LimeSpot Privacy Policy

LimeSpot Solutions Inc. ("LimeSpot", "we", "us", or "our") is committed to protecting the privacy of shoppers ("Shoppers") while providing personalized shopping experiences. We process personal information from our store clients' ("Store Clients") Shoppers to provide product recommendations and market intelligence. However, our output is restricted to aggregated, non-identifying data. We will not sell, rent, lease, or share Shopper information except as permitted by this Privacy Policy. This Privacy Policy is subject to and incorporated into our Customer Terms of Service.

This Privacy Policy is published in English and in French; Section 15.14 of the Terms of Service governs its language.

What LimeSpot processes when a Store Client uses its AI and agentic services, and why, is described in AI and Agentic Services for Store Clients below.

This Privacy Policy also covers the LimeSpot browser extension. What it collects, where it is sent and how long we keep it are described in LimeSpot Browser Extension below.

This Privacy Policy is based on five key principles:

• Transparency: Store Clients must notify Shoppers that LimeSpot processes their data as described in this Privacy Policy.
• Consent: Store Clients must obtain informed Shopper consent for data processing by LimeSpot.
• Accountability: Store Clients must provide means for Shoppers to inquire about personal data and withdraw consent through LimeSpot or our Data Protection Officer.
• Security: LimeSpot maintains secure data storage and transfer methods.
• Breaches: LimeSpot notifies Store Clients of any security breaches or unauthorized processing.

Our Relationship to Our Clients and Their Shoppers

LimeSpot provides services to contracted Store Clients. We collect information at Shoppers' direction through Store Clients' platforms. LimeSpot relies on Store Clients to obtain informed consent and provide privacy policy access.

Shoppers may use third-party platforms (such as Facebook or Google) to access store sites. None of a Shopper's personal information is copied by or transferred to LimeSpot from any third-party platform in this circumstance.

LimeSpot cannot be held responsible if Store Clients fail to obtain proper consent or comply with data protection laws.

How We Collect Shopper Information

From Store Platforms: LimeSpot collects information through installed plugins or APIs as Shoppers interact with store sites, including product interests, order history, and browsing behavior.

Through Third-Party Platforms and CRM: Shoppers may authenticate using third-party services or store CRM systems. Information collected varies based on privacy settings with those platforms.

The Types of Information We May Collect

LimeSpot collects two categories of information:

Personally-Identifying Information ("PII"): Information uniquely associated with an identifiable Shopper, including age, gender, location, email, phone number, and sometimes IP address.

Non-Personally Identifying Information ("NPII"): Information not identifying specific Shoppers, such as store details, product collections, non-identifying order information, age ranges, geographical associations, shopping behavior, and aggregated or anonymized data derived from PII.

How We Use and Disclose Information

Except as the last sentence of this paragraph states, LimeSpot will not sell, rent, lease, share, or disclose information unless consent is provided, information is anonymized, or disclosure is legally required, except LimeSpot's own records of its relationship with Store Clients, which it discloses only as Store Clients and the People Who Act for Them describes. We do not sell or share personal information, except that the scheduling service embedded on our demo page may use identifiers it sets on your device under its own privacy notice, and except that, outside the EU/EEA, the UK, Québec and British Columbia, we use the advertising features of Google Analytics as the section on cookies describes.

By accepting this policy, Shoppers authorize LimeSpot to use their information as follows:

Performance of Services: Use PII and NPII to fulfill stated purposes, assess shopping patterns, and create Shopper profiles. We may combine Shopper data across stores (without sharing PII between stores) and use information to improve our products and services.

Third-Party Platform Services: Push non-identifying shopping preference information to platforms like Facebook or Google for customized advertising. LimeSpot does not receive PII from these platforms. We also use authentication services provided by third parties.

Third-Party Service Providers: Engage other companies for data storage and analysis tasks. These providers access only necessary information for their functions. They include the AI model providers named in our Data Processing Agreement, which generate recommendations, content and analysis for our services under terms that do not allow them to use the information to train their models.

