Privacy Policy

This Privacy Policy explains what information we collect from our users ("merchants"), why we need it, who we share it with and how we protect it. It applies to the Exhibe web application, to the mobile applications for iOS and Android, and to the public storefronts published with the platform. By using Exhibe, you accept the practices described here.

The data controller is Ozer Tech Solutions LLC (Wyoming, USA) and its local subsidiary being incorporated in the Republic of Honduras.

2.1. Your data as a merchant: with respect to your account, your business and your use of the platform, Exhibe acts as the controller.

2.2. Your customers’ data: with respect to information about buyers that you upload or receive through Exhibe (name, phone, email, delivery address, order history), you are the controller and Exhibe acts solely as processor: we process it following your instructions, in order to provide you the service, and we do not use it for our own purposes or commercialize it. You are responsible for informing your customers and for having a legal basis to process their data.

Privacy contact: legal@ozertechsolutions.com.

3.1. Profile and account: name, profile photo (optional) and email address. Your password is stored encrypted and hashed; nobody at Exhibe can read it.

3.2. Sign in with Google: if you choose that method, we receive your name, email and profile photo.

3.3. Sign in with Apple: if you choose that method, we receive your name and your email. If you turn on the option to hide your email, Apple gives us a private relay address (privaterelay.appleid.com) and we never see your real email.

3.4. Payment information: subscriptions and credit packs are processed with Apple when you buy inside the iOS application, and with Stripe when you buy from the web. Exhibe does NOT store or have access to your card details in either case; that information is handled by Apple and Stripe. We only keep purchase identifiers, the plan and its status.

3.5. Your business content: business name, logo, description, category, hours, contact details, products, photos, prices, stock, variants, coupons and your storefront configuration.

3.6. Your customers’ data: buyers’ name, phone, email and delivery address, along with their orders, quotes and layaways. If your storefront charges upfront or with a deposit, we also store the payment proof the buyer uploads: it is an image, it stays attached to that order and it is deleted along with it. Handled as described in section 2.2.

3.7. Operational records: orders, sales, inventory movements, point-of-sale shifts and cash counts, subscription events and AI credit usage.

3.8. Location (only if you turn it on): if you use live delivery tracking, the mobile application accesses the device location only while the app is in use and only during the delivery. That location is shared with whoever holds the tracking link for that order, for the sole purpose of letting the buyer follow their delivery, and tracking closes automatically when the order is marked as delivered or cancelled. We do not collect background location and we do not build movement histories.

3.9. Camera: used, with your permission, to take product photos and to scan barcodes. Barcode images are processed on the device; photos you choose to save are stored as your business content.

3.10. Push notifications: if you turn them on, we store a device identifier (token) so we can notify you about orders and events in your business.

3.11. Biometrics: if you turn on fingerprint or face unlock, verification happens entirely on your device, through the operating system. Exhibe never receives, transmits or stores biometric data.

3.12. Interactions with artificial intelligence features: the messages you send to the assistants, the photos you upload to the product assistant, the searches in your catalog, and the catalog data needed to answer you. See section 4.

3.13. Technical data: IP address, device type, operating system, browser and usage logs, including security logs, rate limits to prevent abuse and error reports from the web application.

3.14. Cookies and browser storage: on the web we use first-party cookies and the browser’s local storage to keep you signed in, remember your language and measure how the site is used. The details are in section 11.

3.15. WhatsApp (only if you connect it): your WhatsApp Business account data and the conversations with your customers that reach your number. See section 5.

3.16. Instagram (only if you connect it): your professional Instagram account data and the direct messages your customers send it. See section 5.

3.17. Voice (only if you use it): if you talk to Vitra from the web or from the mobile application, we use the microphone, with your permission, while the voice conversation is open. The audio is sent to our artificial intelligence providers to be transcribed (see section 4), and the resulting text is treated as a written message (3.12). Vitra’s spoken replies are generated from its text. We do not store the recordings on our servers; in the mobile application, the audio stays briefly in the device’s temporary storage and is deleted when done.

