Privacy Policy

1. Introduction

WeScale ("Company," "we," "us," or "our") operates WeScale.ai ("Service"), a web-based tool for print-on-demand store owners to import designs, generate product mockups, publish products, connect Shopify, Meta, Klaviyo, and Printify accounts, and view business-performance information in one dashboard.

This Privacy Policy explains what personal data and connected-business data we collect, how we use and retain it, who we disclose it to, and what rights and choices may be available to you. It applies when you use the Service or connect a supported platform account.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Shopify Store Data Accessed Through the Admin API

When you connect a Shopify store to WeScale, our application accesses data through the Shopify Admin API to perform the operations you initiate, populate and update your dashboard, and maintain authorized historical business information. The categories of data we read, write, or retain are summarized below.

WeScale has Shopify Protected Customer Data Level 2 permission because Shopify places certain aggregate reporting capabilities within that permission. Shopify may make customer-level fields, such as names, email addresses, shipping addresses, and phone numbers, technically available while our systems run an authorized aggregate query. Our code is designed to select and retain only the aggregate results needed for the dashboard, not those customer fields or individual customer records. We do not use Shopify customer-level information for another purpose, and we do not process payment-card information. We maintain an access log for API calls that can reach Shopify protected customer data.

When you disconnect your Shopify store in Settings, we revoke or delete the relevant credentials and keep the Shopify-derived data already collected for 30 days, so that reconnecting the store within that period restores its history; we then delete it. When you uninstall the WeScale Shopify app, or when you or Shopify sends us an applicable store or customer erasure request, we revoke or delete the relevant credentials and delete the Shopify-derived data covered by the uninstall or request within 30 days, in accordance with Shopify's requirements and our deletion procedures. Residual copies may remain temporarily in backups until they are overwritten under our backup schedule, unless applicable law requires otherwise.

2.3 Marketing analytics integration (Klaviyo)

When you connect the optional Klaviyo integration from your Settings page, WeScale processes the credential that authorizes the connection and retains the attributed revenue, campaign, flow, message, content, and aggregate performance information described in Section 6.3. The connection is authorized in one of two ways:

• Connect with Klaviyo — you approve WeScale's access in Klaviyo's authorization (OAuth) flow, and the access credentials Klaviyo issues are stored encrypted in our vault. New connections use this method.
• Private API key — connections made before Connect with Klaviyo was available use a private API key you pasted (starting with pk_ ); those connections keep working, and the key is stored encrypted in our vault.

The decrypted credential is used only as needed to communicate with Klaviyo and is not written to our application database in plaintext. You can revoke access by disconnecting the integration in Settings. See Section 6.3 for a detailed breakdown of Klaviyo data.

2.4 Connected Business Data

When you connect Shopify, Printify, Meta, Klaviyo, or another supported integration, WeScale may copy authorized store, product, design, aggregate sales, production-cost, advertising, and email-marketing information to our systems. We retain this connected-business data to maintain historical records, provide a unified dashboard, and support the in-app recommendations, coaching, and analysis described in Section 3. If an API response contains shopper-level fields that are not needed for these purposes, our systems are designed to filter or discard those fields rather than store them. Aggregate and business records retained by WeScale are distinct from customer-level information that may be handled transiently while an authorized request is processed.

Shopify. We collect product catalog information, product relationships and color swatches, aggregate daily sales and best-selling-product results, copies of product images, dated product-variant and pricing history, product options, aggregate traffic funnels and session breakdowns, and Shopify marketing-event results. We do not retain Shopify customer profiles or order-level records.

Meta. We collect ad-account details; campaign, ad-set, and ad names, identifiers, and settings; daily account- and ad-level performance; budgets, schedules, bidding, placements, and targeting configurations; ad text, images, video thumbnails, carousel content, boosted-post references, and copies of media files; additional performance and attribution-window metrics; aggregate demographic, geographic, placement, and device breakdowns; tracking-pixel names and identifiers; and historical creative and settings versions. We do not collect individual ad viewers or the member’s custom or lookalike audiences.