Business Transfer: In mergers, acquisitions, or asset sales, Shopper information transfers as a business asset but remains subject to this policy unless Shoppers consent otherwise.

How We Use Cookies and Other Technologies

LimeSpot and Store Clients use "cookies," pixel tags, and web beacons to track Shopper behavior, measure advertisement effectiveness, and generate recommendations. Personal information collected through these technologies is treated as PII under this policy.

We use cookies to remember personal information across visits, combine information across different stores (without sharing PII between stores), and improve services. For example, knowing a Shopper's country and language enables customized experiences, while knowing product interests helps deliver relevant advertising and recommendations.

On our website, if you are in the EU/EEA, the UK, Québec or British Columbia, or we cannot tell where you are, we set analytics, advertising and attribution cookies only after you accept them in our cookie banner, and you may withdraw that acceptance at any time; elsewhere, analytics and the advertising features of Google Analytics are on by default, and advertising tracking, including those features, is off if your browser sends Global Privacy Control or you opt out through "Do Not Sell or Share My Personal Information" in the footer.

In the services that Store Clients and the people who act for them sign in to, we use the country and region that your connection indicates, which is derived from your IP address, to decide whether to ask for your choice before we run analytics, session recording and advertising tracking, and before our emails to you may record whether they are opened and which of their links are followed. We keep the most recent country and region of your connection with your email address for those decisions, replacing them on each visit, until 13 months after your last visit. If you are in the EU/EEA, the UK, Québec or British Columbia, or we cannot tell where you are, we run them only after you accept them, and you may withdraw that acceptance at any time. Elsewhere, analytics, session recording and advertising tracking run unless you turn them off in the privacy choices of your account, and advertising tracking is also off whenever your browser sends Global Privacy Control, everywhere. We remember your choice on your device for a limited period, shared with our website, and with your account, so that it also applies in our emails and on a device where you have not yet chosen; when the period on your device ends we ask again in the regions above unless your account holds a choice that still applies, and elsewhere analytics, session recording and advertising tracking may run again. In the regions above, our customer messaging service, which stores identifiers on your device, starts only when you ask for help or support, and it then receives your name, email address and the stores you manage. When you sign in we record against your store its identifier, its identifier on its e-commerce platform and the contact email address in a one-way hashed form, and, only if advertising tracking is on for you, the advertising click identifier and attribution details that brought you to us, so that we can report a paid subscription to the advertising provider that referred you. That report may include the click identifier or the hashed contact details, the order identifier and the subscription value. We keep this record for 14 months after the visit that created it.

Outside the EU/EEA, the UK, Québec and British Columbia, we use the advertising features of Google Analytics on our website and in the services that Store Clients and the people who act for them sign in to. Google then receives the analytics data from those visits, which consists of online identifiers, activity on our website and services, and approximate location, and uses it to measure and personalize LimeSpot's own advertising. Under some US state privacy laws this counts as selling or sharing personal information, or as targeted advertising. You can opt out at any time by turning Advertising off in the privacy choices of your account or, on our website, in the cookie settings or through "Do Not Sell or Share My Personal Information" in the footer, and we treat the Global Privacy Control signal your browser sends as that opt-out, everywhere. In the EU/EEA, the UK, Québec and British Columbia, these advertising features run only after you accept advertising.

When you request a demo, the scheduling service that books it receives the details you enter, your IP address and information about your device. That service, and the security and analytics providers it uses, store and read identifiers on your device through cookies and local storage. That service is in the United States and also uses this information for its own purposes, such as improving its products, under its own privacy notice. In the EU/EEA, the UK, Québec and British Columbia, or where we cannot tell where you are, identifiers that are not strictly necessary for security are set only with your consent. We use the details you enter to arrange the demo and to manage our relationship with you, in our legitimate interest in responding to your request. We keep them as business records for as long as they serve those purposes, and delete or de-identify them when you ask.

Our emails may record whether they are opened and which of their links are followed, as Store Clients and the People Who Act for Them describes, including for people who ask us through our website to email them. You can withdraw your agreement, or tell us that you do not want this recorded, by writing to [email protected] or through the email tracking preferences link when one of our emails includes it.

