Legal

Privacy Policy

Last updated: 27 October 2026

Data controller

Aequus Ventures SRL, Via Londra 14/B, 07026 Olbia (SS), Italy, VAT number IT03075070908. GroceryAI is a product developed and owned by Aequus Ventures SRL. For any question about personal data: hello@groceryai.ai.

What this policy covers

  • The website groceryai.ai.
  • The retailer portal, groceryai.ai/app, where a store sets up and manages its assistant.
  • The GroceryAI assistant that answers a store's customers on WhatsApp and on the store's website (GroceryAI Web Chat).

Website visitors

  • Visit statistics (legitimate interest, Art. 6.1.f GDPR): pages viewed, referrer, device type and browser, approximate location, anonymous and aggregated, with Vercel Web Analytics, which uses no third-party cookies.
  • Booking a call (pre-contractual measures, Art. 6.1.b): name, email and what you write in the booking form (Cal.com); the call takes place on Google Meet.
  • Messages you send us (Art. 6.1.b): your address and the content, to reply to you.
  • Giving us this data is optional, but without it we cannot reply to you or schedule the call.

The retailer portal

For the people of a store who use the portal we process, to provide the service under the contract with the store (Art. 6.1.b) and to keep it secure (Art. 6.1.f):

  • email address, name, role and store;
  • sign-in data: two-step verification factors, linked devices and sessions;
  • the log of the actions taken in the portal (who, what, when);
  • technical measurements of the pages (loading times and errors), without the texts you type.

The WhatsApp channel and the assistant

When a store uses GroceryAI, its customers can order and ask questions on WhatsApp or in the chat on the store’s website. In this case the store is the data controller; Aequus Ventures SRL processes the data on its behalf, as a data processor under Art. 28 GDPR, under a written agreement with the store, and only for the purposes the store sets: taking orders and assisting its customers.

The data processed:

  • phone number and WhatsApp profile name;
  • the messages you send and receive, including the photos and voice messages you send;
  • the cart, the orders and the details you give to complete them.

Replies are written by an artificial intelligence model. Prices, totals and delivery slots come from the store’s systems, not from the model. Every day an automatic check reviews the quality of the conversations. The data is not used to train artificial intelligence models (OpenAI does not use data sent to its API for training) and is never sold or used for advertising. No decision with legal effects on you is taken solely by automated means: the store checks and fulfils the order.

For your data as a store’s customer you can contact the store or us directly: how to request deletion.

Service providers that process data

We use these providers, each under a data processing agreement. Before adding a new one we update this list. For each one, what it processes, where and with which safeguards: sub-processors.

  • Meta Platforms (WhatsApp Business Platform, Cloud API): delivers WhatsApp messages; processes them in Meta data centers, as a data processor, and keeps them for at most 30 days.
  • OpenAI: the model that reads the conversation (including photos and voice messages) and writes the replies; United States, with the European Commission’s Standard Contractual Clauses; data sent to its API is kept for at most 30 days for abuse monitoring.
  • Supabase: database, portal sign-in and service functions; the database is in the eu-north-1 region, in Stockholm (Sweden, European Union).
  • Vercel: hosts the website and the portal; server functions run in Frankfurt (Germany), pages are delivered by its worldwide network.
  • n8n: service automations; hosted in Frankfurt (Germany).
  • Cloudflare: traffic to groceryai.ai (website and portal) passes through its network, which protects and routes it; worldwide network, with the Standard Contractual Clauses.
  • Resend: sends the service emails (the codes and links to sign in to the portal and, for stores that choose it, orders by email); United States, with the Standard Contractual Clauses.
  • Google: email and video calls (Gmail, Google Meet) and the sheet of the daily quality check (Google Sheets), with short excerpts of the conversations; United States, with the Standard Contractual Clauses.
  • Cal.com: booking calls from the website; United States, with the Standard Contractual Clauses.

Where the data is

The service database is in the European Union (Stockholm). Some providers process data in the United States or across their worldwide network (OpenAI, Meta, Google, Vercel, Cloudflare, Resend, Cal.com): transfers rely on the Standard Contractual Clauses adopted by the European Commission or on the other mechanisms provided by the GDPR, as set out in each provider’s data processing terms. To obtain a copy of the safeguards, write to hello@groceryai.ai.

How long we keep data

  • Call bookings: 12 months after the last contact, or until you ask for deletion.
  • Messages you send us: for the duration of the relationship and as long as the law requires.
  • Portal: as long as the account is active; when a store closes, its data is deleted (see below).
  • Conversations and orders of a store's customers: as long as the store uses GroceryAI, or until the store or the customer asks for deletion. When a store closes, after 30 days in which it can change its mind, its data is deleted; of the technical logs only anonymous data remains (times, durations, costs), with no texts or identifiers.
  • At the providers: Meta keeps messages for at most 30 days; OpenAI keeps data sent to its API for at most 30 days.
  • Backups: the database has a daily backup, kept by the provider for 7 days; deleted data also disappears from the backups within 7 days.

Security

Communications with the website, the portal and the service are encrypted (HTTPS). Each store’s data is kept separate from other stores’ data, and portal access requires authentication; the database is encrypted at rest by the provider. The measures in detail: security.

Your rights

You can ask to access your data, to correct or delete it, to restrict its processing, to object, and to receive it in a portable format. Write to hello@groceryai.ai: we reply within one month. For deletion: data deletion.

You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): www.garanteprivacy.it.

Cookies

This website uses no profiling or advertising cookies. Visit statistics (Vercel Web Analytics) use no third-party cookies. The portal uses only the technical cookies needed to keep you signed in. The booking form (Cal.com) may use technical cookies to work. Some preferences (for example a notice you closed) stay only in your browser. Technically necessary cookies need no consent (Art. 5(3) of the ePrivacy Directive).

Changes

When this policy changes, we update the date at the top of the page. Terms for stores: terms of service.