3.18. Usage analytics (web only): on the website, the web application and public storefronts we use PostHog to measure how the service is used: pages visited, actions such as viewing a lesson, and technical data about the browser. If you are signed in, that data is associated with your account and your plan. We do not record any session, anywhere in the service: not on public storefronts, not in the management panel, not in the admin portal. Until 29 September 2026 we did record the session of whoever visited a public storefront; it was turned off and that data is no longer collected. The mobile applications do not use analytics or tracking.

3.19. Product emails: we use your email address to send you product news, important changes and usage tips. You can unsubscribe from those emails with the link at the bottom of each one, without losing your account emails — confirmations, recovery codes and service notices — which are required to use the platform and cannot be turned off.

Exhibe includes AI-assisted features: the merchant assistant (also by voice), the shopping assistant on your storefront (which, if you turn it on, also replies on your WhatsApp and your Instagram and listens to the voice notes customers send you on WhatsApp), creating products from a photo, marketing content and image generation, and smart catalog search.

4.1. What is sent: to produce an answer, we send our AI providers only what is necessary: the text of the query or search, the corresponding photo or audio, and the catalog or business data that gives the answer context.

4.2. How it is used: providers receive that information to generate the requested answer, under their terms as providers. Exhibe does not use your content to train its own models.

4.3. Limits: AI-generated output may contain errors or omissions. It is a help, not professional advice: always review the content before publishing it or using it with your customers.

4.4. Which provider receives what: we use models from Anthropic (Claude), OpenAI and xAI (Grok) through Vercel AI Gateway, which routes each request to them. Anthropic powers the merchant assistant, the storefront chat, Vitra on WhatsApp and Instagram, creating products from a photo and marketing content. xAI transcribes voice (yours and WhatsApp voice notes) and generates Vitra’s voice. OpenAI transcribes voice when xAI does not respond, creates marketing images and turns the text of your products and of searches into vectors for smart search. Google Cloud Vision analyzes images for the product features and the storefront chat, and Google Programmable Search looks up public information on the web when the shopping assistant needs it.

4.5. Your permission: before the first feature that sends data to these providers, we ask for your permission in the application or in the panel, and we record when you gave it, from where and which version of this notice you accepted. If you say no, those features are not used and the rest of Exhibe stays the same. You can revoke it at any time from Settings → AI use; whatever you already have turned on, such as Vitra on WhatsApp or Instagram or automatic content, keeps working until you turn it off.

Connecting your WhatsApp Business to Exhibe is optional and is done from Settings → Integrations in the web application, through Meta’s official WhatsApp Business platform. Your WhatsApp Business account remains yours: Exhibe only receives the access needed for the features you use. This section describes what data we receive through that connection, what we use it for and when we erase it.

5.1. Your account data: when you connect, Meta gives us the identifiers of your WhatsApp Business account and of your number, the display number, and an access token that lets us send messages on your behalf. The token is stored separately, with no access from the applications, and is only used by our servers.

5.2. Conversations: while the connection is active, we receive the messages your customers write to your number and the ones you send from your WhatsApp Business app, along with each customer’s phone number and WhatsApp profile name. We store them so that Vitra knows what the conversation was about and so we know when you took over the conversation. For your customers’ voice notes, if Vitra is turned on for your WhatsApp, we download the audio, send it to our artificial intelligence provider to be transcribed (see section 4) and we only store the transcription along with the message: the audio is not stored and the transcription is erased along with the message (5.6). For photos and other files we only record that they were sent, not the file itself.

5.3. Order notices: when you send an order notice by WhatsApp (order confirmed, payment confirmed, ready for pickup, on its way, delivered), a template approved by Meta is sent to the phone number on that order. We record which notice went out for each order —without the text or the phone number— so it is not sent twice; that record is erased along with the order.

5.4. Vitra on WhatsApp: if you turn on Vitra replies on your WhatsApp, for each reply we send our artificial intelligence provider (see section 4) the latest messages of that conversation and the catalog data needed. Vitra replies on behalf of your business and only about your business. It introduces itself as a virtual assistant and, if the customer asks to talk to a person, it stops replying in that conversation and flags it in your Conversations inbox.