Klaviyo. We retain daily attributed revenue and order counts; campaign and automated-flow names, status, send times, and audience settings; per-message delivery and performance metrics; email subject lines, preview text, sender names, bodies and images, including copies of image files; dated versions of editable flow messages; list and segment names and counts over time; sign-up-form results; daily aggregate product-view, cart, and checkout events; and aggregate SMS and push revenue. We do not retain subscriber profiles, individual list membership, or Klaviyo attributed-order records containing shopper details.

Printify. We collect shop and production-catalog information, provider price lists, exact product and variant identifiers, design placement data, generated product images, uploaded artwork, and permitted order-business fields such as order identifier, dates (including shipped and delivered dates), status, carrier name, production and shipping costs, taxes, items, quantities, and destination country or region. Printify may transmit recipient names, email addresses, phone numbers, and street addresses in an order payload; our systems are designed to remove those fields before storage and retain only the permitted business fields.

Created within WeScale. We retain uploaded designs, generated product photos, design-processing history, pricing and layout preferences, targets and brand settings, and the connection map among each design, Printify product, and Shopify product.

2.5 Information Collected Automatically

When you use the Service, we collect certain technical information needed to operate and secure it. Where required by applicable law, non-essential analytics and session-recording tools begin only after you provide separate affirmative consent as described in Sections 5.3 and 8.4:

• Device and browser information — Browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage data — Pages visited, features used, actions taken within the Service, import activity, and interaction patterns. With your analytics consent, when an AI assistant uses WeScale through our API, we record the tools it used, its request, and our response.
• Log data — IP address, access timestamps, referring URLs, page URLs, and HTTP request metadata.
• Performance data — Page load times, error rates, and application performance metrics.
• Approximate location — General geographic location derived from your IP address (city/region level, not precise GPS coordinates).
• Session recordings — Session recording means a tool that captures a replay of clicks, scrolls, and page navigation within the WeScale application—not your connected stores—to diagnose bugs and improve the user experience. Where required by applicable law, recording begins only after you provide separate affirmative consent. All form entries and elements reasonably likely to contain credentials, access tokens, payment information, customer information, message content, or sensitive dashboard information are masked or excluded in the browser before recording data is sent. You can withdraw consent using the controls described in Sections 5.3 and 8.4.

2.6 Information We Do NOT Collect

• Passwords — We use passwordless authentication with a one-time sign-in code sent to your email; no passwords are ever stored.
• Payment or financial information — We do not process payments through the Service.
• Precise geolocation — We do not use GPS or fine-grained location tracking.
• Contact lists or address books — We do not access contacts from your email or device.

3. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service — Authenticate you, import your designs, create products, generate mockups, and publish to your connected platforms.
• Store and secure your credentials — Encrypt and manage your third-party API tokens so you can connect your print-on-demand and e-commerce accounts.
• Process and transform your images — Convert file formats, resize, compress, and composite images as part of the design import and mockup generation workflows.
• Maintain your preferences — Save your product presets, design placements, shop defaults, and UI preferences.
• Analyze and improve the Service — Understand how the Service is used, identify trends, measure feature adoption, diagnose errors, and improve performance and reliability.
• Communicate with you — Send you one-time sign-in codes and, when necessary, important service-related notices.
• Ensure security — Detect and prevent fraud, abuse, and unauthorized access.
• Generate aggregate insights — Compile anonymized, aggregate usage metrics for internal analysis and product decisions.
• Operate our ChatPOD platform – Analyze your shop data to provide recommendations, evaluation, and analytics based on your current performance and history; detect when you appear to be struggling and proactively recommend future actions.

We do not use your information for advertising, behavioral profiling, or selling to third parties.

4. How We Store and Protect Your Data

4.1 Credential Security

Third-party API tokens are encrypted before storage. Our application database is designed not to store plaintext tokens, and a database-level constraint supports that control. The application is designed not to persist the decrypted value.

