Privacy Policy

Wizel (“Wizel”, “we”, “us”) operates an AI email marketing platform for Shopify DTC brands and the Klaviyo agencies that serve them. This Privacy Policy explains what we do with personal information and applies to our website, application, and related services (the “Services”).

We act in two distinct roles. For your own account information we are a data controller. For the data you bring in from connected platforms — your subscribers, campaigns, and analytics — we act as a data processor on your behalf, handling that data only to provide the Services under our agreement with you. Where you are an agency, the same applies between you and your own clients.

By using the Services you agree to the practices described here. If you do not agree, please do not use the Services.

This policy applies to:

• Visitors to our marketing website.
• Account holders and authorised users of the Wizel application.
• Data we process from platforms you connect (Klaviyo, Shopify) to deliver the Services.

It does not cover third-party services that have their own privacy policies — including Klaviyo, Shopify, and any site we link to. Your use of those platforms is governed by their terms and policies.

We collect only what we need to run the Services. The categories below summarise what we hold and where it comes from.

We do not intentionally collect special-category data (such as health, biometric, or government-ID data). Please do not upload it to the Services.

We use personal information for the purposes below. Where the GDPR or UK GDPR applies, the corresponding legal basis is shown.

We do not sell personal information, and we do not use the customer data you sync from connected platforms to train AI models or for our own advertising.

The Services use AI models to draft campaign copy, generate imagery, and surface analytics insights. To do this we send relevant brand, product, and campaign context to our AI providers strictly to produce the output you request.

• We share only the data needed to generate the requested output, and we rely on provider terms that prohibit using your content to train their models.
• Outputs are drafts. A person reviews and approves what is sent — we do not make decisions producing legal or similarly significant effects about individuals without human involvement.
• We do not use your synced subscriber or customer data to train our own models.

We use cookies and similar technologies to:

• Keep you signed in and remember your preferences.
• Understand how the Services are used so we can improve them.
• Protect against fraud and abuse.

You can control cookies through your browser settings; disabling some cookies may affect functionality. Where required, we request consent for non-essential cookies. We honour Global Privacy Control (GPC) signals as a valid opt-out of targeted sharing where applicable.

We do not sell your personal information. We share it only in these circumstances:

• Sub-processors: vetted service providers who help us operate the Services under contract and on our instructions (see the table below).
• Connected platforms: data flows to and from Klaviyo and Shopify as you direct and authorise.
• Legal and safety: where required by law, or to protect the rights, property, or safety of Wizel, our customers, or the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.
• With your consent: when you explicitly ask us to.

Sub-processors

We engage the following categories of sub-processor. A current list of named sub-processors is available to customers on request.

Wizel is based in Australia and uses infrastructure and providers that may process data in other countries. Where we transfer personal data across borders — including out of the EEA, UK, or your home country — we put appropriate safeguards in place, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or transfers to jurisdictions recognised as providing adequate protection.

You can request more detail about the safeguards that apply to a specific transfer using the contact details below.

We apply organisational and technical controls appropriate to the risk, including encryption in transit and at rest, least-privilege access, MFA on administrative systems, vulnerability management, and logging and monitoring.

Full detail of our controls — access management, encryption, vulnerability remediation timeframes, incident response, and breach notification — is published in our Information Security Program. No method of transmission or storage is perfectly secure, but we work continuously to protect your data.

Breach notification

If a breach is likely to result in serious harm, we assess it promptly and notify affected customers and, where required, the relevant regulators and individuals — under the Australian Notifiable Data Breaches scheme and, where applicable, within 72 hours under the GDPR.

Depending on where you live — including under the GDPR/UK GDPR, the Australian Privacy Act 1988, and US state laws such as the California CCPA/CPRA — you may have the following rights over your personal data.

To exercise any of these rights, email privacy@wizel.ai. We will verify your request and respond within the timeframe required by applicable law (generally within 30 days). You may use an authorised agent where the law allows. If we process data on behalf of one of our customers, we will refer your request to that customer as the controller.

We retain personal information only as long as necessary to:

• Provide the Services to you.
• Comply with our legal, tax, and accounting obligations.
• Resolve disputes and enforce our agreements.
• Maintain backups and business continuity.

When you close your account, we delete or anonymise your personal data within 30 days, unless we are required to retain it by law. Synced customer data is deleted or returned at the end of the engagement, subject to legal retention requirements. Backups are purged on a rolling schedule.

The Services are intended for businesses and are not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you by email or within the Services. Your continued use of the Services after an update means you accept the revised policy.

Questions about this policy or how we handle your data? We are happy to help — and you have the right to complain to a regulator if you are not satisfied with our response.