1. Who we are and what this covers
Winni is a business software service developed by Winni AI LLC, a Wyoming limited liability company. This draft describes the intended handling of personal information on the Winni website and through its business messaging service. Winni is in development; only features enabled for a participating merchant apply. The final effective date and privacy contact must be confirmed before launch.
2. Merchants and their customers
For merchant account, business relationship, and website contact information, Winni determines how information is used for its own operations. For customer conversations and connected merchant records, Winni generally processes information on the merchant’s instructions. The merchant determines the purpose of its customer relationship and is responsible for its customer privacy notices and required permissions. If you are a customer of a merchant using Winni, contact that merchant about its products, orders, and use of your information. You may also contact Winni for assistance identifying the relevant merchant.
3. Information the service processes
Depending on the features enabled, information may include: merchant names and business contact details; account identifiers and authorized users; WhatsApp business account and phone-number identifiers; customer names, phone numbers, message contents, timestamps, delivery information, images and voice messages; transcriptions; product questions, preferences, shipping information, and order-related records from connected commerce systems. The system also keeps operational records such as action confirmations, support escalations, audit events, and diagnostic information. Connection credentials are used to access authorized integrations. Do not send payment card details, government identification numbers, health records, or other highly sensitive information through chat unless a separately approved workflow specifically supports it.
4. How information is used
The intended purposes are to provide merchant-authorized customer assistance; understand questions and generate replies; look up relevant products and order information; prepare authorized business actions; route questions to a human; maintain conversation context; investigate failures and abuse; secure the service; and meet legal obligations. AI-generated replies can be inaccurate. Merchants remain responsible for supervising their configuration and reviewing consequential actions. Customer content is provided to AI services when needed for enabled features; that processing is distinct from using content to train models. Training and evaluation practices are an open decision and must be disclosed accurately before live customer processing.
5. Service providers and integrations
Information may be processed by messaging, AI, hosting, communications, and commerce providers needed for the enabled service. The development implementation uses Meta/WhatsApp, self-hosted Chatwoot, OpenAI, Anthropic, and Shopify integrations; voice features are optional and their production provider is not finalized. This is not a final production subprocessor list. Before onboarding live merchants, Winni must publish the actual providers, purposes, locations, and relevant contract terms. Merchants and their authorized staff can access records for their business. Information may also be disclosed when legally required, to protect rights and security, or as part of a lawful business transfer with appropriate notice and safeguards.
6. Retention and deletion
Retention must be limited to the purpose for which information is needed, applicable law, and the merchant’s documented instructions. A final retention schedule has not yet been adopted. The current development system has a manual administrative retention process; it does not automatically delete all information after a fixed number of days. Deletion from one system does not automatically remove copies in messaging services, connected stores, provider logs, or backups. Some identity, accounting, security, audit, and transaction records may need to be retained for legitimate or legal reasons. The final policy must state the actual retention periods or criteria and how backup expiry and exceptions are handled.
7. Your choices and rights
Depending on applicable law and your relationship with the service, you may request access to your personal information, correction, deletion, restriction or objection, a copy of information, or withdrawal of consent where consent is the basis for processing. Withdrawal does not change the lawfulness of earlier processing. We may need proportionate identity information to verify a request. A merchant customer’s request may need to be coordinated with the merchant. See the data-deletion instructions for the proposed request process. Nothing here limits rights that cannot be waived under applicable law.
8. Customers in Colombia
Where Colombian data-protection law applies, individuals may exercise rights to know, update, and correct their information, request evidence of authorization when relevant, learn how their information has been used, and request revocation or deletion where permitted. They may bring a complaint to the Superintendencia de Industria y Comercio after completing the applicable request procedure with the responsible party or processor. The final operating procedure must support the legally required response periods and the merchant’s role as responsable del tratamiento. Cross-border processing must be assessed and documented under the rules that actually apply to each relationship.
9. International processing and security
Winni AI LLC is a United States company and may use service providers in other countries. The actual hosting regions and transfer safeguards must be confirmed before launch. Winni must implement safeguards appropriate to the information and risks, limit access to authorized people, and maintain an incident response process. No service can guarantee absolute security. This draft does not assert a certification, zero-retention arrangement, or end-to-end encryption for data after it reaches Winni or its service providers.
10. This website, children, and updates
The splash page itself uses no advertising pixels, analytics SDKs, or embedded chat tools. Its language switch does not store a tracking identifier. Hosting providers may process ordinary request and security information. Once a contact email is enabled, email links open your email application; sending an email shares the information you choose to include with the recipient and email providers. Winni’s merchant service is intended for adults acting for a business, not as a service directed to children. Material policy changes should be communicated before they take effect when required by law.
11. Contact and open decisions
Winni AI LLC. Proposed public correspondence address: 30 N Gould St, Ste N, Sheridan, WY 82801, United States; confirm the registered-agent service can receive this correspondence before publication. Contact for support, privacy, and deletion requests: [email protected]. Before this policy is effective: test the contact mailbox, confirm the data inventory, production providers and locations, retention and backup schedule, AI training/evaluation practices, legal grounds and consent flows, international transfer arrangements, and request-response procedure.