This Privacy Policy explains how Winning Technologies Ltd ("Winning", "we", "us", "our") collects, uses, shares, stores and protects personal data when you visit https://winn.ing, use the Winning platform, join our waitlist, contact us, or connect third-party services such as Shopify.
Winning Technologies Ltd is incorporated in the Dubai International Financial Centre (DIFC), United Arab Emirates, with its registered office at:
Winning Technologies Ltd
Innovation Hub Virtual Inventory, IH-00-VZ-01-FL-215, Level 1
Dubai International Financial Centre
Dubai, United Arab Emirates
Privacy contact: [email protected]
Legal contact: [email protected]
1. Scope
This Privacy Policy applies to:
- visitors to the Winning website;
- users who create or manage a Winning account;
- users who connect an e-commerce store, including Shopify;
- users who submit business information, product ideas, store content, ad content, customer support messages, or other materials to the platform;
- people who interact with our waitlist, emails, forms, or support channels.
This policy does not apply to third-party websites, apps, or platforms that we do not control, such as Shopify, Stripe, Meta, Google, AI model providers, or other services that you may use separately. Their own privacy policies apply to their processing.
2. Our Role Under Data Protection Law
Depending on the context, we may act as either a data controller or a data processor. We act as controller when we decide why and how personal data is processed (account, billing, analytics, marketing, support, security, product improvement). We may act as processor when a business user submits or connects personal data belonging to their own customers, leads, store visitors, or business contacts. When we act as processor, the Data Processing Addendum attached to our Terms of Service applies.
3. Personal Data We Collect
We collect only the categories of personal data reasonably necessary to operate, secure, improve, and provide the platform.
- Account data: name, email, password hash, user ID, account creation date, authentication events.
- Subscription and billing data: plan, invoices, billing address, VAT/tax details, payment status, last four digits and card brand if provided by Stripe.
- Business workspace data: business name, niche, selected products, brand strategy, positioning, store copy, ad concepts, product research, generated outputs.
- AI interaction data: prompts, messages, instructions, uploaded context, generated responses, agent logs, approval decisions.
- Shopify and e-commerce data: store metadata, products, collections, orders, customer records, emails, shipping addresses, carts, checkout events, sales and analytics data where connected.
- Support and communication data: emails, contact form submissions, support tickets, attachments, call notes, issue history.
- Marketing data: waitlist email, newsletter opt-in status, email engagement, campaign source, unsubscribe status.
- Usage and analytics data: pages visited, features used, click events, device data, browser type, approximate location, referral source, session duration.
- Security and technical logs: IP address, login attempts, error logs, admin actions, fraud and abuse signals.
- Cookie and tracking data: cookie IDs, consent preferences, analytics identifiers, advertising identifiers where consent is given.
We do not intentionally request special categories of personal data such as health data, biometric data, religious beliefs, political opinions, or trade union membership.
4. How We Collect Data
- directly from you when you create an account, join a waitlist, contact support, or submit information to the platform;
- automatically through website, app, security, analytics, and cookie technologies;
- from connected third-party services when you authorize an integration, such as Shopify;
- from payment processors such as Stripe for billing and subscription status;
- from service providers that help us operate the platform, subject to contractual safeguards.
5. Purposes and Legal Bases
Where GDPR, UK GDPR, or similar laws apply, we rely on legal bases such as performance of contract, legitimate interests, legal obligation, and consent. We process personal data to: create and manage your account; provide Winning services (AI workflows, product research, store generation, ad generation, business memory, Shopify integration); process payments and subscriptions; provide support; secure the platform; improve the product; send transactional and (where permitted) marketing communications; use analytics and advertising cookies subject to consent where required; and comply with the law.
You may object to processing based on legitimate interests where applicable. You may withdraw consent at any time where processing is based on consent.
6. AI Processing
Winning uses AI systems to help users research products, build brand and positioning assets, generate store content, create advertising concepts, analyze business performance, and recommend next actions. We use AI model providers as sub-processors. By default, we configure business/API services so that customer content is not used to train third-party foundation models. AI outputs may be inaccurate, incomplete, or require human review. You remain responsible for reviewing generated business, legal, marketing, advertising, and store content before using or publishing it.
7. Shopify and Customer Data
If you connect a Shopify store or other e-commerce platform, the platform may access and process data from that store to provide the service. You are generally the controller for your own store customer data; Winning generally acts as your processor when processing that data to provide the platform. You must ensure that you have a lawful basis and appropriate notices for sharing that data with Winning.
8. Cookies and Similar Technologies
We use cookies and similar technologies for site operation, security, analytics, and marketing. Essential cookies are required for the website and platform to work and cannot be disabled. Analytics and marketing cookies are used only with your consent where required. You can accept all cookies, reject all non-essential cookies, or manage your choices by purpose. You can change or withdraw your consent at any time using the "Cookie preferences" link in the footer.
9. Who We Share Data With
We do not sell personal data. We share personal data only where necessary for the purposes described in this policy, with recipients such as: Stripe (payments), AI model providers (inference), Shopify (store integration), hosting and database providers, email and marketing providers, analytics and support providers, professional advisers, and public authorities where the law requires it.
10. International Transfers
Winning is based in the United Arab Emirates and may use service providers located outside your country, including outside the EEA, UK, and Switzerland. Where GDPR, UK GDPR, or Swiss data protection laws require transfer safeguards, we rely on appropriate mechanisms such as European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions where applicable, contractual safeguards, and transfer impact assessments where required.
11. Data Retention
We keep personal data only for as long as necessary for the purposes described in this policy, unless a longer period is required by law. Indicative periods: account and workspace data for the life of the account; AI interaction data up to 24 months after last activity; payment records and invoices up to 10 years (tax/accounting); support messages up to 3 years; analytics data 13 to 25 months; security logs 6 to 12 months; cookie consent records up to 6 to 13 months.
12. Security
We implement technical and organizational measures designed to protect personal data, including encryption in transit (TLS), encryption at rest where supported, access controls and least-privilege access, multi-factor authentication for administrative access where available, workspace separation, secure token storage, monitoring and logging, vendor review, and limited internal access. No system is perfectly secure. If you believe your account or data has been compromised, contact [email protected] or [email protected] immediately.
13. Your Rights
Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, port your data, withdraw consent, and complain to a supervisory authority. To exercise your rights, contact [email protected]. We will respond within one month where GDPR applies.
14. Deletion and Account Closure
You may request deletion of your account and personal data by contacting [email protected]. We will verify your identity, delete or anonymize data where legally possible, disconnect integrations, retain only what we must keep for legal/tax/security reasons, and confirm completion.
15. Marketing Communications
You can unsubscribe from marketing emails at any time using the unsubscribe link or by contacting [email protected]. We may still send transactional or service-related emails.
16. Children's Data
The platform is not intended for children. You must be at least 18 years old to use the platform.
17. Automated Decision-Making
The platform may generate recommendations, scores, rankings, or suggested next actions using automated systems. These outputs assist users and do not produce legal or similarly significant effects on individuals without human review. You are responsible for reviewing decisions before acting on them.
18. Changes to This Policy
We may update this Privacy Policy from time to time. If changes are material, we will provide notice by email, in-app notification, or another appropriate method. The "Last updated" date at the top shows when this policy was last changed.
19. Contact
For privacy questions or data rights requests:
Winning Technologies Ltd
Innovation Hub Virtual Inventory, IH-00-VZ-01-FL-215, Level 1
Dubai International Financial Centre
Dubai, United Arab Emirates
Email: [email protected]
For legal questions: [email protected]