Privacy Policy

This Privacy Policy explains how A³ (operated by Konstantin Tikhaev, an Israeli sole proprietorship — "Esek Patur" — registered as Mispar Esek 346571938 at Hanna Rovina 2, Haifa 3495402, Israel — referred to as "A³", "we", "us", or "our") collects, uses, retains, and shares personal information when you interact with our services.

A. About this policy and our role

A³ provides a live, AI-powered ambassador (voice + text + video) that Shopify merchants ("Merchants") embed on their storefronts. When a shopper ("Shopper") interacts with the embedded ambassador, A³ processes data on the Merchant's behalf.

We act in two distinct roles, and your rights depend on which one applies:

• Controller / Business (GDPR Article 4(7), CCPA "Business"): when we operate our marketing website (app.triplea.studio) and process the personal information of Merchants who subscribe to our services.
• Processor / Service Provider (GDPR Article 4(8), CCPA "Service Provider"): when we process the personal information of Shoppers on behalf of a Merchant Customer. In this role, the Merchant is the Controller; requests about Shopper data should be directed to the Merchant first. Our DPA (Schedule 2) implements the EU Commission Standard Contractual Clauses, Module 2 (controller→processor), where applicable.

B. Geographic scope — who we serve

A³ is offered globally. We comply with the privacy and data protection laws of every region where our service is available, including but not limited to: the European Union and EEA (General Data Protection Regulation, Regulation (EU) 2016/679, "GDPR"), the United Kingdom (UK GDPR and Data Protection Act 2018), Switzerland (Federal Act on Data Protection, "FADP"), the United States (California Consumer Privacy Act / California Privacy Rights Act, Colorado, Connecticut, Utah, Virginia, Texas, Oregon, Montana, and other state laws; Illinois Biometric Information Privacy Act; Federal Trade Commission Act §5 on unfair and deceptive practices and AI guidance), Canada (Personal Information Protection and Electronic Documents Act "PIPEDA" and Quebec Law 25), Australia (Privacy Act 1988 and the Australian Privacy Principles, as amended by the Privacy and Other Legislation Amendment Act 2024), and New Zealand (Privacy Act 2020).

EU/EEA & UK note: We are not established in the European Union or the United Kingdom and currently process data of EU/UK residents on an occasional, non-large-scale basis incidental to Merchants based outside the EU/UK whose storefronts may attract visitors from these regions. We have not appointed a formal Article 27 GDPR representative at this stage; we will appoint one promptly if our processing of EU/UK residents' data becomes regular and substantial, or upon written request from a competent supervisory authority. Until such appointment, EU/EEA and UK data subjects may exercise all rights described in §J and lodge any complaint with their local supervisory authority (see §W).

Israel adequacy: A³ is operated from Israel, which has been recognised by the European Commission as offering an adequate level of data protection (Decision 2011/61/EU as last reviewed). Personal data transferred from the EU/EEA, UK, or Switzerland to A³ benefits from this adequacy finding. Onward transfers to our US-based sub-processors are governed by Standard Contractual Clauses and the EU-US / UK-US / Swiss-US Data Privacy Frameworks where the sub-processor is self-certified (see §Q and the Subprocessors page).

C. Personal information we collect

From Merchants (when you subscribe)

• Account identifiers: email address, name, password hash (via Firebase Authentication).
• Shop identifiers: Shopify shop domain, store name, currency, locale, country, timezone (provided by Shopify Admin API during install).
• Payment identifiers: a tokenized customer ID from Shopify Billing (Shopify-distributed plans) or Polar.sh (direct web subscriptions). We do not see your full payment card number.
• Configuration data: ambassador persona settings, knowledge base entries, tool toggles, objectives, guardrails — all values you provide in the merchant dashboard.

From Shoppers (when they interact with the ambassador)

• Conversation text: the text transcript of what you and the ambassador say to each other.
• Voice audio: streamed to our processing layer in real time and immediately converted to text. See "Voice processing" below for retention.
• Behavioral signals: when you clicked on a product card the ambassador surfaced, when you accepted a discount, when you opted out.
• Technical metadata: IP address (hashed in our event logs — see §F), browser and operating-system details, approximate country (for geofencing), timezone, referrer URL.
• Voluntarily provided: email address or phone number if you give it to the ambassador (e.g., to receive an order update or follow-up).

