Privacy Policy

This Privacy Policy explains how Copia Systems, Inc. ("Copia," "we," "us," or "our") collects, uses, discloses, and protects information in connection with our website at copia.co and our software-as-a-service platform (collectively, the "Service"). By using the Service, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy is incorporated by reference into our Terms of Service. Capitalized terms used but not defined here have the meanings given to them in the Terms of Service.

1. Scope

This Privacy Policy applies to information we collect when you visit copia.co, sign up for or use the Service, communicate with us, or otherwise interact with Copia. This Privacy Policy does not apply to: (a) information collected by third parties whose websites or services may be linked from or integrated with the Service, including without limitation third-party AI model providers, payment processors, and other vendors; or (b) information collected by Copia in contexts other than as a service provider (for example, information collected from job applicants).

2. Information We Collect

2.1 Information You Provide Directly

We collect information you provide directly to us, including:

Account information: name, email address, company name, job title, password (stored in hashed form), and similar registration details.

Customer Content: text, files, prompts, queries, and other content you submit to the Service.

Billing information: handled by our payment processor Stripe (we do not directly collect or store credit card numbers), but we receive limited billing-related information such as billing address, last four digits of payment card, transaction history, and subscription tier.

Communications: when you contact us by email, support form, or other means, we collect the content of those communications and any information you choose to share.

Survey or feedback responses: if you respond to a survey or provide feedback, we collect your responses.

2.2 Information Collected Automatically

When you use the Service, we automatically collect certain information, including:

Usage data: pages visited, features used, actions taken, dates and times of access, and similar usage information.

Device and connection data: IP address, browser type and version, operating system, device identifiers, language preferences, and referring URL.

Cookies and similar technologies: see Section 6 below for details on our use of cookies.

Logs: server logs, error logs, and other system-generated records.

2.3 Information from Third Parties

We may receive information about you from third parties, including:

Authentication providers if you sign in using a third-party service (e.g., Google or Microsoft single sign-on).

Stripe, our payment processor, with respect to payment confirmations, failures, and similar billing events.

Analytics and error-reporting providers, with respect to your use of the Service.

Public sources, including business directories and public social media profiles, in connection with sales and marketing efforts.

Advertising platform integrations, including Meta/Facebook, when you connect an advertising account or authorize Copia through OAuth. This may include ad account information, campaign performance metrics, ad creative data, audience insights, page information, and related data needed to provide advertising management, analytics, and creative intelligence features.

Commerce platform integrations, including Shopify, when you install a Copia app on your store or otherwise connect your store to Copia. This may include your product catalog (product titles, descriptions, images, pricing, and SEO metadata) and order information limited to order identifiers, order totals and currency, purchased products and quantities, and marketing campaign (UTM) parameters. Copia does not collect or store your customers' names, email addresses, physical addresses, or phone numbers from connected commerce platforms.

3. How We Use Information

We use the information we collect for the following purposes:

Providing the Service: to operate, maintain, and provide the features and functionality of the Service, including processing your Customer Content through third-party AI models to generate Outputs.

Account management: to register and manage your account, authenticate you, and provide customer support.

Billing and payments: to process subscription payments, manage billing, and prevent fraud.

Communications: to send you transactional messages (such as billing notifications, security alerts, and service updates), respond to your inquiries, and, with your consent where required, marketing communications about Copia’s products and services.

Service improvement: to monitor and analyze usage and trends, debug and improve the Service, develop new features, and ensure security and reliability. As described in our Terms of Service, we may use de-identified, aggregated, or anonymized data derived from Customer Content for these purposes.

Security: to detect, prevent, investigate, and respond to fraud, abuse, security incidents, violations of our Terms or Acceptable Use Policy, and other harmful or illegal activity.

Compliance and legal: to comply with applicable laws, regulations, legal process, and lawful government requests; to enforce our agreements; and to protect our rights, property, or safety, or those of our users or others.

Business operations: to manage our business operations, including financial reporting, audits, corporate governance, and corporate transactions (such as mergers, acquisitions, or financings).

3.1 AI Model Training and Cross-Account Insights

Subject to your right to opt out, Copia may use Customer Content for the following purposes:

Internal model improvement: Copia may use Customer Content to evaluate, fine-tune, and improve its prompts, evaluation frameworks, model selection logic, retrieval pipelines, internal models, and other operational components of the Service. Customer Content used for these purposes is processed internally and is not exposed in raw form to other customers.