4.2 Access Control

Database tables containing user data use Row-Level Security (RLS) policies intended to limit each user to data associated with that user's account.

4.3 Authentication Security

• Sign-in codes have six digits, are single-use, and expire after one hour.
• Session tokens are stored in browser cookies and checked on our servers on every request.
• Sessions are automatically validated on every request.

4.4 File Storage

Your design files and generated mockups are stored on encrypted, S3-compatible object storage and served over HTTPS through a CDN. Temporary files (such as ZIP downloads) are automatically deleted after 24 hours.

4.5 Infrastructure

The Service is hosted on infrastructure configured to use HTTPS and TLS for data in transit. We also use access controls, logging, encryption, and other administrative, technical, and organizational safeguards appropriate to the nature of the information and the risks involved. No system or transmission method is completely secure. We maintain an incident-response process to investigate suspected security incidents, contain and remediate confirmed incidents, document response steps, and provide notices to affected users, platforms, or authorities when required by applicable law or binding platform requirements.

4.6 Per-store Isolation

Per-store isolation of data is the default. Each seller’s store data belongs to and is visible to that seller, and we do not make one merchant’s identifiable store, customer, revenue, order, product, design, advertising, email-marketing, or coaching-interaction data available to another merchant.

5. Cookies and Similar Technologies

5.1 What Are Cookies

Cookies are small data files stored on your device when you visit a website. We use cookies and similar technologies to operate the Service and understand how it is used.

5.2 Types of Cookies We Use

5.3 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can configure your browser to refuse non-essential cookies. However, disabling essential cookies may prevent you from using the Service.

We do not use advertising or cross-site tracking cookies.

Non-essential analytics and session-recording tools are off by default. Where applicable law requires consent, they begin only after you make a separate affirmative choice through our consent control, which allows you to accept or decline and links to this Privacy Policy. General acceptance of the Terms of Service or this Privacy Policy, account creation, or continued use of the Service does not by itself provide that consent. You can withdraw consent through the in-product privacy or consent control or by contacting us; withdrawal stops future non-essential collection but does not affect processing that occurred before withdrawal. Until the required consent is provided, we do not load the non-essential analytics or session-recording provider. We may retain records of consent and withdrawal where reasonably appropriate to administer your choice and demonstrate compliance.

5.4 Global Privacy Control and Do Not Track

Some browsers and extensions send Global Privacy Control (GPC) or "Do Not Track" (DNT) signals. Where applicable law requires us to treat GPC as a request to opt out of a sale, sharing, or targeted-advertising use, we will apply it to the browser or device and, when reasonably identifiable, the associated account. The Service does not currently sell personal data, share it for cross-context behavioral advertising, or use it for targeted advertising, so a GPC signal does not replace the separate opt-in control for analytics and session recordings. We do not otherwise respond to DNT signals. You can manage non-essential analytics and recordings through the consent control described in Sections 5.3 and 8.4.

6. Third-Party Services and Data Sharing

We work with third-party service providers to operate, maintain, and improve the Service. We do not sell, rent, or trade your personal data to anyone.

6.1 Categories of Service Providers

We disclose data to the following categories of service providers, subprocessors, and user-directed integration recipients. We seek to limit each recipient to information reasonably necessary for its function and, when the recipient processes data for WeScale, use contractual confidentiality, security, data-processing, and international-transfer terms appropriate to the service and applicable law. You may request current information about our material subprocessors by contacting support@wescale.ai :

