QUADPICK AI PRIVACY POLICY

Effective date: 29 September 2026

This Privacy Policy explains how Brix + Bailey Technology Limited ("QuadPick AI", "we", "us" or "our") collects, uses, discloses and protects Personal Data in connection with the QuadPick AI Shopify application (internal working title "PEARL") and associated services.

Brix + Bailey Technology Limited is registered in England and Wales under company number 10234158 and has its registered office at Suite 1, 24-25 Barnack Business Centre, Blakey Road, Salisbury, SP1 2LP.

For privacy enquiries, contact mail@brixbailey.com.

1. What QuadPick AI does

QuadPick AI is a Shopify application that analyses a Merchant's own product catalogue to derive product-to-product relationships for merchandising purposes.

Depending on the functionality a Merchant chooses to enable, QuadPick AI may also analyse limited Shopify order information to identify products that are purchased together and show shoppers how often a suggested product was bought together with the product it is suggested for, to report to the Merchant the orders and sales that QuadPick AI's suggestions assisted and, where the Merchant has switched on public discovery pages, to rank which of the Merchant's products' public discovery pages are listed in the sitemap and on the public discovery index page.

QuadPick AI is designed to minimise the amount of customer information required for these purposes.

2. Our privacy roles

QuadPick AI has different data-protection roles depending on the information being processed.

When QuadPick AI acts as a processor

Where QuadPick AI processes Shopify order or customer-related information solely to provide the Service to a Merchant, the Merchant is generally the Controller and QuadPick AI acts as its Processor.

The Merchant determines why the information is processed and authorises QuadPick AI's access through Shopify.

If you are a customer of a Merchant and your enquiry concerns information QuadPick AI processes on that Merchant's behalf, you should normally contact the Merchant directly.

Our obligations to Merchants when acting as Processor are set out in the QuadPick AI Data Processing Addendum.

When QuadPick AI acts as a controller

Brix + Bailey Technology Limited acts as an independent Controller for Personal Data used for its own legitimate business purposes, such as:

• Merchant and user account administration;
• business contact information;
• support communications;
• billing and commercial records;
• Service security;
• fraud and abuse prevention;
• legal and regulatory compliance; and
• operation of QuadPick AI's own website and business.

This Privacy Policy applies directly to that Controller Processing.

3. Information QuadPick AI receives from Shopify

The information QuadPick AI receives depends on the Shopify permissions authorised by the Merchant and the functionality the Merchant enables.

Merchant and store information

QuadPick AI may receive information required to identify and administer a Merchant's installation, such as:

• Shopify store identifiers;
• store domain information;
• installation and authorisation information;
• authorised account or administrative information; and
• information required to authenticate and maintain the Shopify integration.

Catalogue information

QuadPick AI may process catalogue information required to derive product relationships, including relevant product identifiers and product or catalogue content made available through the Merchant's authorised Shopify permissions.

Limited order information

If the Merchant enables QuadPick AI's optional order-derived functionality, QuadPick AI may transiently process:

• limited order metadata;
• technical order identifiers where necessary to distinguish individual orders;
• line-item product or variant associations and quantities;
• order and line-item amounts and the order currency; and
• order custom attributes, of which QuadPick AI uses only the marker it adds to the cart when a product is added from one of its suggestions.

QuadPick AI uses this information to determine which products have been purchased together, to show shoppers how many times a suggested product was bought together with the product it is suggested for (only for pairs bought together in at least three orders), to report to the Merchant the orders, items and sales value that QuadPick AI's suggestions assisted and, where the Merchant has switched on public discovery pages, to rank which of the Merchant's products' public discovery pages are listed in the sitemap and on the public discovery index page.

None of those uses needs line-item quantities; QuadPick AI currently reads them only to calculate the per-product unit count described in section 4, which no current feature of the Service uses.

For assisted-sales reporting, QuadPick AI counts only orders that carry its marker and adds up only the value of the line items that the marker names.

Apart from the product relationships described above, which help decide the suggestions each public discovery page shows and so feed into how that page ranks, the only order-derived information this ranking uses is an aggregated count, for each product, of recent orders that contained it. Neither those per-product counts nor the ranking order are published.

If the Merchant switches the order-derived functionality off, QuadPick AI no longer has access to order information and, from the next time the ranking is rebuilt, stops using per-product order counts for it, but the product relationships from its most recent calculation, including the bought-together counts shown to shoppers, stay in use until the first calculation after the functionality is switched back on, or until the Merchant's data is erased.

QuadPick AI does not require customer:

• names;
• email addresses;
• telephone numbers;
• billing addresses; or
• shipping addresses

for this functionality.

