campaign data and metrics, Shopify product and aggregate order summaries, Okendo reviews).
Data we deliberately minimize: our ingestion pipeline strips columns commonly containing personal data (emails, phone numbers, addresses, IP addresses, financial and ID numbers) from uploaded files, and runs remaining text through automated PII redaction (emails, phone numbers, card numbers, addresses, and similar identifiers) before analysis. Our Shopify sync stores aggregate summaries, not row-level customer records. Redaction is automated and not guaranteed to catch every identifier.
Usage and technical data: generation counts, token usage and processing costs, timestamps, and logs necessary to operate and secure the Service. We use minimal cookies — strictly those required for authentication and session management. [CONFIRM AT LAUNCH: analytics tool on the marketing site, if any, and update this sentence.]
3. How We Use Data
- To provide the Service: building your Brand DNA, generating strategy and content, syncing integrations, showing performance analyses.
- AI processing: brand data and customer content excerpts are sent to our AI infrastructure providers (listed in §6) to generate analysis and content. We do not use your content to train our own models, and our providers process API data under terms that do not permit them to train their models on it.
- To operate the business: billing, usage-limit enforcement, support, service emails (e.g. trial and billing notices), security, and abuse prevention.
- We do not sell personal data, and we do not use your customers' data for advertising.
4. Retention and Deletion
- Customer Content is retained while your account is active so the Service can maintain your Brand DNA over time.
- Account deletion is self-serve (Settings → Delete account) and cascades: brands, files, sources, analyses, and subscriptions are deleted. Residual copies in encrypted backups expire on the backup provider's rotation schedule.
- You may request deletion of specific content (e.g. an individual customer's quotes) at hello@emoatly.com and we will action it within 30 days.
5. Security
Measures in place include: row-level security isolating each account's data; encryption in transit (TLS) and at rest; encrypted storage of integration credentials; server-side-only service credentials; role-restricted database functions; rate limiting; and webhook signature verification. No method of transmission or storage is 100% secure.
6. Subprocessors and Service Providers
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage, realtime | [US region — confirm project region] |
| Vercel | Application hosting | US/global edge |
| Anthropic | AI model inference (analysis and generation) | US |
| Firecrawl | Website content retrieval | US |
| Perplexity | Public-web research queries | US |
| Apify | Public review retrieval (e.g. Amazon) | US/EU |
| Inngest | Background job orchestration | US |
| Stripe | Payments and billing | US/global |
| Resend | Transactional email (magic links, service notices) | US |
| Klaviyo / Shopify / Okendo | Only if you connect them — data sync you authorize | per provider |
We will update this list when subprocessors change; material changes are notified to account holders by email.
7. International Transfers
We are based in the United States (California) and our providers process data primarily in the United States. Where we process personal data subject to GDPR/UK GDPR, transfers rely on appropriate safeguards (our providers' Standard Contractual Clauses / Data Privacy Framework participation, as applicable).
8. Your Rights
Depending on your location (e.g. GDPR, CCPA), you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing. Contact hello@emoatly.com; we respond within 30 days. If your data appears in a brand's Customer Content, we may redirect your request to that brand (the controller) and will assist them in fulfilling it. You may also lodge a complaint with your supervisory authority.
9. Children
The Service is for business users and not directed to anyone under 18; we do not knowingly collect children's data.
10. Changes
We will post updates here and notify account holders by email of material changes at least 14 days before they take effect.
11. Contact
Whilarza Creative Solutions Inc. — Emoatly 6426 Ruby St, Los Angeles, CA 90042, USA hello@emoatly.com