From Shopify APIs (only what Merchant scopes allow)

With the Merchant's authorization via the Shopify App OAuth flow, A³ reads — and in limited cases writes — Shopify Admin data on behalf of the Merchant. The exact scopes we request are disclosed at install. As of this version they are:

• read_products, read_product_listings, read_inventory, read_locations, read_collections: to recommend, compare, and check availability.
• read_orders, read_customers: to answer order-status and recent-order questions when the Shopper has confirmed their email in the conversation.
• read_shipping, read_discounts, read_themes: to answer shipping, promo-code, and storefront-styling questions.
• write_discounts: to generate a single-use, time-limited discount code in response to Shopper price hesitation. Codes are prefixed A3-, expire within 7 days, capped at 50% off, and apply once per customer.
• write_draft_orders: to create a draft order with an invoice link the Shopper can pay. Drafts are never auto-completed; the Shopper must pay through the invoice.

D. Voice processing — explicit disclosure

When a Shopper interacts with A³ via voice, audio is streamed to our processors in real time and converted to a text transcript on-the-fly. The raw audio stream is discarded within thirty (30) seconds of transcription. We do not create voiceprints, faceprints, or any biometric template, and we do not use Shopper voice data to train, fine-tune, or improve any AI model. Only the resulting text transcript is retained for the period stated in §I.

The ambassador's synthetic voices (Anna, Maya, Sophia, Hannah, Ella, Amara, Daniel, Marcus, David) are generated by AI text-to-speech and are not voice clones of any real person. The avatar faces are AI-generated stock characters licensed for our use; they are not photographs of any real individual.

E. Purposes of processing and legal bases

For Shoppers based in the EU/EEA, the UK, or Switzerland, our legal bases under GDPR Article 6(1) are noted below. For other regions, the equivalent statutory ground is listed in parallel.

Where we rely on consent (6(1)(a)), you may withdraw it at any time without affecting the lawfulness of prior processing — see §J and the Your Privacy Choicespage. Where we rely on legitimate interest (6(1)(f)), you may object to processing based on your particular situation; we will stop unless we demonstrate compelling legitimate grounds that override your interests (GDPR Article 21).

F. AI training — no use of Shopper conversations by default

We do not use individual Shopper conversation content to train our base AI models or those of our AI sub-processors (Google Vertex AI, Anthropic via AWS Bedrock). Our agreements with these sub-processors contractually prohibit them from training their foundation models on our customer data. Merchants may opt in (in the merchant dashboard) to aggregated, de-identified analytics that help us improve A³'s quality across all stores; this is an active opt-in setting and can be revoked at any time.

G. Cookies and tracking

We use four categories of cookies and similar technologies:

• Strictly necessary: session token, CSRF protection, language preference. Cannot be disabled.
• Preferences: theme (light/dark), persisted ambassador choice. Disabling will reset your preferences on next visit.
• Analytics: aggregate usage measurement (page views, button clicks) on our marketing site only — not on Merchant storefronts. Disabled by default; opt-in required.
• Marketing: we currently do not run advertising trackers. If we add them, we will update this policy and require explicit opt-in.

Quebec residents: we ship a granular cookie banner with per-category opt-in (not a single "Accept all"). You can change your preferences at any time from the "Your Privacy Choices" link in the footer.

California & other CCPA-state residents: we honor Global Privacy Control (GPC) browser signals. Setting GPC on your browser will be treated as a request to opt out of any sale or sharing of personal information (we currently do neither).

H. Sub-processors

We use a small set of carefully chosen third-party service providers to deliver A³. Our current list — and the regions where they host data — is maintained on a separate page so it is always current:

View the current sub-processors list →

We will give Merchants at least twenty (20) days' notice before adding or replacing a sub-processor that processes Merchant or Shopper personal information. Merchants may object during that window; if we cannot resolve the objection, the Merchant may terminate the affected portion of the service. Sign up for notifications at privacy@triplea.studio with subject "subprocessor-notifications".