QuadPick AI does not intentionally request those customer identity fields for these purposes.

4. What happens to order information

Underlying order information used to calculate product relationships, per-product order counts and assisted-sales totals is processed transiently.

QuadPick AI does not retain a customer-level or underlying order-level dataset after the relevant calculation is complete.

The retained output consists of product-level relationships, per-product order counts, daily totals of the orders, items and sales value that QuadPick AI's suggestions assisted, and associated aggregate information required to provide the Service. With each per-product order count, QuadPick AI also stores the number of units of that product in those orders; no current feature of the Service uses that unit count.

QuadPick AI applies minimum aggregation or small-cell suppression controls before qualifying order-derived relationships are retained or used.

QuadPick AI does not use Shopify order information to create advertising profiles about individual customers.

QuadPick AI does not sell Shopify customer Personal Data.

5. Information collected directly from Merchants

When a Merchant or authorised user uses or communicates with QuadPick AI, we may receive:

• name and business contact details;
• account and store information;
• support requests and correspondence;
• subscription or billing information made available through Shopify or another authorised billing process;
• preferences and application configuration;
• feedback; and
• information voluntarily supplied when contacting QuadPick AI.

We ask Merchants not to include unnecessary customer Personal Data in support messages.

6. Technical and security information

QuadPick AI may process technical information reasonably necessary to authenticate users, maintain the Service, diagnose faults, prevent abuse and protect QuadPick AI and its Merchants.

This may include application events, timestamps, request identifiers, authentication events, security events and other diagnostic information generated through normal operation of the Service.

QuadPick AI applies data-minimisation principles to operational logs and does not use technical Service information to create behavioural advertising profiles about a Merchant's customers.

7. Information collected directly from Merchant customers

QuadPick AI's core functionality is not designed to require customers of a Merchant to create a QuadPick AI account or provide their identity directly to QuadPick AI.

QuadPick AI does not use its order-derived functionality to collect customer names, email addresses, telephone numbers, billing addresses or shipping addresses directly from buyers.

QuadPick AI does not use order data to conduct cross-site behavioural tracking of Merchant customers.

Where ordinary network infrastructure necessarily handles technical connection information to deliver or protect a Service request, that Processing is limited to operational and security purposes.

8. How we use Personal Data

Where QuadPick AI acts as an independent Controller, we may use Personal Data for the following purposes.

Providing and administering QuadPick AI

We use Merchant and authorised-user information to:

• establish and manage installations;
• authenticate authorised use;
• provide requested functionality;
• administer subscriptions;
• provide support; and
• communicate service information.

Our lawful basis will generally be performance of a contract where the individual is personally party to the contract, or our legitimate interests in operating and administering our business relationship where the contract is with an organisation.

Security and fraud prevention

We process appropriate technical, account and security information to protect QuadPick AI, our Merchants and connected systems from unauthorised access, abuse, fraud and security threats.

We rely on our legitimate interests in protecting the security and integrity of our Service, our Merchants and our business, and where relevant on legal obligations.

Legal and regulatory compliance

We may process or retain information where reasonably necessary to comply with law, taxation, accounting, regulatory requirements, court orders or lawful government requests.

Our lawful basis is compliance with a legal obligation where the applicable law imposes that obligation on us.

Establishing and defending legal rights

We may process appropriate records where reasonably necessary to establish, exercise or defend legal claims.

We rely on our legitimate interests in protecting and enforcing our legal rights.

Improving the Service

We may analyse Service operation, errors, performance and Merchant usage to maintain and improve QuadPick AI.

Where this involves Personal Data for which QuadPick AI is Controller, we rely on our legitimate interests in maintaining and improving the Service, subject to appropriate consideration of individual rights and interests.

We do not use Merchant customer order Personal Data processed as Processor for unrelated independent product development, advertising or customer profiling.

9. Artificial intelligence

QuadPick AI may use artificial intelligence to analyse Merchant catalogue and product content.

QuadPick AI currently accesses Anthropic directly through Anthropic's commercial API.

The QuadPick AI AI path is separate from the Shopify order-analysis path.

QuadPick AI does not intentionally send Shopify order-level Protected Customer Data, customer identities, customer contact information or individual customer purchasing histories to Anthropic for catalogue analysis.

The information sent to Anthropic is limited to Merchant catalogue and product content required for the relevant AI function.

If a Merchant has itself included Personal Data within catalogue or product content, that information may consequently be included in the content sent for AI processing.

For a QuadPick AI account based in the United Kingdom, Anthropic's current Commercial Terms identify Anthropic Ireland, Limited as the contracting Anthropic entity.