We keep a record of the choices you make about email measurement, and of the cookie choices you make in the services you sign in to, so that we can apply them and demonstrate them. The record holds each choice, when it was given and through which service, form or email, the version of the wording shown to you, the location we used to decide whether to ask for your consent and how we determined it, and, for a choice made while signed in, your account. The record also holds the date on which we asked for your choice, which we keep for five years after that date, or until we erase your information if that is sooner. We keep a consent while it applies; a consent that has ended, and any choice that a later one replaced, for five years after it ended or was replaced; and a refusal or withdrawal that has not been replaced for as long as it is needed to keep applying it. When we erase your information, we keep only a keyed one-way hash of your email address with any refusal or withdrawal, when, through which service, form or email and under which version of the wording it was given, and how we determined the location then used, so that a "no" keeps applying. Our legal bases are our legal obligation to be able to demonstrate consent and to respect its refusal or withdrawal or, where the law that protects the information does not recognize that obligation, our legitimate interest in meeting it, and, for what we keep after erasure, our legitimate interest in making sure your "no" keeps applying.

How We Keep Your Information Secure

LimeSpot implements reasonable security measures both online and offline. Only employees with confidentiality obligations access Shopper PII.

Internet transmissions use SSL encryption. Shopper information is pseudonymized and rendered as NPII. We maintain redundant systems and conduct routine security assessments.

However, no method of transmission over the Internet, or method of electronic storage, is 100% secure.

LimeSpot notifies Store Clients of unauthorized access or disclosure. Store Clients must inform affected Shoppers as required by law.

Contact: [email protected]

Storage and Transfer of Your Information

Shopper information may be transferred to, stored, and processed in the United States, Europe, or Canada. LimeSpot uses Microsoft's Azure platform data centers. Canada provides adequate data protection recognition. Transfers from the EU and UK to providers in the United States rest on the provider's Data Privacy Framework certification or on Standard Contractual Clauses with the UK Addendum; copies are available from [email protected]. Information stored outside Canada may be accessible to the authorities of the country where it is stored under that country's laws. Information about people in Québec may be communicated outside Québec, including to other provinces of Canada and to the United States.

Storage Duration for PII:

LimeSpot removes Shopper PII upon:

• Shopper request via the Shopper Rights Access Portal
• Store Client request or Shopper consent withdrawal notice
• Shopper objection to PII processing received in writing
• Discovery of unlawful PII collection
• Request from supervisory or legal authorities with proper authorization

Storage for NPII not identifying Shoppers is indefinite.

Shoppers' Rights

Transparency: Full disclosure of information processing and purposes through this policy.

Accountability and DPO: Shoppers may contact our Data Protection Officer ([email protected]) regarding information collected by LimeSpot through Store Clients. LimeSpot may forward concerns to relevant Store Clients. Shoppers may lodge complaints with applicable supervisory authorities. For Shopper information LimeSpot acts as a processor for Store Clients, who are responsible for any European or UK representative the law requires of them.

Access, Rectification, and Deletion: Shoppers may request PII erasure through Store Clients or directly via [email protected]. Rectification requests should also be directed to [email protected].

Breaches: LimeSpot notifies Store Clients of breaches involving PII, providing details on breach nature, the DPO contact, possible consequences, and mitigation measures taken.

AI and Agentic Services for Store Clients

This section applies when a Store Client uses LimeSpot's AI and agentic services, which use AI models to analyze the Client's store, answer the questions of people acting for the Client, and recommend and prepare changes to the store and to the accounts the Client connects. Some run on a schedule the Client can change, and others when a person acting for the Client asks. They do not change a connected account on their own. Most changes they prepare take effect only after a person acting for the Client approves or carries out the proposed change. LimeSpot may automatically apply product-recommendation choices to products for which the Client has not set its own choices; the Client can replace or remove those choices.

What We Process and How We Use It

Store information. The store's settings, pages, catalog, orders and customer records, and how the store and its LimeSpot features perform. We use it to analyze the store and its results, to recommend and prepare changes and content, and to measure the effect of changes the Client makes.