I. Retention

We retain personal information for the shortest period consistent with the purpose for which it was collected and applicable law. Conversation data retention is tied to the Merchant's plan tier:

• A³ Lite: conversation transcripts retained for 30 days.
• A³ Starter: conversation transcripts retained for 60 days.
• A³ Pro / Growth: conversation transcripts retained for 90 days by default; configurable by the Merchant.
• A³ Enterprise: as specified in the Merchant's separately executed DPA.
• Voice audio: discarded within 30 seconds of transcription (see §D).
• Account-level data: retained while subscription is active and for 90 days after cancellation, then deleted.
• Billing records: retained for tax and audit purposes for up to seven (7) years as required by Israeli tax law.

J. Your rights (Shoppers)

Where we act as Processor on behalf of a Merchant, please submit data-subject requests to the Merchant first; they are the Controller. We will assist the Merchant in responding within the timeframes required by applicable law.

If you are unable to reach the Merchant, you may contact us at privacy@triplea.studio. We will forward your request to the Merchant and, if they do not respond, we will fulfill it directly within thirty (30) days where required by law.

California (CCPA / CPRA)

• Right to know what personal information we have collected, used, or disclosed.
• Right to delete personal information we have collected.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information (we do neither).
• Right to limit the use of sensitive personal information (we do not use any in this category).
• Right not to be discriminated against for exercising these rights.

Other US states (CT, CO, UT, VA, TX, etc.)

Equivalent rights apply. Submit a request via privacy@triplea.studio.

Canada (PIPEDA, Quebec Law 25)

You have the right to access, correct, withdraw consent, request deletion, and (Quebec residents) data portability. Quebec residents have an additional right to a human review of automated decisions; A³ does not make "significant decisions" about you (see §M), but you may still request review.

Australia (APPs) and New Zealand (Privacy Act 2020)

You may access and correct your personal information; complain to us; or complain to the OAIC (AU) or Office of the Privacy Commissioner (NZ).

European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR / FADP)

Under GDPR / UK GDPR, you have the following rights:

• Right of access (Article 15): obtain confirmation of whether we process your personal data, what data, the purposes, recipients, retention period, and a copy.
• Right to rectification (Article 16): correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Article 17): request deletion in defined circumstances (consent withdrawn, data no longer necessary, unlawful processing, etc.).
• Right to restriction of processing (Article 18): temporary halt of processing while accuracy or legal basis is contested.
• Right to data portability (Article 20): receive your data in a structured, commonly used, machine-readable format (we provide JSON export); transmit to another controller where technically feasible.
• Right to object (Article 21): object to processing based on legitimate interest (6(1)(f)) on grounds of your particular situation; we will stop unless we demonstrate compelling overriding grounds.
• Right to withdraw consent (Article 7(3)): where processing is based on consent (6(1)(a)), withdraw at any time without affecting lawfulness of prior processing.
• Rights related to automated decision-making (Article 22): right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. A³ does not make such decisions — see §N.
• Right to lodge a complaint with a supervisory authority (Article 77): see §W for a list of authorities by country.

Submit requests via Your Privacy Choices or privacy@triplea.studio. We will respond within one (1) month as required by GDPR Article 12(3), extendable by two further months for complex requests (we will notify you of the extension within the first month). There is no fee for legitimate requests. We may require verification of your identity (e.g., confirming the email address associated with your activity) before disclosing personal data.

Switzerland (FADP): Swiss residents enjoy equivalent rights under the revised Federal Act on Data Protection (in force 1 September 2023). Submit requests to the same address.

K. "Your Privacy Choices" (California-mandated link)

You may submit a privacy request — including a request to opt out of any sale or sharing of personal information — via the Your Privacy Choices page or by emailing privacy@triplea.studio. We currently do not sell or share personal information; this link exists to acknowledge your rights and provide a contact channel.

L. State-specific disclosures

Two-party consent / recording disclosure (CA, CT, DE, FL, IL, MD, MA, MT, NV, NH, PA, WA)

Conversations with the A³ ambassador are recorded as text transcripts. Audio is not retained (see §D). Before any microphone is activated on the Merchant's storefront, you are shown an explicit disclosure card with a "Continue" button. Clicking Continue constitutes your consent to recording under the laws of these jurisdictions. If you do not consent, do not click Continue; the ambassador will remain inactive.

