Privacy Policy

Last updated: 1 September 2026

At Rymera Web Co, we recognize that privacy of your personal information is important. Here is information on what types of personal information we receive and collect when you visit our site, interact with our business, and how we safeguard your information.

1. Introduction

Storeagent.ai (a subsidiary of Rymera Web Co) (“us”, “we”, or “Company”) is committed to respecting the privacy rights of its customers, visitors, and other users of the Company Website (“the Site”). We created this website Privacy Policy (“Privacy Policy”) to give you confidence as you visit and use the Site, and to demonstrate our commitment to fair information practices and the protection of privacy. This Privacy Policy applies to the Site, to the StoreAgent plugin and to the hosted services that the plugin connects to (together, the “Services”). It does not apply to any other website or service you can reach from the Site or through the Services, including any third-party AI assistant you choose to connect to your store. Those other websites and services may have data collection, storage and use practices that differ materially from this Privacy Policy.

2. Information Collection Practices

2.1 Types of Information Collected

(a) Traffic Data Collected

We automatically track and collect the following categories of information when you visit our Site: (1) IP addresses; (2) domain servers; (3) types of computers accessing the Site; and (4) types of web browsers used to access the Site (collectively “Traffic Data”). Traffic Data is anonymous information that does not personally identify you but is helpful for marketing purposes or for improving your experience on the Site. We also may use “cookies” to customize content specific to your interests. Third-party service providers which may provide information about you when you browse the website, click on links, log in to your account, make a purchase. This includes Google Analytics and Facebook Pixel.

(b) Personal Information Collected

In order for you to download products that we offer via the Site, we require you to provide us with certain information that personally identifies you (“Personal Information”). Personal Information includes the following categories of information: (1) Contact Data (such as your name and e-mail address) and (2) Demographic Data (such as your country). If you communicate with us by e-mail or post messages, any information provided in such communication may be collected as Personal Information.

(c) Payment Information Collected

We do not store your credit card or other payment details on our Site or servers. These services are provided by third-party providers (currently Stripe and PayPal) and storage of that payment information and the actual transaction does not happen on our servers. Please refer to their privacy policies and services for more information about how their services operate.

(d) Usage Tracking

StoreAgent plugins collect certain information through usage tracking. The purpose of usage tracking is to help us better understand our users and their website needs by looking at a range of variables in their StoreAgent plugins, WordPress environment, and web host. This information allows us to continuously improve our products as well as our QA/testing process. The information may include the license key (and type), plugin activation status, and setting usage to help us make sure our features and updates get tested in situations that closely match our customers’ site environments and StoreAgent usage. We may also collect information about active integrations and plugin settings. Sensitive settings such as API keys are automatically excluded from tracking. Our usage tracking includes collecting information as to the WordPress active theme/plugins, locale, timezone, whether SSL is enabled, if the site is a multisite instance, and the site URL and admin email. In addition, the usage tracking includes determining the PHP and MySQL Versions in order to help us make sure our testing procedures have proper coverage to avoid compatibility issues, and determining the server software, which is used for testing purposes.

Opting Out of Usage Tracking: If you have a paid license with StoreAgent then you will, by default, be opted into usage tracking. To disable this, please reach out to support and they will happily help out. If you’re using StoreAgent’s free plugin and would like to enable usage tracking so that our team can keep making our product better, then please go to Settings > Help. On this screen, you’ll need to check the Allow Usage Tracking checkbox.

(e) SMS & Text Messaging

StoreAgent offers account and transaction-related text message (SMS) and voicemail notifications to customers who provide a mobile phone number. For this purpose we collect only your mobile phone number and your messaging preferences (including your opt-in and opt-out status).

We use this information solely to send you messages relating to your account, such as subscription, billing, and payment notifications. Message frequency varies. Message and data rates may apply. You can opt out at any time by replying STOP to any message, or reply HELP for assistance.

No mobile information — including your phone number and SMS opt-in or consent — will be sold, rented, or shared with any third parties or affiliates for marketing or promotional purposes. We may share your information with subcontractors who provide services on our behalf (such as messaging and customer-support providers) strictly to deliver these messages, and they are not permitted to use it for any other purpose. Text-messaging opt-in data and consent are not shared with any third parties for any other use case.

(f) Store Data Processed by the Services

When you install the StoreAgent plugin and connect your account, the Services process content and data from your WooCommerce store (“Store Data”) to provide the features you have enabled. Store Data may include:

• Store content — product titles, descriptions, attributes, categories, tags, images and image metadata, posts and pages, coupons, and product reviews.
• Chat conversations — messages sent by visitors through the chat widget, the replies generated, and a session identifier and timestamps. We do not record IP addresses or browser details. Messages are free text, so a visitor may type personal information such as their name, email address or order number. We do not ask for it, but it forms part of the transcript. Conversations are deleted after 30 days — see §3.3.
• Order details looked up during a chat — if a visitor gives an order number, we retrieve that order from your store to answer their question. The lookup deliberately excludes the customer’s name, email address, telephone number and street address. It returns order and delivery details such as status, totals, items and delivery area, plus any note the customer left at checkout. It is used only to answer that question and is not added to AI memory.
• Configuration and account data — your plugin settings, licence and plan status, and credit usage.

