Privacy Policy

1. WHO WE ARE AND WHEN THIS POLICY APPLIES

1.1. Scope. Agentous, Inc., a Delaware corporation, with its principal place of business at 1452 Hughes Rd Ste 200, Grapevine, TX 76051, provides Merissa AI. This Policy applies when Agentous determines the purposes and means of processing personal information through Merissa-operated websites, apps, shopping interfaces, agent sessions, and related services.

1.2. Merchant-hosted experiences. When a merchant hosts Merissa on its website or storefront, that merchant may independently determine what customer information it collects and how it uses it. Agentous may act as a service provider or processor for some activities and as a separate business or controller for others, such as protecting Merissa, administering account security, and responding to legal requests. The merchant’s own privacy notice applies to its independent collection and use. If we process information solely on a merchant’s documented instructions, applicable rights requests may need to be addressed to that merchant.

1.3. Independent providers. Shopify, other commerce platforms, Shop Pay, Stripe and Stripe Identity, Skyfire, Experian, and other payment, identity or fraud-prevention providers may independently process information under their own privacy notices and applicable agreements. Specific services and availability vary by integration and transaction.

1.4. Geographic and age scope. Merissa is currently intended for U.S. consumers age 18 or older (or the higher applicable age of majority). We do not knowingly offer the Services to minors or knowingly collect personal information directly from children under 13. If we learn we collected such information contrary to law, we will take appropriate steps to delete it and comply with applicable requirements.

2. PERSONAL INFORMATION WE COLLECT

2.1. Information you provide. Depending on your use, this may include your name, email address, phone number, account identifiers, shopping preferences, budgets, product interests, addresses you choose to supply, text or voice instructions, customer-support requests, and transaction or merchant communications.

2.2. Shopping and transaction details. We may collect search and browsing activity within Merissa, product selections, cart contents, merchant and product identifiers, price estimates, order instructions, purchase permissions and limits, shipping details, confirmation and transaction status, order and refund references, and standing-instruction creation, modification, or withdrawal. We generally do not need to hold purchase funds or complete card numbers to provide shopping assistance.

2.3. Voice, video, and AI interaction data. Merissa may process conversations, transcripts, audio, video, and associated session data where those features are enabled. Any recording, transcription, voice or image analysis, or use of biometric information is subject to applicable notices, settings, provider terms, and any consent required by law. Do not assume a video-enabled session is recorded or that biometric templates are created in every interaction; the actual processing depends on the deployed feature.

2.4. Device, cookie, and usage data. We may receive IP address, device and browser characteristics, approximate location inferred from IP address, log data, session identifiers, referral or page events, diagnostic data, fraud indicators, cookie identifiers, and similar technical information for functionality, security, measurement, and support. A separate cookie notice or preference interface will identify optional analytics or advertising technologies where used.

2.5. Data from other parties. Merchants, commerce platforms, payment providers, fraud-prevention services, and other authorized partners may supply product and listing data, purchase status, user-authentication results, transaction identifiers, permitted verification outputs, and other information needed to fulfill the requested function.

2.6. Sensitive information. Depending on a specific feature, information may be sensitive under state law, including account login credentials, financial information, identity-verification information, precise location (only if enabled), or audio/video-derived data. We limit sensitive-data processing to disclosed, authorized, or otherwise legally permitted purposes and obtain consent where required. We do not assume that ordinary conversations authorize collection of all sensitive data categories.

3. HOW WE USE INFORMATION

3.1. Provide requested shopping assistance. To understand your instructions; recommend and compare products; search eligible merchant catalogs; prepare or update carts; communicate with merchants; support authorized checkout and payment-provider handoff; and provide transaction updates or customer support.

3.2. Authorizations and consumer control. To verify the scope, validity, limits, and withdrawal of purchase permissions, standing instructions, merchant-specific directions, and related actions. Instructions to browse or compare do not by themselves authorize an actual purchase or payment.

3.3. Identity, safety and fraud prevention. To verify identity and authorization, assess security and fraud risks, enforce restricted-product, merchant and industry controls, investigate abuse, protect accounts, and satisfy applicable provider, payment-network, legal and contractual requirements. Where available, we may use merchant identifiers, merchant-industry or category information, platform-provided vetting indicators, restricted-party lists, and other risk signals to decide which merchants or products Merissa displays or facilitates. Merchant screening may also depend on vetting performed by integrated commerce platforms; the accuracy and availability of platform-supplied data may limit our ability to identify restricted merchants or categories.