Connected accounts. Data from the search, shopping, analytics, tag management and advertising accounts the Client connects, read only with the access the Client grants. We use it to analyze how people find the store and how its advertising performs.

Instructions and conversations. The instructions, questions and conversations of people acting for the Client, the decisions they make on proposed changes, and the email addresses they choose for notices. We use them to answer, to prepare what they ask for, and to send those notices.

Public information. The store's public pages and other publicly available information about it, such as how search engines and AI assistants present it. We use it to assess how people find and see the store.

Where this information includes Personal Data, as the Data Processing Agreement defines it, such as information about the Client's Shoppers or staff, LimeSpot processes it as the Client's processor, on the Client's instructions and under that agreement.

Legal Basis

LimeSpot provides these services to perform its agreement with the Store Client. For Personal Data in them, the Client decides the purposes of the processing and is responsible for its legal basis and for informing the people concerned, and LimeSpot acts as the Client's processor under the Data Processing Agreement.

Who Receives It

The AI model providers listed in the Data Processing Agreement receive only the content needed for these purposes and may not use it to train their models. LimeSpot's hosting, storage and email delivery providers, also listed there, process it on our behalf, and notices are emailed only to the addresses the Client chooses. To measure and look up the store's public presence, LimeSpot sends public measurement and reference services only the store's public web addresses and name. Transfers between countries rest on the safeguards the Data Processing Agreement describes.

How Long We Keep It

LimeSpot keeps Personal Data in these services only as long as it needs it to provide them, or as the law requires, and deletes or returns it within the period the Data Processing Agreement sets after the Client's agreement with LimeSpot ends. AI model providers keep the content they receive no longer than the periods listed in that agreement.

Choices and Rights

• The Client can switch off the start of new scheduled work for any of these services. Product-recommendation work already sent to an AI model provider before the Client switches the service off may still be completed and automatically applied afterward; the Client can replace or remove those choices. The Client can withdraw LimeSpot's access to a connected account at any time; LimeSpot then stops reading that account.
• Email notices go only to addresses a person acting for the Client chooses, and can be turned off.
• People whose information these services process may ask to see, correct, delete or restrict it, to receive it in a portable form, or to object to its use, through the Store Client or by writing to [email protected]. LimeSpot helps the Client answer, as the Data Processing Agreement describes.

LimeSpot Browser Extension

This section applies to people who use the LimeSpot browser extension (the "Extension", its "Users") and to people who receive a report from it by email ("Recipients"). The Extension may audit an online store a User names and write a report on where it could personalize (an "Audit" and its "Audit Report"), offer a chat about that report, and email the report to people the User chooses; it may offer other functionality over time. It asks the browser for access to all websites so that it can run on whichever store the User names, but it collects nothing from a page and sends nothing off the browser until the User activates an Audit or opens Studio there, and then only from that store. It uses no third-party analytics or tracking. The website parts of this policy apply to the LimeSpot pages it opens.

LimeSpot's use and transfer of information received through the Extension adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. We use that information only to provide and improve the Audit and the Extension's own features, we do not sell it or use it for advertising, and no person at LimeSpot reads it except with the User's permission, to keep the service secure, or to comply with law. What a person gives us on the LimeSpot pages the Extension opens, including their activation details, is collected by our website, and we use it as described under Activation details below and in the website parts of this policy.

What We Collect and How We Use It

Activation details. To activate an Audit, a User gives us their name, email address and store details, agrees to our Terms of Service and this Privacy Policy, and may opt in to LimeSpot marketing email. We record those choices with the wording shown and when they were made, how the User reached us, their browser, and when their activation and Audit runs happen. We use these to verify the User's email address, to activate the Audit for their store only, to limit runs per store, and to let our team follow up. A User who opts in to marketing email may be added to our customer messaging service, Intercom.