We use Store Data solely to provide the features you have enabled, to generate the content you request, and to maintain and support the Services. We do not use Store Data to build advertising profiles, and we do not sell it.

Where Store Data contains personal information about your customers or site visitors, you are the controller of that information and we process it on your behalf as your processor, in accordance with your instructions and our Data Processing Addendum, available at https://storeagent.ai/dpa/.

(g) Connected AI Assistants (Model Context Protocol)

You can connect a third-party AI assistant, such as Claude or ChatGPT, to your store using the Model Context Protocol (“MCP”). The assistant can then discover and run StoreAgent tools (“abilities”) on your store. This feature is off until you turn it on.

To authorise a connection you sign in on your own store and choose whether it is read-only or read-write. Abilities then run on your store as the user who approved the connection, subject to that user’s permissions — an assistant cannot do anything you could not already do yourself.

What this means for your data:

• Requests and results pass through our service on their way between your store and your assistant.
• We record which connection ran which tool, the outcome and the time — never the content of a request or its result. We keep that record for three months; your store keeps its own activity log for 30 days. We do not retain results, index them, or add them to AI memory.
• Most abilities do not involve personal information. The exceptions are those that return chat conversations, which are free text and may contain personal information about your customers.
• You choose the AI assistant, and that provider’s terms and privacy policy govern what it does with the data it receives — including whether it retains that data or uses it to train models. Consumer and business plans often differ. Review your provider’s terms before you connect.

Abilities from other software. You can also expose abilities registered by other plugins, themes or WooCommerce itself. These are off until you switch each one on. We do not write, control or review them and cannot tell you what data they return — which may include order and customer records. Satisfy yourself about an ability before exposing it.

Your responsibilities. Connecting an assistant discloses store data — potentially including personal information about your customers — to the provider you chose. You are responsible for having a lawful basis to do so, for reflecting it in your own privacy notice, and for choosing an appropriate access level and abilities. You can revoke a connection at any time in your StoreAgent settings.

2.2 Uses of Information Collected

(a) Company Use of Information

We use Contact Data to send you information about our company or our products or services, or promotional material from some of our partners, or to contact you when necessary. We use your Demographic Data to customize and tailor your experience on the Site, displaying content that we think you might be interested in and according to your preferences.

(b) Sharing of Personal Information

We share certain categories of information we collect from you in the ways described in this Privacy Policy. We share Demographic Data with advertisers and other third parties only on an aggregate (i.e., non-personally-identifiable) basis. We do not share Contact Data with other companies who may want to send you information about their products or services. We share Contact Data and Store Data with our staff and with the sub-processors described in §2.3. They assist us by performing core services related to our operation of the Site and the Services, such as fulfilment, hosting, data storage and security, and AI model processing. Those people have all agreed to uphold the same standards of security and confidentiality that we have promised to you in this Privacy Policy, and they will only use your Contact Data and other Personal Information to carry out their specific business obligations to Company. If you do not want us to share your Contact Data with any third parties, please contact us via the “Contact” link on the site menu. Please understand that such a request will likely limit your ability to take advantage of all of the features and services we offer on the Site.

(c) User Choice Regarding Collection, Use, and Distribution of Personal Information

You may choose not to provide us with any Personal Information. In such an event, you can still access and use much of the Site; however, you will not be able to access and use those portions of the Site that require your Personal Information, such as making a purchase. If you do not wish to receive information and promotional material from us or from some of our partners, you may select the appropriate “opt-out” option each time we ask you for Personal Information or simply refuse to provide it as appropriate when asked.

2.3 Sub-processors and AI Model Providers

To deliver the Services we rely on a small number of third-party providers who process data on our behalf. These providers are our sub-processors. They act only on our instructions, and written terms bind them to protect the data and to use it only to provide their service to us.

Our sub-processors fall into the following categories: AI model providers, who generate the content and chat responses the Services produce; cloud infrastructure and hosting providers, who run our application and store our data; transactional email providers; and payment processors, who handle billing information only.

AI model providers. Our AI features work by sending the relevant Store Data to a third-party AI model provider and returning the result to you. We engage those providers under commercial API terms which mean your data is not used to train their models, and under which they retain what they receive only briefly to detect abuse of their service.

We may add or change providers as the Services develop. If you use the Services to process personal information about your own customers, we will name our current sub-processors in writing on request, and give you at least ten (10) days’ notice before we add or replace one that processes that information, so you may object as set out in our Data Processing Addendum.

