Privacy Policy

Who we are

RetailIntel (retailintel.in) is a product of North Pulse LLC, run by its founder, Promit Biswas. For this policy, RetailIntel is the data controller (the "data fiduciary" under India's Digital Personal Data Protection Act, 2023) for personal data collected through the website, our emails and our API. Write to our privacy contact about anything here.

What we collect

You give us

• Account details when you sign in: your email address, a name if you add one, and the role you pick when you start (for example "category manager").
• What you follow and ask for: the brands and themes you follow, your alert rules, your daily-brief subscription, quiet hours, and the email address deliveries go to.
• Questions you ask in Ask, and the answers we give.
• Messages you send through our contact, correction and enterprise forms, or by email.
• Billing details if you buy a plan. Pro is sold through Link (Stripe Managed Payments): Stripe collects your name, billing address and payment details, uses them to take the payment and meet its tax duties under its own privacy policy, and tells us your plan status. We never see or store your card.
• API keys you create, and a log of the API calls made with them (endpoint, time, size and status).

We collect automatically

• First-party usage events: which pages and actions were used (for example "viewed a signal", "followed a brand"), the browser's user-agent, the referring site's domain, and a one-way hash of your IP address. We never store the IP address itself in these records.
• Analytics, only where you allow it (see Cookies): pages viewed, clicks on links and buttons, device and browser type, approximate location, page performance, and session replays in which everything you type is masked. If you are signed in, analytics knows you by your account ID, never your email.
• Email engagement: whether you clicked a link in an alert or brief, so we can tell which deliveries are useful.
• Security logs: IP address and request details held briefly by our hosting and network providers to keep the service up and stop abuse.

We do not collect sensitive categories of data (such as health, religion or biometrics), and we do not buy data about you from others.

How we use it, and why we may

• To provide the service you asked for — your account, follows, alerts, daily brief, Ask and the API. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)); under DPDP, the consent you give when you sign up or subscribe.
• To send service email — confirmations, the deliveries you subscribed to, and important notices about your account. Every alert and brief has a link to stop it.
• To keep RetailIntel secure and working — preventing abuse, rate-limiting, debugging. Legal basis: our legitimate interests (Art. 6(1)(f)) and, under DPDP, the purposes the Act permits for security and legal compliance.
• To understand and improve the product — first-party usage events (hashed IP, 90 days) under our legitimate interest in knowing which pages readers use; cookie-based analytics and session replay only with your consent where the law requires it (EU, EEA, UK, Switzerland) and otherwise until you opt out.
• To meet legal obligations — tax and accounting records if you pay, and responding to lawful requests.

We do not use your data for advertising, we do not build profiles to sell, and we do not make decisions about you that have legal or similarly significant effects by automated means.

AI and your questions

Ask answers and signal pages are written by language models running in Amazon Bedrock, on our AWS account. Questions you type are sent to those models to produce your answer. Under AWS's terms, Bedrock does not use our inputs or outputs to train models, and does not share them with the model providers. Do not put confidential or personal information about other people into a question.

Who we share it with

We share personal data only with the service providers below, who process it on our instructions under data-processing terms, and when the law requires it.

We will tell account holders before adding a provider that changes how personal data is handled. If RetailIntel is sold or merged, your data would pass to the new owner under this policy, and we would tell you first.

Where it is stored

Our servers and database are in the United States (AWS us-east-1), so data from India, the EU, the UK and elsewhere is transferred there. Where the GDPR or UK GDPR applies, those transfers rely on the providers' Standard Contractual Clauses or the EU–US Data Privacy Framework. India's DPDP Act allows transfers to the United States.

How long we keep it

• Account, follows, alerts and subscriptions: while your account or subscription is active. When you delete your account we erase them at once, except what we must keep by law.
• Ask conversations: kept so you can come back to them, and deleted with your account or on request.
• First-party usage events: deleted after 90 days.
• Analytics (PostHog): events up to 1 year, session replays up to 30 days.
• Records of emails we sent you: as long as your subscription is active, then deleted with your account.
• Billing records: as long as tax law requires (up to 8 years in India).
• Messages to us: as long as needed to answer them and keep a record of the conversation.

Your rights and choices

Wherever you live, you can ask us to:

• access the personal data we hold about you and get a copy in a portable format: download it as a JSON file, signed in, in one tap;
• correct or complete it;
• delete it, including your whole account: delete it yourself, signed in, in one tap. If you only gave us an email address for the daily brief, the stop link in any brief can erase it;
• object to or restrict processing based on our legitimate interests;
• withdraw consent at any time — for analytics, use Your privacy choices; for email, use the stop link in any alert or brief, or manage your follows and alerts;
• nominate someone to exercise your rights if you die or become incapacitated (DPDP Act s. 14).

For the other rights, or if the page above does not work for you, email our privacy contact from the address on your account, or tell us how to verify you. We reply within 30 days and do not charge for requests. We honour the Global Privacy Control signal: if your browser sends it, analytics stays off.

California residents

In the last 12 months we collected the categories described above: identifiers (email, account ID, hashed IP), commercial information (plan purchases), internet activity (usage and analytics), approximate geolocation and inferences limited to the role you choose. We collected them for the purposes in "How we use it". We do not sell personal information and do not share it for cross-context behavioural advertising, and we do not use sensitive personal information. You have the right to know, delete and correct, and to not be discriminated against for using these rights.

Children

RetailIntel is a professional service for adults. You must be 18 or older to create an account or subscribe. We do not knowingly collect data from anyone under 18; if you think we have, tell us and we will delete it.

Security

Traffic is encrypted in transit (TLS). Our database is encrypted at rest, and alert email addresses are additionally encrypted at the field level. Access to production systems is limited to the people who run RetailIntel. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you and the relevant authorities as the law requires. To report a vulnerability, seeSecurity.

Grievance Officer and complaints

If you are not satisfied, you can complain to the Data Protection Board of India, your EU or EEA data protection authority, the UK Information Commissioner's Office, or the California Privacy Protection Agency.

Changes to this policy

We update this page when what we do changes, and change the date at the top. If a change materially affects how we use your data, we email account holders before it takes effect.