5.5. Link to your storefront: when Vitra sends a customer the link to your storefront, the link includes a code to continue the conversation in the storefront chat. Anyone with that link can see the latest messages of that conversation —without the phone number— for 24 hours; after that the code expires and stops working.

5.6. How long we keep them: WhatsApp messages are automatically erased after 90 days. The full conversation remains in your WhatsApp, which is where it lives: ours is a working copy.

5.7. If you disconnect WhatsApp: we immediately erase the token and all stored conversations, and we cancel our subscription at Meta so we stop receiving your messages. We only keep the record that your account was connected (the business’s identifiers and number) for as long as your Exhibe account exists.

5.8. Who is responsible for this data: your customers’ data that arrives through WhatsApp is governed by section 2.2: you are the controller and Exhibe acts as processor. Meta processes the messages as the provider of the WhatsApp Business platform, under its own terms and privacy policy.

5.9. Instagram: connecting your professional Instagram account is optional too and is done from Settings → Integrations, with Instagram’s official login. When you connect, Instagram gives us your account identifier, your username, the account type and an access token that expires after 60 days and that we renew automatically. The token is stored separately, with no access from the applications, and is only used by our servers.

5.10. Instagram direct messages: while the connection is active, we receive the direct messages your customers send your account —including those from people who do not follow you— and the ones you send from Instagram, along with each customer’s identifier, username and profile name. We use them for the same purposes as on WhatsApp (5.2). For the photos, videos, audio, stories and posts they send you we only record the type and its identifier, never the file or its link. If a customer deletes a message, we delete it from our copy too.

5.11. Vitra on Instagram: if you turn on Vitra replies on your Instagram, the same applies as on WhatsApp (5.4).

5.12. How long we keep them and when they are erased: Instagram messages are automatically erased after 90 days. If you disconnect Instagram, or remove Exhibe’s access or ask us to delete your data from your Instagram settings, we immediately erase the token and all stored conversations, and we stop receiving your messages. We only keep the record that your account was connected (identifier and username) for as long as your Exhibe account exists.

5.13. Who is responsible for this data: as on WhatsApp (5.8): for your customers’ data that arrives through Instagram you are the controller and Exhibe acts as processor. Meta processes it as the provider of Instagram, under its own terms and privacy policy.

Exhibe does NOT sell your personal data. We share information only with the providers needed to operate the service, who act as processors and are required to protect the data:

a) Infrastructure and database: Supabase (database, authentication and functions) and Vercel (hosting for the web applications).

b) Images: Cloudinary (storage and optimization of product photos, logos and payment receipts).

c) Payments: Apple (purchases made inside the iOS application) and Stripe (subscriptions, credit purchases and the billing portal on the web).

d) Transactional email: SendGrid (Twilio), for account confirmations, recovery codes and service notices.

e) Artificial intelligence: models from Anthropic (Claude), OpenAI and xAI (Grok), through Vercel AI Gateway; Google Cloud Vision to analyze images; and Google Programmable Search when the assistant needs to look up public information on the web. What each one receives is described in section 4.4.

f) Identity providers: Google and Apple, only if you choose to sign in with them.

g) Messaging: Meta, through the WhatsApp Business and Instagram platforms, only if you connect your WhatsApp or your Instagram: the messages sent and received from your number or your account go through them.

h) Analytics and diagnostics: PostHog (web usage analytics, see section 3.18) and Sentry (error reports from the web application).

i) Maps and addresses: Google Maps Platform, to show the map for delivery tracking and to autocomplete your business address.

j) Push notifications: Expo, which delivers notices to your device through Apple (APNs) and Google (Firebase Cloud Messaging).

k) Authorities: where required by law or to protect rights, people’s safety or the integrity of the platform.

Public content: what you publish on your storefront (business, products, prices, photos) is, by its nature, visible to anyone with the link.

a) Contractual necessity: creating and maintaining your account, publishing your storefront, managing orders and charging your subscription.

b) Legitimate interest: maintaining security, preventing fraud and abuse, and improving the performance of the service.

c) Consent: device permissions (location, camera, microphone, notifications), which you can grant or revoke at any time from your system settings, and sending data to third-party artificial intelligence providers (section 4.5), which you can revoke from Settings → AI use.

d) Legal compliance: keeping accounting and tax records required by applicable regulations.

