Privacy Policy
Symma Technologies, Inc. (“Symma”, “we”, “our”, or “us”) is committed to protecting the privacy, integrity, and security of both our e-commerce merchant partners and their end-consumers.
Our Core Privacy Commitments
Enterprise transparency and AI data safety
- ✓No AI Model Training: Your store data and shopper queries are never used to train public foundation models.
- ✓Zero Data Selling: We never sell, rent, or monetize your business or personal data.
- ✓Enterprise Google Cloud: Built on ISO 27001, SOC 2 Type II Google Cloud & Vertex AI infrastructure.
- ✓GDPR & CCPA Ready: Full rights for data export, deletion, and access upon request.
1. Scope and Applicability
This Privacy Policy applies to the software services, storefront chat widgets, developer APIs, and merchant management applications provided by Symma (collectively, the “Services”), including our website athttps://symma.shop.
When a merchant installs Symma on their Shopify or Comez store, Symma operates as a Data Processor(or Service Provider) on behalf of the merchant, who acts as the Data Controller regarding customer and catalog information.
2. Information We Collect
A. Merchant Account & Catalog Data
When you sign up for Symma, we collect business contact information (name, business email, store URL) and authorized API access tokens to synchronize your product catalog, variant attributes, stock quantities, and public store policies (e.g. refund rules, shipping FAQs).
B. Shopper Interaction Data
When an end-consumer interacts with the Symma storefront assistant, we temporarily process:
- Chat Messages & Inquiries: Product questions, size inquiries, and conversational inputs.
- Visual Search Photo Uploads: Photos uploaded by shoppers to locate visually matching catalog items.
- Order Lookup Identifiers: Order reference numbers or email addresses provided voluntarily by the shopper to retrieve delivery updates.
C. Technical & Device Information
We collect standard technical metadata necessary for network reliability, rate limiting, and security: IP addresses, browser user-agent, operating system, and anonymized session identifiers.
3. How We Use Information
We process data strictly to provide, optimize, and secure the Symma services, including:
- Grounding AI responses against the merchant’s live inventory to prevent hallucinated product recommendations.
- Executing multimodal visual vector embeddings to match uploaded shopper images against store products.
- Facilitating seamless cart addition and order status checks within the chat interface.
- Preventing malicious traffic, distributed denial-of-service (DDoS) attacks, and unauthorized API exploitation.
4. AI Architecture & Google Cloud Governance
Enterprise AI Privacy Guarantee:
Symma leverages Google Cloud Vertex AI (including Gemini models and multimodal embedding endpoints). Under our enterprise data governance agreements with Google Cloud Platform:
- Your proprietary merchant data is never logged or used by Google or Symma to train foundational machine learning models.
- Shopper queries, images, and catalog embeddings remain strictly confined to the merchant’s isolated multi-tenant container.
- Embeddings and queries are transmitted over encrypted TLS 1.3 channels and stored in dedicated PostgreSQL pgvector instances with AES-256 encryption.
5. Third-Party Sub-processors
Symma partners with vetted infrastructure and platform providers to deliver our services. All sub-processors are bound by Data Processing Agreements (DPAs) meeting or exceeding GDPR and CCPA standards:
| Entity | Purpose | Location |
|---|---|---|
| Google Cloud Platform (GCP) | Cloud Hosting, Vertex AI API, Vector Database | United States / Global |
| Shopify, Inc. | E-commerce API Integration & Webhooks | Canada / United States |
| Comez Commerce | Native E-commerce API Sync | India / United States |
6. Data Retention & Deletion
We retain merchant catalog data only for the duration of the active subscription. When a merchant uninstalls Symma, catalog embeddings and associated cached store knowledge are automatically purged within 30 days.
Shopper conversation logs are retained for analytics purposes for up to 90 days, after which they are permanently anonymized or deleted. Uploaded visual search images are processed ephemerally in RAM for vector calculation and not stored permanently on disk.
7. Your Rights under GDPR and CCPA
Depending on your geographic location, you may have statutory rights regarding your personal information, including:
- Right of Access & Portability: Request a copy of your personal data held by Symma.
- Right to Rectification: Correct inaccurate or incomplete personal records.
- Right to Erasure (“Right to be Forgotten”): Request permanent deletion of your data.
- Right to Opt-Out: Opt out of non-essential processing. (Note: Symma does not sell personal data).
To exercise any of these rights, please contact our Privacy Office at privacy@symma.shop. We acknowledge and fulfill verified requests within 30 days.
8. Children’s Privacy
Symma’s services are strictly intended for commercial entities and individuals aged 18 and older. We do not knowingly collect personal information from children under 13 (or under 16 in the European Economic Area).
9. Contact Our Privacy Office
If you have questions, feedback, or concerns regarding this Privacy Policy or our security practices, please contact us:
Symma Technologies, Inc.
Attention: Data Protection Officer
Email: privacy@symma.shop
General Support: support@symma.shop