Nevada (covered information sales opt-out)

Nevada residents may direct us not to make sales of any "covered information" as defined under Nevada law. We do not sell covered information. To submit a Nevada opt-out, email privacy@triplea.studio.

M. Illinois Biometric Information Privacy Act (BIPA)

A³ does not collect, capture, store, scan, or otherwise process any "biometric identifier" or "biometric information" as defined by 740 ILCS 14/ (the Illinois Biometric Information Privacy Act). Specifically, we do not retain voiceprints, faceprints, retina or iris scans, or fingerprint data. Voice audio is converted to text in real time and discarded within thirty (30) seconds; no template, model, or vector derived from Shopper voice characteristics is created or retained. The ambassador's synthetic voices and faces are AI-generated and are not derived from any individual.

N. Automated decisions

A³ is an interactive shopping assistant. It surfaces products, answers questions, and offers discount codes. It does not make "significant decisions" about you (in the sense of CCPA ADMT regulations or Australian Privacy Act 2026 amendments). Specifically, A³ does not determine your eligibility for financial products, housing, education, employment, insurance, healthcare, or any legal, immigration, or government service.

California, Quebec, and (from December 2026) Australian Shoppers may request a human review of any automated interaction. Contact privacy@triplea.studio.

O. AI interactions — your right to know

When you interact with A³, you are talking to an AI ambassador, not a human employee of the Merchant. The ambassador identifies itself as AI at the start of every conversation (per FTC guidance). If at any point you wish to speak with a human, ask the ambassador to escalate; depending on the Merchant's configuration, it will provide a contact email, a callback option, or a hand-off to the Merchant's human support team.

P. Children under 13 (COPPA)

Our service is not directed to children under the age of thirteen (13), and we do not knowingly collect personal information from anyone under 13. If we discover that we have collected such information, we will delete it immediately. California residents under 16 have additional opt-in protections; we treat all California users under 16 as if Do Not Sell or Share applies by default.

Q. International data transfers

A³ is operated from Israel, recognised by the European Commission as offering an adequate level of data protection. Personal data transferred from the EU/EEA, UK, or Switzerland to A³ relies on this adequacy decision and requires no additional safeguards.

Onward transfers from A³ to our US-based infrastructure sub-processors (Google Cloud, AWS, Cerebrium, Vercel) are protected by a combination of:

• EU Commission Standard Contractual Clauses (Decision 2021/914, the "new SCCs"), Module 2 (controller→processor) or Module 3 (processor→sub-processor) as applicable, executed with each sub-processor.
• UK International Data Transfer Addendum to the EU SCCs (UK Information Commissioner's Office template, in force since 21 March 2022).
• Swiss Federal Data Protection and Information Commissioner amendments to the SCCs for Switzerland-originating data.
• EU-US, UK-US, and Swiss-US Data Privacy Frameworks where the sub-processor maintains active self-certification with the US Department of Commerce (currently: Google Cloud, AWS, Vercel — see the Subprocessors page for the live status).
• Supplementary technical measures as required by the CJEU Schrems II ruling: TLS 1.3 in transit, encryption at rest (AES-256 / AWS KMS / Google Cloud KMS), customer-managed encryption keys where supported, and access logging.

Where a Merchant or Shopper would prefer that their data not be transferred to the US, please contact privacy@triplea.studio. We will discuss EU-region hosting options on a case-by-case basis; note that AI inference for the ambassador currently relies on US-region GPU infrastructure, and EU-region inference capacity is a roadmap item.

A copy of the executed SCCs and DPF certifications relevant to your data is available on request to privacy@triplea.studio.

R. Security

We protect your information using industry-standard measures including TLS 1.3 in transit, encryption at rest (AWS KMS, Google Cloud encryption), least-privilege access controls, multi-factor authentication for administrators, server-side input validation, audit logging, and personally identifiable information (PII) redaction on event-stream writes. No service can guarantee absolute security; in the unlikely event of a personal data breach we will notify affected Merchants without undue delay and in any event within seventy-two (72) hours of becoming aware, as set out in our DPA.

S. Contact

Questions, requests, or complaints? Email privacy@triplea.studio. We respond to all privacy enquiries personally.

