Privacy Policy

Last updated: 18 October 2026

1. Who we are

AI Head Office ("AI Head Office", "we", "us", "our") is operated by E-Commerce Growth Solutions Ltd, a New Zealand company trading as The E-Commerce Accelerator, of 80 KahaKaha Lane, Māngere, Auckland 2022, New Zealand. We are an "agency" under the New Zealand Privacy Act 2020 and we handle personal information in accordance with that Act. Where the Australian Privacy Act 1988 applies to us, we also comply with the Australian Privacy Principles.

Our Privacy Officer is Simon John Phillips, reachable at simon@themagnitudegroup.co or aiheadoffice@theecommerceaccelerator.com.

Many of the brands we serve sell to customers in the United Kingdom, the European Union and the United States. Where the General Data Protection Regulation or its United Kingdom equivalent applies to a brand's customers, we act as that brand's processor under the Data Processing Addendum in our Terms of Service, and the brand is the controller you should contact first.

2. Who this policy is written for

Three groups of people, and we address each separately:

• Merchant users: the people who create a workspace, sign in, and connect commerce, advertising, email, review and accounting platforms.
• The merchant's customers, reviewers and contacts: people whose information reaches us through the platforms a merchant connects. We hold most of this information as the merchant's agent. If you are one of these people, section 9 is for you.
• People who appear in public content we analyse: creators, competitor advertisers and the authors of public reviews and comments. Section 10 is for you.

3. Information we collect about merchant users

• Account identity: name, email address, and organisation membership, held by our authentication provider (Clerk). We do not store your password.
• Workspace content you create: notes, comments, chat messages, briefs, business-plan and role documents, staff seat details including salary figures and role salary bands if you enter them, settings, and any files you upload.
• Role agreements and induction plans: when you send a role to a staff member or contractor for signature, or share a first-week induction plan with them, we store the agreement as sent, the person's name and email address, and the progress they tick off. Section 9 says what we record when they sign.
• Usage records: product-analytics events about how the dashboard is used, and an audit log of privileged actions (actor, action, target, time, IP address and browser).
• Payment: subscriptions are billed through Shopify Billing. We receive the subscription status and plan. We never receive card details.
• Voice: if you use dictation, the audio is sent to OpenAI for transcription and is not retained by us.
• Your own AI credentials: if you connect an Anthropic, OpenAI, Google or other API key, or a personal Claude subscription token, we store it AES-256-GCM encrypted and show you only its last four characters.
• Coaching: if your workspace is part of The E-Commerce Accelerator programme, we store questions you submit to coaches and, for recorded strategy calls, the call transcript and a searchable index of it. Call recording is announced at the start of every recorded call; you may ask for any call to be excluded from your workspace context. These are working meetings: the people on the call are named in the conversation, and the strategy documents and weekly actions written from the calls name them too.
• Claude access: if a workspace admin switches on Brand Access under EHO MCP and a member connects their own AI assistant (today, Claude by Anthropic), we store the admin's authorisation (who, when, which data groups, the wording accepted), each connection (the member, the app, when it was granted and last used), the sign-in tokens that keep it working, and a log of every request (the tool asked for, when, how large the answer was, whether it was refused) kept for 90 days. We do not receive, store or read the member's conversation with the assistant.

4. Information we receive from platforms you connect

We collect only what each feature needs. The scopes we request are the minimum the platform allows for that data.

4.1 Health-related and children's information

Some merchants sell supplements or therapeutic goods, run quizzes that ask customers about health goals or outcomes, or sell to children and teenagers. Information of that kind can reach us through the merchant's customer tags, email segment rules, order notes, product purchases and reviews. We do not ask for it, we do not build profiles from it, and we do not use it to target anyone. The merchant is responsible for collecting it lawfully, including obtaining consent for sensitive information and complying with the Children's Online Privacy Code where it applies. We treat it as sensitive: it is isolated per merchant, encrypted in transit and at rest, excluded from any review quote used in marketing drafts where it discloses a diagnosis, and deleted on the merchant's instruction.