Store pages. When a User runs an Audit, the Extension loads pages of the activated store through LimeSpot's proxies and captures screenshots of them with their addresses, text, structure and selected page markup. A storefront password a User types into a proxied page passes through the proxy to the store. The captures go to LimeSpot's AI service, which uses the AI model providers named in our Data Processing Agreement to write the Audit Report. Those providers may not train their models on this content and keep it no longer than the period listed there. To prepare the Audit Report, LimeSpot's servers check the activated store's public pages and name with public web services and with the AI model providers named in our Data Processing Agreement.

Chat. Questions a User asks about the Audit Report go, with the conversation and the Audit Report, to LimeSpot's AI service and its AI model providers to answer. The service does not store the questions; it keeps each answer briefly so that a repeated request gets the same answer.

Emailing the Audit Report. A User may ask us to email the Audit Report to themselves and to Recipients they choose, with an optional personal note. Before a copy goes to anyone else, the User gives their full name and confirms a personal or business relationship with each Recipient. We send from our own domain through SendGrid. A Recipient's copy names the User, by full name and email address, as the person who shared it, says it was sent as a result of their referral, carries no LimeSpot offer, and adds the Recipient to no mailing list; each Recipient receives at most one Audit Report email per store, and none if they have unsubscribed. We keep a record of each send and each referral, not the Audit Report or the note.

Unsubscribing. Every copy carries an unsubscribe link, which does not expire, and a one-click unsubscribe that mail apps can offer. A person may stop Audit Reports that others share with them or stop all LimeSpot marketing email; either withdraws any marketing consent and puts the address, as a keyed one-way hash, on our unsubscribe list, which every email sent from limespot.com is checked against. Account and service emails, and anything a person asks for themselves, are not marketing and are sent regardless. Messages from our customer messaging service carry their own unsubscribe link.

Legal Basis

Where the law asks us to name a legal basis, these are ours. We process a User's activation details, store pages, Audit Report, chat and own copy of the Audit Report to deliver the Audit they asked for (contract). We read the store's pages, including any names or reviews shown on them, and email Recipients on the User's referral, in the User's legitimate interest in reviewing and sharing a report on their own store and LimeSpot's in offering Audits; we have weighed those interests against the effect on the people concerned, and anyone may object at any time. Marketing email rests on consent, which may be withdrawn at any time. We keep referral, unsubscribe and consent records to meet anti-spam and privacy law, and we protect the service with Cloudflare Turnstile and rate limits keyed to one-way hashes of email and network addresses, in our legitimate interest in preventing abuse; we do not store raw IP addresses.

Where We Store Extension Information

limespot.com and LimeSpot's AI service run on Cloudflare, and the Extension information they keep is stored with Cloudflare in the United States. Email is sent through SendGrid, and AI analysis is performed by the AI model providers named in our Data Processing Agreement. Transfers from the EU and UK to these providers rest on the provider's Data Privacy Framework certification, including its UK Extension for UK data, or on Standard Contractual Clauses with the UK Addendum, available from [email protected]. Information stored in the United States may be accessible to United States authorities under United States law.

What the Extension Keeps in the Browser

The Extension keeps each store's Audit Report, chat and Audit session in the browser's extension storage until the session ends. If the User's store subscribes to LimeSpot, it also keeps a Studio sign-in for that store, validated and revoked with LimeSpot's servers; it never receives the User's LimeSpot password. A User can delete everything it keeps from within the Extension or by removing it, which also revokes any Studio sign-in.

How Long We Keep Extension Information

• Audit sessions, the captures uploaded for a run, and the Audit Reports, chats and sessions the Extension keeps in the browser: up to 30 days, sooner when the session ends.
• A Studio sign-in kept in the browser: until it expires or is revoked, or the User signs out, disconnects it, or removes the Extension.
• Chat answers and the per-store records LimeSpot's AI service keeps: 30 days after the latest answer or session. Content sent to our AI model providers: the period listed in our Data Processing Agreement.
• Activation details, including the record of agreement to our Terms of Service and this Privacy Policy: up to 180 days after the request was last updated.
• Send records, which hold the addresses an Audit Report went to: 90 days.
• Referral records (the User's name, their confirmation and keyed hashes of the Recipients' addresses) and keyed Recipient hashes: three years.
• Subscribe and unsubscribe choices with the wording shown: three years, or while an activation request still holds the address, whichever is later.
• Unsubscribe list (keyed hashes): until the address subscribes again.