Anthropic currently states that commercial API data may be processed using infrastructure in selected countries in the United States, Europe, Asia and Australia and that standard API data storage is located in the United States unless otherwise agreed.

Anthropic currently states that standard API inputs and outputs are automatically deleted from its backend within 30 days, subject to stated exceptions including different agreed arrangements, safety and usage-policy enforcement and legal requirements.

QuadPick AI does not rely on AI-provider retention as a substitute for minimising the information sent to the provider.

10. Cookies and tracking

QuadPick AI does not use Shopify customer order information for behavioural advertising or cross-site advertising profiles.

QuadPick AI does not intentionally place behavioural-advertising trackers on a Merchant's storefront as part of its core or order-derived functionality. For assisted-sales reporting it adds two attributes to the cart: the marker, which holds product references, and the suggested products' titles, which the Merchant sees in the order's details. Neither carries a customer identifier.

QuadPick AI's own administrative or website services may use technologies that are strictly necessary for authentication, security, session management and reliable operation.

If QuadPick AI introduces optional analytics, advertising or other non-essential tracking that requires consent under applicable law, appropriate information and consent controls will be provided before that technology is used.

11. Who we disclose information to

QuadPick AI discloses information only where reasonably necessary for the purposes described in this Policy, at the Merchant's instruction, or where required by law.

Railway

QuadPick AI uses Railway Corporation for production application, database and infrastructure hosting.

QuadPick AI production services containing Merchant Data are configured in Railway's EU West Metal region in Amsterdam, Netherlands.

Railway states that its primary processing operations nevertheless take place in the United States and that its DPA contains applicable safeguards for international transfers.

Anthropic

QuadPick AI uses Anthropic Ireland, Limited and applicable Anthropic affiliates to provide commercial AI inference for catalogue and product analysis.

QuadPick AI does not intentionally transmit Shopify customer identity information or order-level Protected Customer Data to Anthropic for this purpose.

Amazon Web Services

QuadPick AI uses Amazon Web Services EMEA SARL and applicable AWS affiliates for cryptographic key management and related security infrastructure.

QuadPick AI's relevant AWS KMS functions are configured in the eu-central-1 AWS region.

Shopify

QuadPick AI operates through Shopify and exchanges information with Shopify where necessary to install, authenticate and provide the Service.

A Merchant has its own contractual and privacy relationship with Shopify.

Professional advisers and authorities

We may disclose relevant information to professional advisers, auditors, insurers, regulators, law-enforcement bodies, courts or other authorities where reasonably necessary or legally required.

Corporate transactions

If Brix + Bailey Technology Limited is involved in a merger, acquisition, restructuring, financing or sale of some or all of its business or assets, relevant information may be disclosed to parties involved in that transaction subject to appropriate confidentiality and data-protection safeguards.

12. Subprocessors

Where QuadPick AI acts as a Processor for a Merchant, our current material Subprocessors are described in the QuadPick AI Data Processing Addendum.

Our current principal Subprocessors are:

• Railway Corporation;
• Anthropic Ireland, Limited and applicable Anthropic affiliates; and
• Amazon Web Services EMEA SARL and applicable AWS affiliates.

Shopify is not treated as a QuadPick AI Subprocessor merely because the Merchant has instructed QuadPick AI to access information through the Merchant's own Shopify service.

13. International transfers

Although QuadPick AI's Railway production deployment is configured in Amsterdam and its AWS key-management service is configured in an EU region, some of our providers conduct Processing outside the United Kingdom and European Economic Area.

In particular:

• Railway states that its primary processing operations take place in the United States; and
• Anthropic states that commercial API data may be processed in the United States, Europe, Asia and Australia, with standard API storage in the United States unless otherwise agreed.

Where Personal Data is subject to a restricted international transfer, QuadPick AI uses or requires its relevant providers to maintain an appropriate transfer mechanism.

Depending on the Processing, these safeguards may include:

• UK adequacy regulations;
• European Commission adequacy decisions;
• approved transfer frameworks;
• European Commission Standard Contractual Clauses;
• the UK International Data Transfer Addendum;
• the UK International Data Transfer Agreement; or
• another lawful transfer mechanism.

Further details concerning processor transfers are available in our Data Processing Addendum.

14. Data retention

We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected or Processed, taking account of legal, contractual, security and legitimate business requirements.

Shopify order information

Underlying order information used for product co-purchase analysis, assisted-sales reporting and public discovery page ranking is processed transiently and is not retained by QuadPick AI as an order-level customer dataset after the relevant calculation.

Product relationship information

Product-to-product relationship information and aggregate metrics may be retained for as long as required to provide QuadPick AI to the relevant Merchant.

