Privacy Policy

1. Introduction

Laminir ("we," "our," or "us") provides weekly commercial intelligence software for retail executive teams. Our platform ingests trading data, inventory position, and go-to-market context to deliver structured decision-ready briefs to retail leadership. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our platform at laminir.com (the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, do not use the Service.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly when you:

• Enquire about the Service (name, work email, company name, revenue band, phone number where supplied)
• Create an account (name, email address, company name, business size, retail category)
• Subscribe to a paid plan (billing information processed by our payment provider)
• Upload business data (sales forecasts, GTM activation calendars, weekly trading metrics)
• Configure your retailer profile (strategic anchors, margin targets, supplier lead times, brief recipients)
• Contact us for support

2.2 Business Data

The Service is designed to analyse your retail operational data. This includes:

• Sales performance, margin and refund data, uploaded by you or pulled from your connected Shopify store via API
• Product and inventory data, uploaded by you or pulled from your connected Shopify store via API
• Weekly sales forecasts and targets uploaded via template
• GTM activation calendar data uploaded via template
• Strategic goals and commercial priorities you define during setup
• Decisions recorded in the Service, including approvals, deferrals, overrides and the notes attached to them

This data is provided by you or accessed via your authorised integration, and is processed solely to generate intelligence outputs for your business.

2.3 Third-Party Integration Data

When you connect a third-party platform such as Shopify, we access data from that platform on your behalf using OAuth authorisation. We only access the data scopes required to provide the Service. You can revoke this access at any time through your connected platform's settings.

2.4 Automatically Collected Information

When you access the Service, we automatically collect:

• Device information (browser type, operating system, IP address)
• Usage data (pages viewed, features used, time spent)
• Cookies and similar technologies
• Log data (access times, error logs)

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process your business data and generate commercial intelligence briefs and agent outputs
• Deliver briefs and notifications to the recipients you nominate
• Process payments and prevent fraud
• Send you service updates, security alerts, and support messages
• Respond to your comments, questions, and support requests
• Monitor and analyse usage patterns to improve the platform
• Comply with legal obligations

We do not sell your personal information or business data to third parties.

4. AI Processing and Data Usage

Laminir uses artificial intelligence to analyse your business data and generate commercial intelligence outputs. Your data is processed by our automation and application infrastructure, and by third-party AI providers under terms that prohibit the use of your data to train their models.

Important: Your business data is used solely to provide intelligence services to you. We do not use your data to train AI models, and we do not use one customer's data to produce outputs for another. Access to customer data within our systems is restricted and controlled.

5. How We Share Your Information

We share your information only in the circumstances described below.

5.1 Sub-processors

We engage third-party providers to deliver the Service. Each is bound by contractual obligations to process data only on our instructions and to maintain appropriate security. We engage sub-processors in the following categories:

• Cloud hosting and application infrastructure — running the platform and serving the application
• Authentication and identity management — account creation, sign-in and session management
• Database and structured data storage — storing your trading data, briefs and configuration
• Workflow automation — moving data between systems and running the weekly intelligence pipeline
• AI and language model providers — generating commentary and agent outputs from your data
• Transactional email delivery — sending briefs, notifications and service messages
• Payment processing — subscription billing (we do not store card details)
• Connected commerce platforms — platforms such as Shopify from which we access your authorised data via API

A current list of named sub-processors, including their location and function, is available on request from privacy@laminir.com. We will provide reasonable notice of any change to our sub-processors that materially affects the processing of your data.

5.2 Legal Requirements

We may disclose information if required by law or in response to valid requests by public authorities.

5.3 Business Transfers

If Laminir is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

6. Data Security

We implement appropriate technical and organisational measures to protect your information:

• Data encrypted in transit (TLS) and at rest by our infrastructure providers
• Authentication using industry-standard protocols
• Access to customer data restricted to personnel who require it to deliver the Service
• Regular review of access and system configuration

However, no method of transmission over the Internet or electronic storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: retained while your account is active
• Business data and briefs: retained for the duration of your subscription plus 30 days
• Enquiry data: retained for up to 24 months from your last contact with us
• Backup data: deleted within 90 days of account closure
• Legal and compliance data: retained as required by law (typically seven years for financial records)

Upon account deletion, we will delete or anonymise your personal information within 30 days, except where retention is required by law.

8. Your Rights and Choices

Depending on your location, you may have the following rights:

8.1 Access and Portability

You can access and export your data — including all historical briefs — through the platform or by contacting us.

8.2 Correction

You can update your account information at any time through your account settings, or by contacting us.

8.3 Deletion

You can request deletion of your account and data by contacting privacy@laminir.com.

8.4 Revoke Integration Access

You can revoke Laminir's access to any connected third-party platform (including Shopify) at any time through that platform's settings. Revoking access will affect our ability to pull trading data automatically.

8.5 Opt-Out

You can opt out of marketing communications by following the unsubscribe link in any such email, or by contacting us. Service messages relating to your account and briefs are not marketing communications.

8.6 Do Not Sell

We do not sell personal information. If you are a California resident, you have the right to opt out of the sale of personal information — this right does not apply to us as we do not engage in such sales.

9. Cookies and Tracking

We use cookies and similar technologies to:

• Keep you signed in
• Remember your preferences, including whether you have completed our enquiry form
• Understand how you use the Service
• Improve performance and security

You can control cookies through your browser settings. Disabling cookies may affect your ability to use certain features of the Service.

10. Where Your Data Is Processed

Laminir operates from Australia. Your information is stored and processed in the United States, where our cloud hosting, database, workflow automation, AI and email delivery providers operate. Depending on the provider, data may also be processed in other jurisdictions in which that provider operates.

If you are located in Australia, this constitutes a disclosure of personal information to overseas recipients for the purposes of Australian Privacy Principle 8. By using the Service, you acknowledge this disclosure. We take reasonable steps to ensure our sub-processors handle personal information in a manner consistent with the Australian Privacy Principles, but overseas recipients may not be subject to equivalent privacy laws, and you may not be able to seek redress under Australian law against them.

For transfers of personal data out of the European Economic Area or United Kingdom, we rely on the transfer mechanisms offered by our sub-processors, including Standard Contractual Clauses where applicable. Details are available on request.

11. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

14. Additional Rights by Jurisdiction

14.1 Australian Users

Under the Australian Privacy Principles, you have the right to access and correct your personal information, and to complain about privacy breaches to the Office of the Australian Information Commissioner at oaic.gov.au. Please raise any concern with us first so we can attempt to resolve it.

14.2 European Economic Area and United Kingdom Users

Under the GDPR and UK GDPR, you have additional rights including access, rectification, erasure, restriction of processing, data portability, objection to processing, and the right to lodge a complaint with a supervisory authority.

14.3 California Residents

Under the CCPA, you have the right to request disclosure of the information we collect and how we use it, and the right to request deletion of your personal information.