Your Choices

• Emailing the Audit Report and the chat are optional; an Audit produces its Audit Report without them.
• Anyone can unsubscribe with the link in any Audit Report email, and anyone can object, free of charge, to LimeSpot using their information for direct marketing by writing to [email protected]; we then stop and keep only what we need to honor that objection.
• Users and Recipients may ask us to see, correct, restrict or delete the information we hold about their email address, to receive what they gave us in a portable form, and to object to any use we base on our legitimate interests, at [email protected]. After a deletion we keep only the keyed unsubscribe entry, so we do not email that address again, and referral records for the rest of their retention period.
• Complaints may go to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or, in the EU and UK, the local data protection authority.

Store Clients and the People Who Act for Them

LimeSpot is responsible, as controller, for its own records of its relationship with each Store Client and the people who act for it: their names and business contact details, which we receive from the people themselves, from the Store Client or from the store's e-Commerce Platform, or from providers of business contact information; the store's identifiers, billing address and other details of the store, such as how it found us; plan, trial, invoice and payment records and the terms the Store Client accepted; records of which features they use and when, including recordings of their sessions linked to their account; measures of the store's size and results, and the feedback they give us; and support requests, conversations and notes, including a conversation in our services that they pass to our support team, and the other messages we exchange with them. The Data Processing Agreement does not govern these records, but it does govern the other instructions, questions, conversations and decisions of people acting for the Store Client in our services.

We use these records to provide, bill for and support our services, to send messages about them and the account, to manage our relationship with the Store Client, including after its store removes LimeSpot, to ask for feedback, to tell them about our services, including after the store leaves, to understand and improve how our services are used, to meet the tax, accounting and other laws that apply to LimeSpot, to establish, exercise or defend legal claims, and to recognize a returning store and the trial terms it has already used. Our legal bases are our agreement with the Store Client, where the person is a party to it, and otherwise our legitimate interest in performing it; compliance with the law or, where the law that protects the information does not recognize the law concerned, our legitimate interest in complying with it; our legitimate interests in supporting our customers, managing our relationship with them, telling them about our services, understanding and improving our services, protecting our rights and preventing repeated free trials; and, where the law requires consent for analytics that store or read information on their device or for marketing messages, their consent, which they may withdraw at any time. We need names, business contact details and billing details to provide our services; feedback is optional.

When we email the people who act for a Store Client, the addresses a Store Client chooses for notices, or people who ask us through our website to email them, we and our email delivery provider may record whether and when each message we send through that provider is opened and which of its links are followed, with the network address, the device and the email program or browser used. We may use this record to give people a better experience with our messages: to check that they arrive, work and are read, to improve them, to report on how they perform, to decide whether to send a person a follow-up message and which of our messages to send them and when, and to group our contacts by how they respond to our messages, and we keep it no longer than 30 days. Our customer messaging service and our customer relationship management service may record whether and when the messages we send through them are opened and which of their links are followed; we may use those records for the same purposes and keep them for as long as we keep that person's contact record with that service, and no longer than two years in our customer messaging service. We also use the location that our customer messaging and customer relationship management records hold for each of their contacts only to decide whether we must ask before our messages to that contact record whether they are opened and which of their links are followed, and we note the result in those records. Where any of our records places a recipient in the EU/EEA, the UK, Québec or British Columbia, or none shows where the recipient is, none of these records is made unless the person has first agreed to it. Anyone may withdraw that agreement, or tell us that they do not want it recorded, at any time by writing to our Data Protection Officer, and we then stop. Our legal bases are the person's consent, given in the way the law of their location requires, and, where that law requires no consent, our legitimate interest in delivering, improving and tailoring our messages and reporting on them.