4.2 Asana

Project, section, and task metadata for the projects you choose to sync is read into your workspace, and item titles, stages, due dates and the assigned team member's email address are written outbound to the linked Asana tasks. The Asana user and workspace IDs of the person who authorized the connection are stored with the integration so we can maintain it and show you who connected it.

4.3 Slack

When you connect Slack, our bot joins the one channel you choose. The text of messages and thread replies posted there, the time they were posted, and the Slack display name of each person who posted or is mentioned are read into your workspace's Creative Chat and stored with it. That can include people in your Slack workspace who do not use this app. Messages you post in the Creative Chat are written to the channel under your name. The Slack team ID, the bot's identity, the chosen channel and the Slack user ID of the person who connected it are stored with the integration. We do not read other channels, direct messages or files.

5. Information we collect from public sources

Some features analyse public content to help you understand your market. Where this content includes information about identifiable people, we collect it indirectly and this section is our notice to them (see section 10).

• Competitor advertising from the Meta Ad Library: page name, ad copy, format, dates, and an AI-generated description of the ad's angle and presenter.
• Organic content from TikTok, Instagram and YouTube for creators, keywords or hashtags you choose: creator handle and display name, follower count, caption, hashtags, engagement counts, and an AI-generated transcript and summary. The video file is sent to Google for analysis and is not stored by us.
• Public reviews and discussion from Amazon, Trustpilot, Reddit, Instagram and TikTok comments for products and topics you choose: the text and its source link. Once analysis is complete we keep the text and drop the commenter's handle and link.

We use a scraping service (Apify) to collect this content. We do not attempt to identify the authors, we do not contact them, and we do not combine this content with any other source to build a profile of a person.

6. Why we use information, and the legal basis

We do not sell personal information. We do not use your data to train AI models, and our AI providers are contracted on the same basis. We do not use one merchant's customers' personal information to advise another merchant. Within The E-Commerce Accelerator programme, coaches compare participating businesses' commercial results with one another, as agreed in the Terms of Service; that comparison involves business metrics, not the personal information of anyone's customers.

7. Where information is stored and processed

Our primary database and application servers are hosted in Seoul, South Korea (Amazon Web Services region ap-northeast-2, and Vercel region icn1). Uploaded files are stored with Cloudflare R2, which places data in the region closest to our servers. Some of the providers below process information in the United States, and our generation services run in Singapore.

New Zealand law allows us to send personal information overseas where the recipient is bound to protect it comparably. We rely on written contracts with each provider to that effect, and we tell you here which countries are involved so you can make an informed choice. For customers of brands to whom European or United Kingdom law applies: New Zealand and South Korea both hold European Union adequacy decisions, New Zealand holds United Kingdom adequacy, and our United States providers are bound by the Data Privacy Framework or standard contractual clauses in their own terms. By using the service, merchant users agree to these transfers on that basis.

8. Who we share information with

We share personal information only with the providers below, each under a written agreement, and only for the purpose stated. We keep this register current in Schedule 2 of our Terms of Service.

A connected AI assistant is different: when a workspace admin switches on Brand Access under EHO MCP and a member connects their own AI assistant, the brand data that assistant asks for is sent to its provider (today, Anthropic, under the member's own agreement with Anthropic and Anthropic's privacy policy). The provider is not our sub-processor; the admin's authorisation and the member's connection are the instruction to send it, and either can be withdrawn at any time on the EHO MCP page under System. Only the data groups the admin ticked leave, only within the member's own plan and departments, and personal information about customers, contacts and reviewers is never included.

We also disclose information where the law requires it, to our professional advisers under confidentiality, and in a sale or restructure of the business, to the successor on the same terms.

If you connect an external AI agent to your workspace through our connector, or a member of your team uses a third-party tool with their workspace credentials, that tool receives what you allow it to; it is not our sub-processor.

9. If you are a merchant's customer, reviewer or contact

We act as the merchant's agent. The merchant is responsible for your information under the Privacy Act and is the right first contact for access, correction and deletion. When a merchant forwards a request to us, or a platform sends us a deletion request (for example Shopify's customer-redact webhook), we act on it within 30 days and usually within hours.