Merchant account information

Merchant administration and account information is retained while reasonably required to administer the Merchant relationship and thereafter where necessary for legitimate business records, legal obligations or legal claims.

Support communications

Support records are retained for as long as reasonably necessary to resolve the relevant issue, maintain appropriate business records and protect legal rights.

Security information

Security and operational information is retained for periods reasonably necessary for system security, incident investigation, fraud prevention and legal compliance.

Anthropic API information

Anthropic currently states that standard commercial API inputs and outputs are automatically deleted from its backend within 30 days, subject to its stated exceptions or a different agreed retention arrangement.

Uninstallation

When QuadPick AI is uninstalled, QuadPick AI's deletion process is designed to remove the Merchant's active tenant-specific application records and QuadPick AI-controlled tenant key records, subject to information that must lawfully be retained and protected backup or security copies which have not yet reached the end of their applicable retention cycle.

Any information retained solely because of a legal obligation or protected backup process remains subject to appropriate security and is not used for unrelated purposes.

15. Shopify privacy requests

QuadPick AI supports Shopify's applicable privacy and compliance mechanisms, including:

• customers/data_request;
• customers/redact; and
• shop/redact.

Because QuadPick AI does not retain an underlying customer-level order dataset for its order-derived functionality, a customer-specific request may result in QuadPick AI determining that it has no responsive retained customer Personal Data.

Where deletion is required and responsive Personal Data exists, QuadPick AI will process the request in accordance with the Merchant's instructions, applicable law and Shopify requirements.

16. Your data-protection rights

Where Brix + Bailey Technology Limited acts as Controller of your Personal Data, you may have rights under applicable Data Protection Law.

Depending on the circumstances, these may include rights to:

• obtain information about our Processing;
• obtain access to your Personal Data;
• have inaccurate Personal Data corrected;
• request deletion;
• request restriction of Processing;
• object to certain Processing;
• receive certain Personal Data in a portable format;
• withdraw consent where Processing is based on consent; and
• complain to a Supervisory Authority.

These rights are not absolute and may depend on the circumstances and the lawful basis for Processing.

To exercise a right relating to information for which QuadPick AI is Controller, contact mail@brixbailey.com.

We may need to verify your identity before fulfilling a request.

17. Merchant customer requests

If you are a customer of a Shopify Merchant using QuadPick AI and your request concerns information processed by QuadPick AI solely on that Merchant's behalf, the Merchant remains responsible for handling your request as Controller.

You should contact the Merchant directly.

QuadPick AI will provide reasonable assistance to the Merchant where required under our Data Processing Addendum and Applicable Data Protection Law.

18. Complaints

If you have a concern about QuadPick AI's Processing of Personal Data for which Brix + Bailey Technology Limited is Controller, please contact us first at mail@brixbailey.com so that we can investigate.

Individuals in the United Kingdom also have the right to complain to the Information Commissioner's Office (ICO).

The availability of a regulatory complaint does not affect any other rights or remedies available to you.

19. Security

QuadPick AI maintains technical and organisational safeguards appropriate to the nature and risk of the information processed.

These include, as appropriate:

• encryption in transit;
• encryption at rest;
• managed key protection;
• controlled production access;
• logical tenant separation;
• data minimisation;
• separation between order Processing and AI Processing;
• retention and deletion controls;
• security monitoring;
• vulnerability management; and
• incident-response procedures.

No internet or cloud service can guarantee absolute security, but QuadPick AI maintains measures designed to prevent unauthorised access, use, alteration or disclosure.

20. Automated processing

QuadPick AI uses automated analysis to derive relationships between products.

QuadPick AI's product-relationship functionality is not designed to make decisions about an individual that produce legal effects or similarly significant effects on that individual.

21. Children

QuadPick AI is a business-to-business Shopify application intended for use by Merchants and their authorised personnel.

QuadPick AI is not intended to be installed or administered by children.

Where a Merchant's order data happens to relate to a child, QuadPick AI's order-analysis functionality remains subject to the same data-minimisation and processor restrictions described in this Policy.

22. Changes to this Privacy Policy

We may update this Privacy Policy where necessary to reflect changes in QuadPick AI, our providers, Applicable Data Protection Law or regulatory requirements.

Where changes are material, we will take reasonable steps to bring them to the attention of affected Merchants.

The effective date at the top of this Policy identifies the current version.

23. Contact us

Questions about this Privacy Policy or Brix + Bailey Technology Limited's use of Personal Data should be sent to:

Brix + Bailey Technology Limited
Suite 1, 24-25 Barnack Business Centre, Blakey Road, Salisbury, SP1 2LP
Company number: 10234158
Privacy email: mail@brixbailey.com