• Infrastructure and hosting providers — Host the Service, store application data, manage authentication, and encrypt sensitive credentials. These providers have access to all data necessary to run the Service, including account information, encrypted tokens, and session data.
• Cloud storage providers — Store design files, product and mockup images, generated composites, permitted copies of ad and email media, historical content versions, and temporary file downloads. We configure storage controls intended to protect files at rest and in transit.
• Print-on-demand platforms — When you connect your account and initiate product creation, we transmit your design image URLs, product titles, descriptions, tags, and variant configurations to the platform to create products on your behalf.
• E-commerce platforms — When you connect your store and initiate publishing, we transmit mockup image URLs, product variant assignments, and metadata to publish products and media to your store.
• File import services — When you import designs from external file storage services, we send file identifiers to retrieve your files. We access these services in read-only mode.
• Background job orchestration providers — Process long-running tasks (imports, mockup generation, publishing) asynchronously. These providers receive the information each task needs, such as record identifiers, links to the images being processed, file names, product titles and descriptions, and the store's web address. They never receive API tokens.
• Error monitoring and performance providers — After any separate affirmative consent required by applicable law, receive error reports and performance traces to help us diagnose bugs and improve reliability. They receive no session recordings. Depending on the tool and event, these providers may receive request metadata such as IP addresses, page URLs, and browser information.
• Analytics providers — Collect usage data associated with your account to help us understand how the Service is used, measure feature adoption, and identify areas for improvement. Analytics are collected only after you provide consent (see Section 8.4). Session recordings come only from our analytics provider, after that consent, with form entries and sensitive fields masked or excluded as described in Section 2.5.
• Customer support and in-app guidance providers — Provide in-app support and product guidance. These providers receive your name, email address, plan, signup date, and the messages you send to our support team.
• AI, data-layer, and model-operations providers — Provide infrastructure, data processing, retrieval, evaluation, recommendation, and model-operation support for ChatPOD and related in-app features. These providers may process account, store, order, revenue, refund, product, design, advertising, email-marketing, coaching-interaction, usage, log, and performance data as service providers or processors acting on WeScale’s instructions, and may not use member data to train their own foundation models unless WeScale has disclosed and obtained any consent or opt-out required by applicable law.
• AI image-processing providers — Process the design images you upload or work on in the Service. These providers receive the design images being processed.
• Internal communication tools — Receive aggregate usage statistics for internal team awareness. No individual user data or personally identifiable information is included.

6.2 Platform Integrations (User-Directed)

Certain data sharing occurs only when you explicitly connect a third-party account and initiate an action:

• Print-on-demand product creation — Your design images and product configurations are sent to the connected platform.
• E-commerce publishing — Your mockup images and product data are sent to the connected store.
• File imports — File identifiers are sent to the connected storage service to retrieve your files.

You can disconnect any third-party integration at any time through the Settings page, which immediately revokes the Service's access. Data already collected from that platform is kept for 30 days, so that reconnecting restores your history, and is then deleted as described in Section 7.

6.3 Marketing analytics integration (Klaviyo)

WeScale integrates with Klaviyo as an optional marketing analytics platform. You must explicitly authorize the connection through the Settings page before any data is retrieved.

You can disconnect this integration at any time through Settings, which revokes WeScale's stored credential and stops future retrieval. We delete retained Klaviyo-derived data associated with the connection in accordance with Section 7, subject to limited legal, security, and backup exceptions.

6.4 Advertising analytics integration (Meta Ads)

WeScale integrates with Meta's Marketing API to surface ad performance inside the dashboard. The connection is authorized through Meta's business login — you click Connect with Meta in Settings, are redirected to Facebook to grant read access to your ad accounts, and are returned to WeScale with an access token that we store encrypted in our vault. The access token stays valid until you disconnect the integration or remove WeScale from your Facebook app settings. WeScale never creates, edits, pauses, or otherwise modifies your ads, audiences, pixels, or business settings.

You can disconnect this integration through Settings, which revokes WeScale's stored access token and stops future retrieval. You can also remove WeScale from your Facebook app settings. When Meta notifies our signed deletion webhook, we will delete the Meta-derived data associated with that connection—including the token, account binding, Meta user identifier, settings, creative content and media copies, metrics, and historical versions—within 30 days. Your WeScale account and other connected integrations remain intact. The status of a Meta deletion request is available through our data-deletion status page.