Cross-account learning: Copia may derive patterns, learnings, structural insights, and aggregated benchmarks from Customer Content (such as which structures, formats, or approaches tend to perform well) and use them to inform and improve the Service for any customer.

Cross-account examples (sanitized): For Customer Content consisting of marketing or advertising creative that has been or is intended to be made publicly available, Copia may use sanitized and abstracted versions of such content as illustrative examples for other customers, after removing brand identifiers, personal identifiers, proprietary specifics, and any content marked as confidential.

Copia passes Customer Content to various third-party AI providers solely to generate Outputs in response to your prompts and queries. Copia contractually requires such providers not to train their own models on Customer Content unless you have explicitly opted in.

Opt-Out: You may opt out of having your Customer Content used for any of the purposes described above (other than de-identified aggregate analytics) by emailing privacy@copia.co. You may also ask us to treat specific Customer Content as confidential or "do not share" by emailing the same address. Opt-outs apply prospectively.

4. Legal Bases for Processing (Applicable to Users in the EU/UK)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, our legal bases for processing your personal information depend on the specific processing activity:

Performance of a contract: to provide the Service to you and fulfill our obligations under the Terms of Service.

Legitimate interests: to operate, secure, and improve the Service; communicate with you; and conduct business operations, in each case where our interests are not overridden by your data protection rights.

Legal obligation: to comply with applicable laws and respond to lawful requests.

Consent: where we rely on your consent (such as for certain marketing communications or optional data uses), you have the right to withdraw your consent at any time.

5. How We Share Information

We share information in the following circumstances:

5.1 Service Providers and Sub-Processors

We share information with third-party service providers and sub-processors who perform services on our behalf. These include:

AI Model Providers: various third-party AI providers, who process Customer Content to generate Outputs. The specific providers we use may change from time to time as we evaluate model performance and capabilities; a current list of significant AI providers is available upon request to privacy@copia.co.

Cloud Infrastructure: hosting, storage, and computing providers.

Payment Processing: Stripe, Inc., for processing subscription payments.

Partner Referral Tracking: Rewardful, our referral-tracking provider, for crediting Copia Partners with the customers they refer. If you subscribe after following a partner's link, Rewardful receives your billing records from Stripe to calculate that partner's commission. The partner who referred you can see limited details of that referral in their partner dashboard.

Advertising Platforms: Meta/Facebook and other ad platforms you connect, solely to provide the integration features you authorize.

Commerce Platforms: Shopify and other commerce platforms you connect, solely to provide the integration features you authorize (for example, publishing product content or images you approve back to your store).

AI and Creative Infrastructure: AI model and image-generation providers, including providers such as OpenAI, Anthropic, and fal.ai, to generate and evaluate Service outputs.

Communications: email service providers (e.g., for transactional emails) and customer support platforms.

Analytics and Monitoring: analytics, error-reporting, and performance-monitoring services.

Authentication: identity providers if you use single sign-on.

Professional Advisors: lawyers, accountants, auditors, and consultants who advise us in the ordinary course of business.

We require our service providers and sub-processors to use information only as needed to perform services for us and in accordance with appropriate confidentiality and security obligations. A current list of significant sub-processors is available upon request to privacy@copia.co.

5.2 Legal Requirements and Protection of Rights

We may disclose information when we believe in good faith that disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or lawful government request; (b) enforce our Terms of Service or other agreements; (c) protect the rights, property, or safety of Copia, our users, or others; or (d) detect, prevent, or address fraud, security, or technical issues.

5.3 Business Transfers

We may share or transfer information in connection with, or during negotiations of, any merger, acquisition, financing, due diligence, reorganization, sale of all or a portion of our assets, or similar transaction.

5.4 With Your Consent

We may share information for any other purpose with your consent or at your direction.

5.5 No Sale of Personal Information

We do not sell personal information in the traditional sense (i.e., for monetary consideration). Some U.S. state privacy laws define "sale" or "sharing" broadly to include certain disclosures for cross-context behavioral advertising or similar purposes. We do not engage in such practices. If our practices change, we will update this Privacy Policy and provide any opt-out mechanisms required by law.

6. Cookies and Similar Technologies

We use cookies and similar tracking technologies (such as web beacons, pixels, and local storage) to operate the Service, remember your preferences, analyze usage, and improve the Service. The types of cookies we use include:

Strictly necessary cookies: required for the Service to function (e.g., authentication, session management, security).

Functional cookies: remember your preferences and settings.

Analytics cookies: help us understand how users interact with the Service.

Referral cookies: if you reach copia.co through a Copia Partners link, our referral-tracking provider stores a cookie for up to 60 days so we can credit the partner who referred you if you subscribe.