3.4. Operate and improve Merissa. To monitor reliability, diagnose defects, test safety controls, improve recommendations and interfaces, measure usage, and maintain platform quality. We do not use Experian-provided verification outputs, identity tokens, or other provider-controlled information to train or fine-tune AI models unless expressly authorized by the provider and legally permitted. Other conversational or shopping information may be used for improvement only within applicable notices, privacy choices, contracts, and law.

3.5. Compliance and communications. To send account, security, service, transaction, and legally required communications; honor privacy requests; maintain audit and consent records; prevent unlawful activity; and establish, exercise or defend legal claims. Marketing messages and applicable opt-outs will be handled separately from necessary service notices.

4. IDENTITY VERIFICATION AND AGENT TRUST SERVICES

4.1. Information submitted or collected. Depending on the selected identity verification provider and service, Agentous or the provider may collect, use or transmit information reasonably necessary for identity verification, authentication, fraud prevention and transaction security, potentially including name, email address, phone number, residential or billing address, identification documents or images, facial or biometric comparison information, device signals, transaction details and evidence of consent. The types of data actually used depend on the implementation, applicable law, the provider agreement, and required disclosures and permissions. Some information may be collected directly by providers, including Stripe Identity, rather than by Agentous.

4.2. Provider processing and results. Independent verification providers, including Experian, Stripe Identity, and other providers, may use information they lawfully receive and authorized third-party sources to perform verification. Depending on the service, Agentous may receive verification status, risk or fraud signals, limited identity attributes, transaction identifiers or other expressly permitted results. The information returned to Agentous may differ from the information collected directly by a provider. Experian-specific processing remains subject to its applicable agreement, privacy notice and approved consent disclosures.

4.3. Provider-specific notices and consent. Before a verification requiring separate notice or affirmative consent, we or the applicable provider will present the required disclosure and obtain the necessary authorization. Experian-enabled verification will use the then-current Experian-approved disclosure and consent process where required. Other providers, including Stripe Identity, may provide their own notices and consent interfaces. General acceptance of Merissa Terms or this Privacy Policy does not substitute for additional consent legally or contractually required for a specific verification.

4.4. Consent records. For each applicable Experian transaction or agent session, Agentous will capture and retain a Consent Record reflecting the actual language and version presented, timestamp, method of acceptance, authorization scope and status, and appropriate consumer, session, or transaction reference. We will associate and transmit the required consent evidence to Experian as required by the governing integration and furnish supporting evidence when properly requested. A standing authorization will be used only where contractually and legally allowed, within its recorded scope.

4.5. Merchant-directed disclosure and tokens. Where an authorized implementation supports identity or agent-verification tokens, or disclosure of covered personal information to merchants, we disclose only as permitted by the governing Experian arrangements. In consumer-directed third-party shopping, Agentous will obtain your express direction for the designated merchant and contemplated transaction before Experian or Agentous shares covered identity information or identity/payment tokens with that merchant, where required. A general shopping instruction is not unrestricted permission to share verification data.

4.6. First-party merchant restrictions. In merchant-hosted experiences using Experian Agent Trust, applicable merchants must be eligible and subject to the separate approvals, credentialing, and participating-merchant terms required by the governing Experian arrangement. This Policy does not represent that every merchant using Merissa has been approved for Experian functionality.

4.7. Provider-data restrictions. Experian-controlled outputs and tokens are subject to specific permitted-use, confidentiality, onward-disclosure, retention, deletion, and security limitations. Agentous does not acquire unrestricted rights to decode, repurpose, resell, or train models on those materials. Processing involving Experian is also subject to the relevant data-processing agreement and approved statement of work.

4.8. Verification is not credit decisioning. Identity, agent-trust and fraud-prevention checks described in this Policy are intended to facilitate authentication and transaction security, not to serve as independent eligibility decisions concerning credit, insurance, employment or housing. Any separately regulated decision process will be subject to its applicable legal requirements and disclosures.

5. WHEN AND WITH WHOM WE DISCLOSE INFORMATION

5.1. Merchants and commerce platforms. We may share information reasonably needed for requested shopping assistance or an authorized transaction, such as item selections, cart or order details, relevant contact or shipping details, merchant identifiers and authorized session or transaction attributes. Merchants and commerce platforms independently determine their own data collection and practices. We rely in part on merchant onboarding, verification and compliance screening performed by integrated e-commerce platforms such as Shopify and, if integrated, WooCommerce, BigCommerce or other platforms. We may apply additional merchant-level or industry-level display and transaction restrictions, including a block list supplied by an authorized partner, where the integration makes accurate merchant identifiers, categories or other relevant data available. Platform vetting is not a guarantee of eligibility and does not by itself supersede any additional approval or credentialing required by a particular provider agreement.