6.5 Legal and Safety Disclosures

We may disclose information in response to a subpoena, court order, search warrant, regulatory demand, or other governmental or legal request when we reasonably believe disclosure is required or permitted by applicable law. Where appropriate and legally permitted, we review the request's validity and scope, seek clarification or challenge overbroad demands, disclose only information reasonably necessary to respond, document the request and response, and notify the affected user. We may also disclose information to investigate or prevent fraud, abuse, security incidents, or threats to the rights, property, or safety of WeScale, our users, or others; establish or defend legal claims; or enforce our agreements.

6.6 Business Transfers

If WeScale is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your data.

7. Data Retention

Platform-specific retention. The same rule applies to data from Shopify, Meta, Klaviyo, and Printify. When you disconnect a platform, we keep the data already collected from it for 30 days, so that reconnecting within that period restores your history, and then delete it. When you uninstall or remove WeScale from a platform, or when you or the platform asks us to delete the data, we delete the platform-derived data covered by that uninstall or request within 30 days. WeScale-created records, including artwork, product media, settings, and historical versions, are retained until you delete them or your account. We may keep limited information longer when reasonably necessary for legal obligations, disputes, fraud prevention, security, or enforcement. Residual copies may remain in routine backups until overwritten under the backup schedule and are not restored for ordinary product use.

8. Your Rights

Depending on your jurisdiction (including under the GDPR, CCPA/CPRA, LGPD, and other applicable privacy laws), you may have the following rights:

8.1 Access and Portability

You can access your data at any time through the Service interface. Your design assets can be downloaded individually or in bulk. Your import history and product records are viewable through the History page. You may request a copy of your personal data by contacting us.

8.2 Correction

You can update your display name and profile picture in Settings → My Account. For other corrections, contact us at support@wescale.ai .

8.3 Deletion

You can delete individual assets, presets, mockup packs, and connected credentials through the Service. You can request deletion of your account and covered associated data in Settings → My Account. Account deletion removes data from active systems within 30 days, as described in Section 7, subject to applicable legal, security, platform, and backup exceptions, including:

• All design files from our storage
• All generated mockup files
• All encrypted API tokens and credentials
• Your profile, import history, connected-platform business data, historical versions, and associated active-system records
• Your authentication identity

Account deletion is irreversible. Products already created on third-party platforms are not affected and must be managed on those platforms directly. Subject to applicable law and platform requirements, we may retain aggregated or de-identified information about your use of the Service that can no longer reasonably be linked to you, your store, or your customers, for internal analytics and service improvement. This retention statement never covers data retrieved from a connected platform, which is deleted as described in Sections 2.2 and 7. Records of your acceptance of the Terms of Service and of your analytics and session-recording consent choices are kept after account deletion for as long as needed to resolve disputes.

8.4 Analytics Consent and Opt-Out

Non-essential product analytics and session recordings are governed by the separate consent control described in Sections 2.5 and 5.3. Where applicable law requires consent, they begin only after a separate affirmative choice; declining does not affect access to Service features. You may withdraw through the in-product privacy or consent control or by contacting support@wescale.ai, which stops future non-essential analytics and recordings.

8.5 Objection and Restriction

You may object to certain data processing activities or request that we restrict how your data is used. Contact us at support@wescale.ai .

8.6 Non-Discrimination

Where applicable law provides a non-discrimination right, we will not unlawfully discriminate against you for exercising that right.

8.7 Exercising Your Rights

To exercise any of these rights, you can:

• Use the self-service features within the Service (delete assets, delete account, manage preferences).
• Contact us at support@wescale.ai .

We may take reasonable steps to verify your identity, authority, and the scope of your request. We generally respond to verified requests within 30 days, or within another period required by applicable law, and will explain any permitted extension or denial and available appeal process. After validating a deletion request, we delete covered information from active systems within the period required by applicable law and our platform obligations, subject to lawful legal, security, backup, fraud-prevention, and other exceptions. Authorized agents may submit requests where permitted by law, subject to proof of authority and verification requirements.