You can control cookies through your browser settings. However, if you disable strictly necessary cookies, the Service may not function properly.

7. Data Retention

We retain personal information for as long as necessary to provide the Service, fulfill the purposes described in this Privacy Policy, and comply with our legal obligations. Specific retention practices include:

Account information: retained for the duration of your account and for a reasonable period thereafter to handle disputes, comply with legal obligations, and maintain business records.

Customer Content: retained while your account is active. Upon cancellation or termination of your account, we will delete your Customer Content within ninety (90) days, except (a) as needed to comply with legal obligations; (b) for backups, which are typically purged within thirty (30) additional days; or (c) where you have requested earlier deletion.

Connected commerce platform data: catalog and order information from a connected store is retained while the store remains connected. When you uninstall the Copia app or disconnect the store, this data is deleted in accordance with the platform's data removal requirements (for Shopify, following its mandatory redaction process).

Billing records: retained for at least seven (7) years to comply with tax and accounting requirements.

Communications and support records: retained for as long as reasonably necessary for our legitimate business purposes (typically three to seven years).

Logs and usage data: typically retained for ninety (90) to three hundred sixty-five (365) days, depending on the nature of the data.

8. Your Rights and Choices

Depending on your jurisdiction and the applicable law, you may have the following rights with respect to your personal information:

Access: request a copy of the personal information we hold about you.

Correction: request correction of inaccurate or incomplete personal information.

Deletion: request deletion of your personal information, subject to certain legal exceptions.

Portability: receive your personal information in a structured, commonly used, machine-readable format.

Opt-out of marketing: unsubscribe from marketing communications using the link in any marketing email or by contacting us.

Restrict or object to processing: in certain circumstances, restrict or object to our processing of your personal information.

Withdraw consent: where we rely on your consent, withdraw it at any time.

Lodge a complaint: file a complaint with your local data protection authority.

To exercise any of these rights, contact us at privacy@copia.co. We will respond within the time period required by applicable law (typically thirty (30) to forty-five (45) days). We may need to verify your identity before fulfilling certain requests.

8.1 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), including the right to know, the right to delete, the right to correct, the right to opt-out of "sale" or "sharing," and the right to limit the use of sensitive personal information. We do not sell personal information or share it for cross-context behavioral advertising. To exercise your rights, contact us at privacy@copia.co.

8.2 European Economic Area, United Kingdom, and Switzerland

If you are in the EEA, UK, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) and applicable national laws. You may contact us at privacy@copia.co to exercise your rights or lodge a complaint with your local supervisory authority.

8.3 Other U.S. State Privacy Laws

Residents of certain other U.S. states (including Virginia, Colorado, Connecticut, and Utah) may have similar rights under applicable state privacy laws. Contact us at privacy@copia.co to exercise your rights.

9. International Data Transfers

Copia is based in the United States, and we may store and process information in the United States and other countries. If you are located outside the United States, your information may be transferred to and processed in countries that may have different data protection laws than your country of residence. For transfers from the EEA, UK, or Switzerland to countries not deemed to provide an adequate level of data protection, we rely on appropriate transfer mechanisms (such as the Standard Contractual Clauses approved by the European Commission). Contact us at privacy@copia.co for more information.

10. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit, access controls, authentication requirements, and regular security reviews. However, no security measures are perfect or impenetrable, and we cannot guarantee the security of information you provide to us. You are responsible for keeping your account credentials confidential and for promptly notifying us of any unauthorized access to your account.

11. Children’s Privacy

The Service is not directed to or intended for use by individuals under the age of eighteen (18). We do not knowingly collect personal information from children under eighteen (18). If you become aware that a child has provided us with personal information, please contact us at privacy@copia.co, and we will take steps to delete such information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (to the address associated with your account), through the Service, or by other reasonable means before the changes take effect. The "Last Updated" date at the top of this policy reflects the date of the most recent revision. Your continued use of the Service after changes take effect constitutes your acceptance of the revised Privacy Policy.

13. Data Processing Agreements (B2B Customers)

If your use of the Service involves processing personal information of EU, UK, California, or other regulated data subjects on behalf of your business, you may need a Data Processing Agreement ("DPA") with Copia. We make a standard DPA available upon request to privacy@copia.co. Customers subject to GDPR or similar regulations who require a DPA should contact us before using the Service in connection with such regulated data.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Copia Systems, Inc.

310 W 22nd St 1C

New York, NY 10011

Email: privacy@copia.co