What we hold about you, at most:

• If you bought from a Shopify store: the store's customer ID, a keyed hash of your email that cannot be reversed without our secret, order totals and dates, your shipping country, and anything the merchant or you typed into the order note.
• If you left a review the merchant imports: your display name and location as published, your rating and words, and the product.
• If you are a contact in the merchant's Xero: name, email, phone, address and business identifiers as the merchant recorded them.

We do not use your information for anything except serving the merchant. Review text may be quoted, verbatim and attributed only by the display name you published under, inside the merchant's private workspace to help write their marketing. We exclude any review that discloses a medical diagnosis from that use. You can ask us directly, at the address in section 1, to delete or correct anything we hold about you, and we will verify your identity through the merchant or the platform.

If a business that uses AI Head Office sends you a role agreement to sign or a first-week induction plan, we hold them on that business's behalf: your name and email address, the agreement as it was sent to you, and the steps you tick. When you sign, we record the name you type, the signature you draw, the time, your IP address and your browser and device details, so the signed copy can show who signed it, when and from where. The business you work with is responsible for this record and is your first contact for access, correction or deletion.

10. If you are a creator, advertiser or the author of a public comment we collected

We collected your public content indirectly, from the platform where you published it, because one of our merchants asked to study a topic, hashtag or competitor. We hold the content to help that merchant understand what resonates in their market. If you are a creator whose video we analysed, we keep your handle and the link so the merchant can find the original. If you are the author of a comment or review, we drop your handle and the link once analysis is complete. We do not contact you, monetise your content, or republish it outside the merchant's private workspace and the AI assistants its admin has connected to that workspace, which carry the same restriction. Email the address in section 1 to have your content removed; we will act within 30 days.

11. How we protect information

• Every merchant's data is isolated at the database layer by Row Level Security on every tenant table, and the application verifies at start-up that its database role cannot bypass that isolation.
• Access tokens, refresh tokens and AI keys are encrypted at rest with AES-256-GCM; the encryption key is never stored with the data.
• Shopify customer emails are stored only as keyed one-way hashes.
• Our staff who can view more than one workspace must use multi-factor authentication, and every privileged action is recorded in an audit log.
• All traffic uses TLS. Backups are encrypted.
• Incoming platform webhooks are verified by signature before processing.
• We do not log prompt contents, passwords or tokens.

No system is perfectly secure. If we become aware of a breach that is likely to cause serious harm, we will notify the New Zealand Privacy Commissioner, and where the Australian scheme applies the Australian Information Commissioner, and the affected people, as soon as practicable and within 72 hours of confirming the breach wherever we can.

12. How long we keep information

We keep information while your workspace is active, except where the table below says otherwise. When your organisation is deleted, the workspace is erased 30 days later; only our platform audit log is kept.

13. Your rights

Merchant users and anyone else whose information we hold can ask us to confirm what we hold, provide a copy, correct it, or delete it. We respond within 20 working days (New Zealand) or 30 days (Australia). Merchants can disconnect any platform in Settings and choose to delete that platform's data. A workspace owner can delete the whole workspace by deleting the organisation, or ask us to; it is then erased as described in section 12.

If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner (New Zealand), privacy.org.nz, or the Office of the Australian Information Commissioner, oaic.gov.au.

14. Cookies

We use only cookies that are necessary to run the service: your sign-in session, your organisation selection, and remembered dashboard settings. We do not use advertising or third-party analytics cookies, so no cookie consent banner is required.

15. Children

The service is for businesses and is not directed at anyone under 18. We do not knowingly collect information from children. Public content we collect for research is not filtered by age; if you believe we hold a child's content, tell us and we will remove it.

16. Changes

We will tell workspace owners by email at least 30 days before any change that reduces your rights or expands what we collect, and we will keep prior versions available on request.

17. Contact

E-Commerce Growth Solutions Ltd (trading as The E-Commerce Accelerator)
80 KahaKaha Lane, Māngere, Auckland 2022, New Zealand
Privacy Officer: Simon John Phillips, simon@themagnitudegroup.co
aiheadoffice@theecommerceaccelerator.com