We keep data while your account is active and for as long as necessary to meet legal obligations, except WhatsApp and Instagram conversations, which have their own, shorter period (sections 5.6 and 5.12). When you delete your account, section 9 applies.

We apply technical and organizational measures: encryption in transit and at rest, strict per-merchant isolation through row level security (RLS), restricted access controls, rate limits and audit logging of administrative actions.

Access by our staff: authorized Exhibe staff may access your account to give you support or diagnose a problem. Every access is logged — who went in, when and until when — and while it lasts your panel shows a visible notice that someone from Exhibe is inside. We do not access your account for our own purposes, nor to use your business’s or your customers’ information for anything else.

You can delete your account yourself, without asking for authorization or writing to anyone, from Settings → Account and security → Delete account, both in the web application and in the iOS and Android applications.

9.1. What happens when you delete it: we permanently erase your business and all its associated data: products, photos, orders, sales, customers, quotes, layaways, inventory, coupons, point-of-sale records, your storefront configuration and your login user. Your public storefront stops being available. If your subscription was purchased on the web, we also cancel it so no future charges are generated; if it was purchased in the iOS application, you have to cancel it yourself in your iPhone Settings → your name → Subscriptions, because only Apple can do it.

9.1 bis. Your images: deletion includes the images hosted with our storage provider — logo, banner, product and variant photos, generated images and the payment proofs attached to your orders — which are removed in the same process.

9.2. It is permanent: deletion cannot be undone and we do not keep copies recoverable by the user. If you want to keep your information, download it before deleting the account.

9.3. What is retained and why: Apple and Stripe keep records of transactions and invoices already made for the period required by accounting and tax regulations. We may also keep minimal technical and security logs, with no content from your business, for the time strictly necessary to prevent fraud and comply with the law. Encrypted backups are overwritten on their usual cycles.

9.4. Your customers’ data: deleting your account also erases from our systems the buyer data associated with your business.

9.5. WhatsApp: if you had WhatsApp connected, the connection, the token and the stored conversations are also erased, and we cancel our subscription at Meta so we stop receiving your number’s messages. Your WhatsApp Business account and its chats are not erased: they are yours and remain at Meta.

9.6. Instagram: if you had Instagram connected, the connection, the token and the stored conversations are also erased, and we cancel our subscription at Meta. Your Instagram account and its messages are not erased: they are yours and remain on Instagram.

You may exercise, at any time, the rights of access, rectification, erasure (right to be forgotten), portability, restriction and objection to processing.

You can exercise most of them directly from the platform: edit your profile and your business, correct or delete products and customers, and delete your entire account from Settings → Account and security. For any other request, write to us at legal@ozertechsolutions.com and we will respond within the timeframes set by applicable law.

We use cookies and the browser’s local storage on the website, the web application and public storefronts. Which cookies they are, what they are for and how to control them is set out in the Cookie Policy, which forms part of this policy.

We operate on global infrastructure, so your data may be stored and processed outside your country, mainly in the United States. We select providers that offer adequate guarantees of security and confidentiality, through contractual clauses and data protection commitments.

Exhibe is not offered to, and is not directed at, people located in the European Union, the European Economic Area or the United Kingdom, and we do not seek out or knowingly target the personal data of people in those territories. Access from there is restricted, as described in section 10 of the Terms and Conditions.

If, despite that restriction, we were to receive data from someone located in those territories, they can write to legal@ozertechsolutions.com to request its deletion, and we will handle it like any other rights request (section 10 of this policy).

Exhibe is a tool for businesses and is intended for people over 18. We do not knowingly collect information from minors. If we detect an account created by a minor, we will delete it along with its data.

We may update this policy to reflect changes in the service or in regulations. Each change is a new version, published with its date. We will notify you within the platform the next time you sign in and, to keep using Exhibe, you will need to accept the new version; we keep a record of which version you accepted and when.

This document is an English translation provided for convenience. The Spanish version is the binding one: in the event of any discrepancy or difference in interpretation between the two, the Spanish text prevails.