PRIVACY POLICY

Effective Date: 21 June 2025

Last Updated: 21 June 2025

1. INTRODUCTION

This Privacy Policy explains how Basebright Inc. ("Company," "we," "us," or "our"), operating the HeckYes personalization service at HeckYes.ai ("Service"), processes personal data when providing our e-commerce personalization plugin to online stores ("Merchants").

We act as a data processor for personal data collected through Merchant websites. Merchants are the data controllers responsible for obtaining necessary consents and complying with applicable privacy laws.

2. DATA WE PROCESS

2.1 End User Data (Store Visitors)

When visitors interact with Merchant stores using our Service, we process:

Product Interaction Data:

  • Product views, purchases, and cart additions
  • Product details (ID, price, categories, descriptions, brand, ratings)
  • Timestamp of interactions
  • Session information

User Profile Data:

  • Unique user identifier (pseudonymous)
  • Email (when provided for identification)
  • Optional metadata: membership status, preferences, purchase frequency
  • Device type and browser information

Technical Data:

  • IP address (for geolocation)
  • Cookie identifiers
  • Session IDs
  • Event tracking data

2.2 Merchant Data

  • Account registration information
  • Contact details for service delivery
  • Usage statistics and performance metrics

3. HOW WE USE DATA

We process data exclusively to provide our Service:

  • Generate personalized product recommendations using AWS Personalize
  • Train machine learning models specific to each Merchant store
  • Measure recommendation performance through A/B testing
  • Provide analytics and reporting to Merchants
  • Improve Service quality and accuracy

We do not:

  • Sell personal data
  • Use data for advertising networks
  • Share identifiable data between different Merchants
  • Make automated decisions beyond product recommendations

However, we may use statistical, aggregated, or otherwise anonymized data collected across all Merchants to improve our Service, provided such data cannot be directly or indirectly linked to any specific Merchant or individual user. This helps improve recommendation quality for all customers.

4. LEGAL BASIS FOR PROCESSING

As a data processor, we process data based on our contractual obligations to Merchants. Merchants must establish their own lawful basis for collection under applicable US privacy laws.

Important: Merchants are responsible for obtaining all necessary consents. Our Service must not be used to process data from users who have not consented to data collection where consent is required.

5. DATA SHARING

We share data only as necessary to provide our Service:

Service Providers:

  • Amazon Web Services (AWS) - Infrastructure and AWS Personalize
  • Supabase - Database services
  • Sentry - Error monitoring (anonymized)

Other Disclosures:

  • To Merchants (only their own store data)
  • As required by law or legal process
  • To protect rights, property, or safety

We do not sell, rent, or trade personal data.

6. DATA RETENTION

  • Active Merchants: Data retained during service period
  • After Termination: Deleted within 30 days
  • Aggregated Analytics: May be retained longer in anonymized form

7. USER RIGHTS

End users have the following rights regarding their personal data:

  • Access: Request copy of personal data
  • Deletion: Request removal of personal data
  • Correction: Request updates to inaccurate data
  • Portability: Receive data in structured format
  • Objection: Object to certain processing

To Exercise Rights: Contact us at team@heckyes.ai with:

  • Your email address
  • The Merchant website involved
  • Your specific request

We will respond within 30 days and coordinate with the relevant Merchant.

8. DO NOT TRACK

We respect browser Do Not Track (DNT) signals. When DNT is enabled:

  • No tracking pixel activation
  • No data collection
  • Default (non-personalized) recommendations shown

9. INTERNATIONAL TRANSFERS

This Service is currently available only to US-based merchants serving US customers. Data is processed and stored exclusively in the United States.

10. SECURITY

We implement appropriate technical and organizational measures:

  • HTTPS encryption for data in transit
  • Encrypted database storage
  • Access controls and authentication
  • Regular security assessments
  • Incident response procedures

11. CHILDREN'S PRIVACY

Our Service is not directed to individuals under 18. We do not knowingly collect personal data from children under 13. If we become aware of such collection, we will promptly delete the data.

Merchants must ensure their use of our Service complies with applicable age restrictions. If you believe we have inadvertently collected data from a child under 13, please contact us immediately at team@heckyes.ai.

12. COOKIES AND TRACKING

We use essential cookies and tracking pixels to:

  • Maintain user sessions
  • Track product interactions
  • Provide personalized recommendations

These are first-party functional cookies necessary for Service operation. Merchants are responsible for cookie consent notices.

13. CALIFORNIA PRIVACY RIGHTS

If you are a California resident using a Merchant's store, you may have rights under the California Consumer Privacy Act (CCPA). We believe we are currently exempt from CCPA due to our size, but we voluntarily provide:

  • We do not sell personal information
  • You may request deletion via team@heckyes.ai
  • Do Not Track signals are respected

For specific rights enforcement, contact the Merchant directly as they are the data controller.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. Material changes will be communicated to Merchants via email with 30 days notice. Continued use after changes constitutes acceptance.

15. CONTACT INFORMATION

For privacy-related questions or requests:

Basebright Inc.

2810 N Church St, Wilmington, Delaware 19802-4447 US

Email: team@heckyes.ai

Website: https://heckyes.ai

---

For Merchants: This Privacy Policy should be referenced in your own privacy policy. You remain responsible for comprehensive privacy disclosures to your users.