Our hosting, storage and email delivery providers, our billing, payment, customer support and messaging, customer relationship management and analytics providers, the providers of the communication tools our staff use, and the AI model providers named in the Data Processing Agreement process these records for us. Transfers of this information from the EU and UK to providers in the United States rest on the provider's Data Privacy Framework certification, including its UK Extension for UK information, on Standard Contractual Clauses with the UK Addendum, or on the provider's approved binding corporate rules; copies or details are available from our Data Protection Officer. These providers store and process this information outside Canada, including in the United States, where it may be accessible to the courts, law enforcement and national security authorities of those countries under their laws.

When we learn that a Store Client's store has removed LimeSpot from its e-Commerce Platform, or when the Store Client asks us, we delete the information we hold about the store and its Shoppers within the period the terms of that e-Commerce Platform set for information about the store, or within 90 days after the store removes LimeSpot where those terms set none: the store's settings, campaigns and other configuration, its catalog and orders, the records of the people who act for it, the information about its Shoppers, and the records of how its Shoppers used the store. If an agreement between LimeSpot and a Store Client ends while the store keeps LimeSpot installed, that does not start this deletion; the Store Client may ask for it at any time by writing to our Data Protection Officer. We keep billing, invoice and tax records, the record of which terms the store accepted and when, and the dates and identifiers of the store's installations of LimeSpot, for as long as the tax and accounting laws that apply to LimeSpot require and, for the installation dates and identifiers, for as long as we need them to recognize a returning store, bill it and apply the trial terms it has already used. We keep the record of the email measurement and cookie choices of the people who act for it for the periods set out in the section on cookies. We keep our support conversations and our sales and marketing contact records with a Store Client and the people who act for it, and the feedback they give us when its store removes LimeSpot, as business records of our relationship with it, including when we move them to another system. We keep them for as long as they serve these purposes: to provide and improve support and our services and to keep a record of the commitments we made; they are not part of the deletion above. Any person may ask us to delete, or to de-identify, their own messages in a support conversation, their feedback or their contact record, and may stop marketing messages at any time, by writing to our Data Protection Officer, and we then do so unless a law requires us to keep it. Caches and other temporary copies of the store's information expire automatically on their own short cycles. Operational logs and the queues that hold messages we could not process are kept only for operating and securing our services and are not used to look up a store's information. Logs expire automatically after a limited period, and our team reviews and clears those queues as part of its regular maintenance. Backups of our systems are held beyond use: nothing reads them but a restore, we keep them only for disaster recovery, and each expires automatically on a short fixed schedule. If we restore a backup, our regular deletion again removes the information of stores that have removed LimeSpot once the period stated here has passed for them. Information about a Store Client's Shoppers or customers that a support request contains is processed for that Store Client under the Data Processing Agreement and deleted within the period that agreement sets.

The people concerned may ask to see, correct, delete or restrict this information, or receive a portable copy of it, by writing to our Data Protection Officer, and may complain to us at that address or to a supervisory authority: the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, the Commission d'accès à l'information du Québec, or, in the EU and UK, their data protection supervisory authority.

They may object at any time, on grounds relating to their situation, to our use of this information for our legitimate interests, and we then stop unless we have compelling legitimate grounds that override their interests or need it for legal claims. They may also object at any time, free of charge, to our use of their information to tell them about our services, and we then stop.

Changes to this Privacy Policy

LimeSpot may update this policy by posting a revised version on this page. Each version shows its posting date at the top, and posting is our notice of the change. A material change takes effect 30 days after posting, or when a Store Client or User first uses a service the change concerns, if sooner. We do not use information we already hold for a new purpose that needs consent without first asking for it. Store Clients, Users and Shoppers should review this page periodically. The current policy applies to all PII about Shoppers using LimeSpot-enabled platforms unless otherwise stated.

Questions and Concerns

This policy is subject to British Columbia provincial law and applicable Canadian federal law.

LimeSpot Solutions Inc., 302-8 Bastion Square, Victoria, British Columbia V8W 1H9, Canada.

A LimeSpot Director is the person in charge of the protection of personal information. Write to [email protected].

For privacy concerns: [email protected]

For policy questions: [email protected]

Related Documents: Terms of Service | Acceptable Use Policy