Postal: A³, Konstantin Tikhaev (Esek Patur 346571938), Hanna Rovina 2, Haifa 3495402, Israel.

Privacy contact / single point of contact: Konstantin Tikhaev acts as the responsible person for privacy matters at A³.

Data Protection Officer (GDPR Article 37): We have determined that appointing a formal DPO is not mandatory under Article 37(1) given (a) we are not a public authority, (b) our core activities do not consist of large-scale, systematic monitoring of data subjects, and (c) our core activities do not consist of large-scale processing of special categories of data or criminal-conviction data. We reassess this determination at least annually and will appoint a DPO if our processing scale changes.

EU/UK Representative (GDPR Article 27): We have not appointed a formal Article 27 representative at this stage; our processing of EU/UK residents' data is occasional and incidental to Merchants located outside the EU/UK whose storefronts may attract EU/UK visitors. We will appoint a representative promptly if (a) our EU/UK processing becomes regular and substantial, or (b) a competent supervisory authority requests one. Until such appointment, EU/UK data subjects may contact privacy@triplea.studio directly and have the same rights and response timelines as if a representative were in place.

U. EU AI Act statement

Under EU Regulation 2024/1689 (the "AI Act"), A³ operates an AI system classified as "limited risk" — specifically, an AI system intended to interact directly with natural persons (Article 50). We comply with the relevant transparency obligations:

• AI identity disclosure: the ambassador identifies itself as AI at the start of every conversation and on the disclosure card shown before microphone activation (Article 50(1)).
• Synthetic media labelling: the ambassador's voice and avatar are AI-generated and do not impersonate any real person; this is disclosed in §D and the disclosure card (Article 50(2)).
• No prohibited AI practices: A³ does not use subliminal techniques, exploit vulnerabilities of specific groups, perform social scoring, real-time biometric identification, or any practice prohibited by AI Act Article 5.
• No high-risk AI use cases: A³ is not used in any of the high-risk domains listed in AI Act Annex III (employment, education, essential services, law enforcement, migration, justice, democratic processes).

V. CCPA-specific disclosures (annual statistics)

In the preceding twelve (12) months, A³ has:

• Collected the categories of personal information listed in §C from Merchants and Shoppers as described in this policy.
• Not sold personal information for monetary or other valuable consideration.
• Not shared personal information for cross-context behavioural advertising.
• Disclosed personal information to the categories of recipients listed on the Subprocessors page for the operational purposes set out in §E.
• Received requests under CCPA / CPRA and responded within the statutory 45-day window (extendable to 90 with notice). Aggregate counts of requests received and responded to are published annually on the Your Privacy Choices page once we exceed the 100,000-California-resident threshold; below this threshold, the disclosure is not statutorily required.

W. Lodge a complaint with a supervisory authority

If you are dissatisfied with our handling of your personal data, you have the right to lodge a complaint with a competent supervisory authority. Below are the authorities for selected jurisdictions; this list is illustrative, not exhaustive:

• EU/EEA: your local Data Protection Authority — full list at edpb.europa.eu/about-edpb/about-edpb/members.
• United Kingdom: Information Commissioner's Office — ico.org.uk.
• Switzerland: Federal Data Protection and Information Commissioner — edoeb.admin.ch.
• California: California Attorney General — oag.ca.gov/privacy; California Privacy Protection Agency — cppa.ca.gov.
• Canada: Office of the Privacy Commissioner of Canada — priv.gc.ca; Commission d'accès à l'information du Québec — cai.gouv.qc.ca.
• Australia: Office of the Australian Information Commissioner — oaic.gov.au.
• New Zealand: Office of the Privacy Commissioner — privacy.org.nz.
• Israel: Privacy Protection Authority — gov.il/en/departments/the_privacy_protection_authority.

We'd appreciate the opportunity to address your concerns directly before you approach a supervisory authority — please give us thirty (30) days to respond.

T. Changes to this policy

We may update this Privacy Policy from time to time. For material changes we will give Merchants at least thirty (30) days' notice via the merchant dashboard and email. The "Last updated" date at the top reflects the current version. Continued use after the effective date constitutes acceptance.