5.2. Payment services. Shop Pay, Stripe Link, Skyfire, supported wallets, financial institutions and other payment services may receive checkout details or tokenized payment instructions as needed for a consumer-authorized transaction. They may directly collect authentication or payment credentials; we do not claim to control the provider’s independent processing.

5.3. Verification, security and service providers. We share information with authorized identity verification and fraud-prevention providers, and with infrastructure, communications, customer-support, hosting, analytics and security vendors under applicable contractual and legal protections. Sharing of Experian information is more restricted as described in Section 4.

5.4. Legal, corporate and protective disclosures. We may disclose information when lawfully required; to protect rights, safety, systems and users; to detect fraud; or in connection with a merger, acquisition, financing or transfer of relevant assets, subject to applicable privacy rights, contracts, notice, and safeguards.

5.5. Not a blanket marketing authorization. We do not interpret consent to shopping, identity checks, or payment facilitation as unrestricted authorization for third-party marketing, cross-context behavioral advertising, or sale of information. Any such activities, if implemented, must be accurately disclosed, provide required opt-out mechanisms and obtain any legally required consent.

6. RETENTION AND DELETION

6.1. Retention criteria. We retain personal information for as long as reasonably necessary for the disclosed purposes, considering account activity, transaction support, fraud prevention, applicable legal requirements, audit needs, dispute resolution, contractual commitments, data sensitivity and consumer rights. We do not promise a universal retention period across all data types.

6.2. Types of records. Shopping-session information, support tickets, diagnostic logs, authorization and purchase records, consent evidence, and security records may have different retention periods. Personal information is deleted, deidentified or otherwise disposed of when no longer needed for a lawful purpose, subject to permitted preservation requirements.

6.3. Provider-controlled material. Experian outputs, identity tokens and related information are retained only for the periods and purposes permitted by the relevant Experian agreement and law. The continued existence of a consumer account does not extend those rights.

6.4. Rights and exceptions. You may request deletion as described in Section 9. We may retain limited records where law or valid exceptions permit, including to complete a transaction, maintain security, prevent fraud, comply with legal duties, or document valid consent. Independent merchants and providers control their own copies.

7. COOKIES, TRACKING AND ADVERTISING CHOICES

7.1. Essential technologies. We may use session cookies or comparable technologies to maintain sign-in, remember choices, prevent fraud, deliver requested features and secure the Services.

7.2. Analytics and optional technologies. Where analytics, advertising pixels or similar technologies are enabled, their categories, providers, purposes and opt-out controls must be disclosed in a cookie or collection notice at the relevant interface. Nonessential technologies will be subject to any required consent or opt-out.

7.3. State opt-out signals. Where legally required for the applicable processing, we honor recognized opt-out preference signals, including qualifying browser-based signals, and provide an accessible method for exercising sale, sharing, or targeted-advertising choices. Please review any feature-specific privacy controls supplied at the point of collection.

7.4. Do Not Track. Because browser Do Not Track signals are not uniformly defined, any specific response to such signals will be described in the published cookie or privacy controls. This does not limit obligations concerning legally recognized opt-out preference signals.

8. SECURITY AND INTERNATIONAL PROCESSING

8.1. Safeguards. We maintain reasonable administrative, technical and organizational measures designed to protect personal information appropriate to the nature of the data and the risks involved. Such measures can include access controls, encryption where appropriate, logging, monitoring, vendor diligence and incident response. No service can guarantee absolute security.

8.2. Incident response. We investigate security incidents and provide legally required notifications and assistance. Please report suspected unauthorized access through the published security contact method.

8.3. Locations and personnel. Our services may involve cloud infrastructure and authorized personnel or providers located in the United States and other jurisdictions. If personal information is accessed or processed across borders, we apply applicable contractual, security and legal protections. We will not identify a specific provider region or assert data localization that has not been verified for the deployed system.

9. YOUR PRIVACY RIGHTS AND HOW TO EXERCISE THEM

9.1. Available rights. Depending on where you reside, the law and whether Agentous acts as controller or processor, you may have the right to confirm processing; access or obtain a copy; correct inaccurate information; request deletion; obtain portability; and opt out of qualifying sales, targeted advertising, certain profiling, or other regulated processing. Some states also provide rights concerning sensitive information, automated decision-making and information about disclosures.

9.2. How to request. Submit requests through the privacy contact method in Section 14 or the account privacy interface, if available. We will provide a suitable channel for legally protected requests without requiring creation of a new account when law prohibits that condition.

9.3. Authentication and representatives. We may reasonably verify your identity or the authority of an authorized agent before acting on a request. Verification will be proportionate to the sensitivity of the requested information. We will follow applicable rules regarding authorized agents, appeals and information required to explain a denial.

