WholesaleAI Privacy Policy

Last updated: 14 July 2026

This policy explains how WholesaleAI processes personal information through the WholesaleAI Shopify app, wholesaleai.app, and related services. WholesaleAI is operated by Realtime Comms Ltd, a company incorporated in England and Wales ("Realtime Comms", "we", "us" or "our").

1. Our role

Shopify merchants use WholesaleAI to research potential wholesale buyers, verify business contact details, prepare outreach, receive wholesale applications, approve buyers, and attribute wholesale activity. For personal information processed on a merchant's instructions, the merchant is normally the data controller and Realtime Comms acts as its data processor. Merchants decide who to contact, whether to send a message, and whether to approve an applicant.

Realtime Comms is a controller for information needed to operate and secure our service, administer merchant relationships, provide support, meet legal obligations, and respond to privacy requests concerning our own activities.

2. Information we process

Depending on how the service is used, we may process:

• Merchant and store information: Shopify shop domain, authenticated session information, store and product information, plan status, wholesale settings, target buyer categories and regions, sending-domain settings, and support communications.
• Prospect information: business names, websites, domains, business categories, locations, publicly listed business contact details, contact-verification results, fit assessments, outreach drafts, sending history, interactions, and opt-out status.
• Wholesale applicant information: company and contact name, email address, phone number, website, application message, and application or approval status.
• Approved buyer and order information: Shopify customer identifiers, relevant contact details, wholesale discount information, order identifiers, order values, currency, and dates needed to attribute wholesale activity.
• Technical and security information: request and event timestamps, hashed rate-limit identifiers, operational logs, webhook events, error details, and other information needed to keep the service secure and reliable.

We do not intentionally collect special category information through WholesaleAI, and merchants should not submit it to the service.

3. Where information comes from

Information may come from:

• the merchant and its Shopify store;
• wholesale applicants who submit a merchant's application form;
• publicly accessible business websites, Google Maps results, business directories, and other public web sources;
• contact discovery, research, enrichment, and verification providers; and
• communications and activity within WholesaleAI.

4. How we use information

We process information to:

• provide, maintain, secure, and improve WholesaleAI;
• read a merchant's store and configure its wholesale programme;
• find relevant business prospects and verify publicly available business contact details;
• assess prospect relevance and prepare personalised outreach for the merchant to review;
• send communications only after the merchant approves them, maintain suppression records, and prevent further outreach after an opt-out;
• process wholesale applications, create or identify approved Shopify customers, and apply the merchant's wholesale pricing;
• attribute and report wholesale activity to the merchant;
• provide support, prevent abuse, and troubleshoot errors; and
• comply with legal obligations and enforce our terms.

We do not sell personal information.

5. Lawful bases

Where Realtime Comms acts as a controller, our lawful bases under UK data protection law may include:

• Contract: processing needed to provide the service a merchant has requested.
• Legitimate interests: operating and securing the service, supporting merchants, preventing abuse, and facilitating relevant business-to-business communications with limited privacy impact. We consider the necessity and impact of this processing and the rights of affected individuals.
• Legal obligation: processing needed to comply with applicable law, regulatory requests, or valid legal process.
• Consent: where consent is requested for a particular activity. Consent can be withdrawn at any time.

When we act as a processor, the relevant merchant is responsible for selecting and documenting its lawful basis, including for prospecting and direct marketing.

6. Outreach and your right to object

WholesaleAI is designed for targeted business-to-business outreach, not indiscriminate or high-volume messaging. A merchant must review and approve each initial message before it is sent. Outreach emails include an opt-out mechanism. If a recipient opts out, WholesaleAI records a suppression so the merchant cannot contact that address again through the service.

You have an absolute right to object to the use of your personal information for direct marketing. Use the opt-out link in an email or contact us at the address below. The merchant sending the communication remains responsible for complying with applicable marketing and data protection laws.

7. Automated assistance and merchant review

WholesaleAI uses automated tools to suggest buyer categories, assess prospect relevance, verify contact details, and draft outreach. These tools support the merchant's decisions. WholesaleAI does not make a solely automated decision that produces a legal or similarly significant effect on a prospect or applicant: the merchant reviews outreach and decides whether to approve an applicant.

8. Service providers and disclosures

We disclose information only as needed to operate WholesaleAI, follow a merchant's instructions, comply with law, protect the service, or complete a corporate transaction subject to appropriate safeguards. Providers used by the service may include:

• Shopify for app authentication and store services;
• Apify and web-research services for business prospect discovery;
• OpenAI and other AI service providers for store analysis, relevance assessment, and message drafting;
• MillionVerifier, BounceBan, and AnyMailFinder for business contact discovery and verification;
• Resend and Microsoft Azure Communication Services for transactional and merchant-approved email delivery;
• Cloudflare for domain and network services; and
• infrastructure, database, security, and professional advisers where reasonably necessary.

Each provider receives only the information reasonably needed for its function and processes it under its applicable contractual terms.

9. International transfers

Some providers may process information outside the United Kingdom. When required, we use appropriate safeguards for restricted transfers, such as an applicable adequacy regulation, the UK International Data Transfer Agreement, or the UK Addendum to approved standard contractual clauses. You can contact us for further information about safeguards relevant to your information.

10. Retention and deletion

WholesaleAI automatically deletes short-lived abuse-control records after one day and completed discovery-run state after 30 days. Rejected applications and prospects marked lost are deleted after 180 days. Sending records, completed job records and security audit events are deleted after one year. Active CRM records, applications, outreach drafts, interactions and attributed order records are deleted after two years without a continuing operational need.

Shopify's mandatory privacy webhooks are used to process customer and shop deletion requests. Encrypted backups expire after 30 days, so deleted records may remain in a restricted backup until that backup expires. Minimal suppression records are retained for as long as necessary to honour an opt-out and prevent renewed contact. We may keep a record longer where law, a dispute, fraud prevention or an active merchant instruction requires it.

11. Security

We use measures designed to protect information, including encryption in transit and at rest, encrypted backups, separate production and development databases, least-privilege access, authenticated Shopify requests and webhooks, rate limiting, access audit events and restricted operational access. No system is completely secure, but we review and improve these measures as the service develops.

12. Your data protection rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict, or receive a copy of your personal information; object to processing; and withdraw consent. Where a merchant controls the information, we may refer your request to that merchant and assist it in responding.

To exercise a right, email us at the address below. We may need to verify your identity and ask for information that helps us locate the relevant merchant or record.

13. Children

WholesaleAI is a business service and is not directed to children. We do not knowingly collect personal information from children through the service.

14. Cookies

WholesaleAI uses only cookies or similar technologies needed for authentication, security, and core service operation. We do not use the service to serve behavioural advertising. Shopify and other providers may use essential technologies under their own notices.

15. Complaints

Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, or to another competent supervisory authority where applicable.

16. Changes to this policy

We may update this policy as WholesaleAI, our providers, or legal requirements change. We will publish the revised version here and update the date above. We will provide additional notice where a material change requires it.

17. Contact us

Realtime Comms Ltd
Incorporated in England and Wales
Email: support@realtimecomms.co.uk