9. International Data Transfers

WeScale is based in the United States, and we and our service providers or subprocessors may process information in the United States and other countries that may have data-protection laws different from those where you live. We do not rely solely on your use of the Service as the legal basis for a restricted international transfer.

Where required, we use a recognized transfer mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another lawful mechanism, and apply supplementary measures when appropriate. You may contact support@wescale.ai to request more information about the transfer safeguards relevant to your personal data.

10. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@wescale.ai and we will promptly delete it.

11. U.S. State Privacy Rights

Depending on your state of residence, U.S. state privacy laws—including the CCPA/CPRA, the Florida Digital Bill of Rights (FDBR), and similar laws—may provide additional rights concerning personal information we process as a business or controller, but only when the relevant law applies to WeScale and the processing. For Florida residents, the rights below apply only if the FDBR or another applicable state privacy law covers WeScale and the relevant processing, including satisfaction of any statutory thresholds, and remain subject to the law's scope limits, exemptions, and exceptions:

• Access and Know — Where applicable, you may request confirmation of processing and access to personal information, including categories, sources, purposes, recipients, and specific pieces where required.
• Delete, Correct, and Port — Where applicable, you may request deletion or correction of covered personal information and a portable copy, subject to statutory scope limits and legal exceptions.
• Opt Out and Consent Choices — Where applicable, you may opt out of sale, sharing, targeted advertising, or qualifying profiling and may limit or withdraw consent for sensitive-data processing. We do not currently sell personal information, share it for cross-context behavioral advertising, or process it for targeted advertising. We honor GPC only to the extent described in Section 5.4.
• Non-Discrimination and Appeal — Where applicable, we will not unlawfully discriminate against you for exercising an applicable privacy right, and you may appeal our decision on a request by replying to our response or emailing support@wescale.ai with "Privacy Appeal" in the subject line.

To exercise any of these rights that applies to you, use available self-service controls or contact support@wescale.ai and describe the right you wish to exercise. We may verify your identity and, where permitted, accept requests from authorized agents as described in Section 8.7.

12. European Economic Area and UK (GDPR)

If you are in the EEA or UK and WeScale acts as controller of your personal data, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, withdraw consent without affecting earlier lawful processing, and complain to a supervisory authority. These rights are subject to applicable conditions and exceptions. When WeScale processes personal data on a merchant's instructions, the merchant may be the controller and WeScale may be its processor; we may refer your request to that merchant where appropriate.

12.1 Legal Bases for Processing

12.2 Data protection contact and representatives

Send data-protection inquiries and requests to support@wescale.ai. Where Article 27 of the EU GDPR or UK GDPR requires WeScale to appoint a representative, we will make the representative's current identity and contact details available in the Service and on request. This contact is not described as a formal Data Protection Officer unless WeScale makes that appointment.

12.3 Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority.

13. Brazilian Users (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including the right to access, correct, delete, and port your data. To exercise your LGPD rights, contact us at support@wescale.ai .

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the Service and update the "Last Updated" date at the top. Your continued use of the Service after the effective date of the updated policy constitutes acceptance of the changes, but acceptance of the Terms of Service or this Privacy Policy does not by itself provide consent to non-essential analytics or session recordings.

15. Contact Us

For questions, complaints, consent withdrawal, integration-deletion requests, data-rights requests, or privacy appeals, contact us using the email below. Please describe your request, the account email and relevant platform connection, the jurisdiction whose rights you are invoking if known, and whether you are acting for another person. Do not send passwords, access tokens, payment information, or other unnecessary sensitive information. We may request additional information to verify identity or authority and will use it only to process and document the request.

WeScale Privacy Requests: support@wescale.ai. Use "Privacy Request" or "Privacy Appeal" in the subject line, as applicable. If your request concerns Shopify, Meta, Klaviyo, or Printify data, identify that platform so we can route the request under the applicable platform process.