9.4. Timing and appeals. We respond within legally required periods, which vary by jurisdiction; for example, qualifying Texas requests generally require a response within 45 days, subject to permitted extension, and a separate appeal process. California and other states may impose additional or different timing and procedures. Where available, you may appeal a denial using the same privacy contact method and identifying the request you wish to appeal.

9.5. Non-discrimination. We will not unlawfully discriminate or retaliate against you for exercising legally protected privacy rights. Some Services may be unavailable if essential information or required authorization is withheld, but that does not permit unlawful discrimination.

9.6. Merchants and providers. If Agentous processes information solely for a merchant as its service provider, we may forward or direct your privacy request to the merchant. Independent commerce, payment and identity-verification providers (including Shopify, Stripe Identity and Experian) may act as separate controllers or businesses for information they process under their own notices; requests concerning their independent processing should be directed to them, subject to applicable law.

10. STATE-SPECIFIC NOTICES

10.1. California. For California residents, rights may include knowledge of categories and specific pieces of personal information, correction, deletion, portability, opting out of sale or sharing, limiting certain uses or disclosures of sensitive personal information, and non-discrimination, when applicable. California law may also require a notice at or before collection and disclosures concerning preceding 12-month practices. The published notice must accurately identify categories collected, sources, purposes, categories disclosed or sold/shared, retention practices, and the actual status of any sale, sharing or targeted-advertising technologies.

10.2. Texas. Where the Texas Data Privacy and Security Act applies, consumers may request access, correction, deletion and qualifying opt-outs, and appeal certain decisions. We will provide the legally required means of submission and appeal, and any required disclosures concerning sales of sensitive or biometric data if such sales occur. Not all businesses are subject to the statute in the same manner.

10.3. Other states. We honor applicable privacy laws in other U.S. states, including rights to opt out of certain sale, advertising or profiling activities and to appeal request denials where required. State-specific supplements or interfaces will be provided when necessary to accurately describe actual processing.

10.4. Consumer reporting and financial data. This Policy does not treat ordinary Merissa identity/fraud checks as consumer-credit eligibility decisions. Any separately regulated consumer report, financial product or other covered activity remains subject to its own applicable laws and notices.

11. AI PERSONALIZATION AND AUTOMATED PROCESSING

11.1. Recommendations and assistance. Merissa uses AI to interpret shopping instructions, present recommendations, compare options and assist with authorized transactions. These systems may use shopping preferences, conversation context and product or merchant data. Outputs can be inaccurate; consumers should review consequential transaction details.

11.2. Consequential actions. Purchases and payments are subject to transaction-specific authorization or valid standing authorization with applicable conditions and limits. General website use or identity verification consent does not grant authority to place unrestricted orders.

11.3. Profiling and rights. We assess fraud and transaction-security risks to protect the Services. We do not describe the ordinary verification integration as a decision regarding eligibility for credit, employment, insurance or housing. Where a covered automated decision process triggers legally required explanation, review, notice, consent or opt-out rights, we provide those protections.

12. CHILDREN AND THIRD-PARTY WEBSITES

12.1. Children. Merissa is intended for adults. If you believe a child provided personal information, contact us so that we can assess and address it. We will meet any applicable obligations under laws protecting children’s information.

12.2. External services. Merchant websites, embedded checkout, authentication screens and other external services may operate under separate terms and privacy policies. We encourage you to review those notices before supplying information directly to the provider.

13. CHANGES TO THIS POLICY

13.1. Updates. We may update this Policy as features, providers, laws and practices change. We will change the “Last updated” date and give additional notice or obtain new consent when required by law. We will not use an updated privacy policy alone to retroactively authorize a transaction or disclosure for which a separate authorization was required.

13.2. Material new uses. Before materially changing how we use previously collected information in circumstances requiring consent or other legal action, we will provide the required notice and choice. Experian-enabled processing remains subject to approved disclosures and the governing provider arrangement.

14. CONTACT AND PRIVACY REQUESTS

14.1. Operator. Agentous, Inc., 1452 Hughes Rd Ste 200, Grapevine, TX 76051, United States.

14.2. Privacy contact. Privacy questions, consumer data rights requests, appeals, and other inquiries under this Policy may be sent to legal@agentous.ai. Additional request methods or state-specific links will be offered where required by applicable law.

14.3. Security contact. To report suspected security incidents or unauthorized access, email legal@agentous.ai.

14.4. Provider notices. Where identity-verification providers, including Experian and Stripe Identity, require additional privacy disclosures or terms, we will present or link the applicable provider notices in the relevant verification experience.