Last updated: September 20, 2026
This Privacy Policy explains how Amileia AB, a Swedish limited liability company (Sw. aktiebolag), and its affiliate Amileia, Inc., a Delaware corporation (collectively, "Amileia", "we", "us", or "our"), collect, use, share, and protect personal data in connection with the Amileia platform available at amileia.com and related applications, APIs, and the website chat widget (the "Service").
For privacy inquiries, contact us at legal@amileia.com.
Amileia is an invite-only AI helpdesk for e-commerce merchants. How we handle personal data depends on whose data it is:
Merchants are responsible for providing Shoppers with an appropriate privacy notice, obtaining any required consents, and ensuring a lawful basis for processing Shopper data through the Service (including the chat widget embedded on the merchant's storefront).
Depending on how the Service is used, we may process:
We use personal data to:
Where Amileia acts as controller, our lawful bases under the GDPR typically include performance of a contract, legitimate interests (for example securing and improving the Service), and legal obligation. Where we act as processor, we process Customer Content on the merchant's documented instructions as described in our Terms and this Policy.
The Service uses third-party AI models and infrastructure (including via the Vercel AI Gateway and related model providers) to interpret Shopper messages, select routing tags, retrieve relevant knowledge, draft or send replies, and evaluate whether certain high-impact actions (such as order changes) should proceed under merchant-configured settings.
Conversation content, relevant metadata, and merchant knowledge snippets may be transmitted to these providers solely to deliver the Service. Amileia does not use Customer Content to train foundation models for unrelated purposes, and we configure our providers, where contractually available, so that API inputs are not used to train their general-purpose models.
AI outputs can be incomplete or incorrect. Merchants remain responsible for reviewing Copilot drafts where human review is enabled, configuring Autopilot and action permissions appropriately, and verifying critical customer-facing statements and commerce actions.
We may share personal data with:
We do not sell personal data. We do not share personal data for cross-context behavioral advertising.
Amileia is designed with regional workspace provisioning in mind. Production merchant knowledge documents are intended to be hosted in the European Union (Pinecone Assistant, EU region on a paid plan). Other Service components—such as authentication, application hosting, email, payments, and AI inference—may process data in the EEA, the United Kingdom, the United States, or other countries where our providers operate.
Where personal data is transferred from the EEA/UK to a country that has not received an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and UK addenda where applicable), and supplementary measures as needed.
We use essential cookies and similar technologies required to operate the Service, including authentication/session cookies, active workspace selection, and region routing. The website chat widget may store a local session identifier in the Shopper's browser to continue an open conversation. We do not currently use non-essential marketing or advertising cookies. If that changes, we will update this Policy and, where required, obtain consent.
We retain personal data only as long as needed for the purposes described in this Policy, including to provide the Service, meet legal, tax, and accounting requirements, and resolve disputes. Customer Content is retained for the life of the merchant workspace unless the merchant deletes it or requests deletion, or longer if we must retain it for legal reasons. Widget session data that is abandoned may expire automatically after a short period. When an account or workspace is deleted, we delete or anonymize associated personal data within a reasonable period, except for limited residual copies in backups or logs that are securely overwritten in the ordinary course.
We implement technical and organizational measures appropriate to the risk, including encryption in transit, access controls, row-level security in our database where applicable, encryption of integration secrets at rest, and least-privilege operational practices. No method of transmission or storage is completely secure; merchants should protect their credentials and invite only trusted users.
If you are in the EEA, UK, or another jurisdiction with similar laws, you may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability. Where processing is based on consent, you may withdraw consent without affecting prior lawful processing. You may also lodge a complaint with a supervisory authority (in Sweden, Integritetsskyddsmyndigheten / IMY).
To exercise rights regarding account data we control, email legal@amileia.com. For Shopper requests about Customer Content, contact the merchant first; we will assist merchants in responding as required by applicable law and our processor obligations.
The Service is directed to businesses and is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.
When Amileia processes Customer Content as a processor, we will: (a) process it only to provide the Service and on the merchant's instructions; (b) require confidentiality from persons authorized to process it; (c) implement appropriate security measures; (d) engage subprocessors under written terms offering at least equivalent protection and remain responsible for their performance; (e) assist with data-subject requests, security incidents, and reasonable compliance inquiries; (f) delete or return Customer Content upon termination of the Service, subject to legal retention needs; and (g) make available information reasonably necessary to demonstrate compliance. A more detailed Data Processing Addendum is available on request for enterprise customers.
We may update this Privacy Policy from time to time. The "Last updated" date above reflects the latest revision. Material changes will be communicated through the Service or by email where appropriate. Continued use of the Service after an update becomes effective constitutes acceptance of the revised Policy, except where applicable law requires a different standard.
Amileia — privacy and legal requests: legal@amileia.com. Website: https://www.amileia.com/.
Related: Terms and Conditions.