AI assistants you connect yourself. An AI assistant that you connect over MCP (§2.1(g)) is not our sub-processor. You select it, you hold the account with it, and it receives data under your own agreement with that provider. We have no contractual relationship with it and no control over what it does with the data.

3. Confidentiality and Security of Personal Information

Except as otherwise provided in this Privacy Policy, we will keep your Personal Information private and will not share it with third parties, unless such disclosure is necessary to: (a) comply with a court order or other legal process; (b) protect our rights or property; or (c) enforce our Terms of Use. Your Personal Information is stored on secure servers. We do not make it available to third parties except as described in this Privacy Policy. That includes making it available to the sub-processors described in §2.3, who act only on our instructions and are bound by written confidentiality and security obligations. We provide you with the capability to transmit your Personal Information via secured and encrypted channels if you use a similarly equipped web browser.

3.1 Public Information

The Site contains links to other websites. We are not responsible for the privacy practices or the content of such websites. We also may make commenting available to you on certain pages. Please understand that any information that is disclosed in these areas becomes public information. We have no control over its use and you should exercise caution when deciding to disclose your Personal Information.

3.2 International Transfers of Information

We are based in Australia, and our sub-processors — including our AI model providers — process data in the United States and other countries. This means that information covered by this Privacy Policy, including Store Data, may be transferred to, stored in and processed in a country other than the one you live in. That country may not provide the same level of data protection as your own.

Where we transfer personal information out of Australia, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles. Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, as applicable. Copies of the relevant clauses are available on request from support “at” storeagent.ai.

Where you connect an AI assistant yourself over MCP (§2.1(g)), any resulting transfer is a transfer made by you to your chosen provider, not by us.

3.3 How Long We Keep Information

We keep information only for as long as we need it for the purposes described in this Privacy Policy, or for as long as the law requires.

• Chat conversations are retained for 30 days from the last activity in the conversation, and are then permanently deleted. This period is fixed for all accounts and is not configurable. Because we hold no conversation older than 30 days, no feature of the Services — including any AI assistant you connect under §2.1(g) — can retrieve one.
• AI memory content — the indexed representation of your store content used for semantic search — is retained for as long as your account is connected and the relevant item remains included in AI memory. Removing an item from AI memory, or disconnecting your account, permanently deletes the corresponding data from our database. It is not recoverable.
• Temporary files created while processing a request, such as uploaded images, are stored in object storage and automatically deleted within 24 hours.
• Contact Data and account records are retained for the life of your account and for five years afterwards, to meet our tax, accounting and legal obligations under Australian law.
• Traffic Data and usage tracking data are retained in aggregate.

When your account is cancelled or becomes inactive, we will delete or de-identify Store Data within 90 days, and often sooner, unless you ask us to delete it earlier or the law requires us to keep it. You can request deletion at any time by contacting support “at” storeagent.ai.

Data that has already been sent to an AI assistant you connected yourself over MCP is outside our control. You must make any deletion request for that data to that provider.

4. Third Party Advertisements / Google Ads

This site also uses third party advertisements to generate revenue. Some of these advertisers may use technology such as cookies and web beacons when they advertise on this Site, which will also send these advertisers (such as Google through the Google AdSense program) information including your IP address, your ISP, the browser you used to visit our site, and in some cases, whether you have Flash installed. This is generally used for geotargeting purposes (showing New York real estate ads to someone in New York, for example) or showing certain ads based on specific sites visited (such as showing cooking ads to someone who frequents cooking sites).

You can choose to disable or selectively turn off our cookies or third-party cookies in your browser settings, or by managing preferences in programs such as Norton Internet Security, McAfee and Eset.com. However, this can affect how you are able to interact with our site as well as other websites. This could include the inability to login to services or programs, such as logging into forums or accounts.

4.1 Google Advertising Cookie and DoubleClick DART Cookie

Google, as a third party vendor, uses cookies to serve ads on this Site. Google’s use of the DART cookie enables it to serve ads to users of our site based on their visit to this Site and other sites on the Internet. Users may opt out of the use of the DART cookie by visiting the Google ad and content network privacy policy.

5. Personal Information of Children

We do not knowingly collect personal information from children under the age of 13. If we learn that we have personal information on a child under the age of 13, we will delete that information from our systems.

6. Contact Information and Policy Updates

6.1 Contacting Us

If you have any questions about this Policy, our practices related to this Site, or if you would like to have us remove your information from our database please contact us at the following:

support “at” StoreAgent.ai
Rymera Web Co
PO BOX 4362
Gumdale QLD 4154
Australia

6.2 Updates and Changes

We reserve the right, at any time, to add to, change, update, or modify this Policy, simply by posting such change, update, or modification on the Site and without any other notice to you. Any such change, update, or modification will be effective immediately upon posting on the Site. It is your responsibility to review this Policy from time to time to ensure that you continue to agree with all of its terms.