Nosto Commerce Experience Platform (experience.AI and Huginn)

by Nosto

AI Application

Low Confidence

Nosto is a SaaS Commerce Experience Platform from Nosto Solutions Oy (Helsinki) used by online retailers and brands, mainly on Shopify, Shopify Plus, Salesforce Commerce Cloud, Adobe Commerce, BigCommerce and Shopware. It covers personalized site search, category merchandising, product recommendations, post-purchase upsell, dynamic bundles, personalized emails, content personalization, behavioral pop-ups, A/B testing and shoppable UGC. The AI layer, branded experience.AI, combines predictive models on shopper behavior (segments, affinities, recommendations), semantic and vector search, visual AI and generative AI; the vendor states it integrates OpenAI's ChatGPT for synonym suggestions and recommendation titles. Huginn, launched in 2025, is an LLM agent that coordinates sub-agents for merchants (Docs, Data Analyst and Developer agents live; Merchandising and CRO agents in early access), proactive 'AI Reveals' (segments, bundles, synonyms, facet clean-up), shopper-facing conversational search, query refinement, image search and cross-language search (early access), and an MCP server and API so external agents such as Klaviyo or Shopify Sidekick can call it. The vendor says nothing Huginn prepares goes live without merchant approval. Typical users are ecommerce, merchandising, CRO and CRM teams. Vendor-reported figures (1,500+ brands, 19.5x average ROI, 1.1B+ daily recommendations) are not independently verified. Risk rationale: Rated medium. Under the EU AI Act this is not an Annex III high-risk use; it ranks products and content for shoppers. The shopper-facing conversational search and AI-generated copy bring Article 50 transparency duties for the deployer (tell users they are interacting with AI, label generated text where required). The main exposure is GDPR: the service builds behavioral profiles of identifiable shoppers (name, email, phone, IP, browsing, cart and order history) to personalize in real time and in email, so the merchant needs a lawful basis, cookie consent and an Art. 21 objection path. The rating is above limited because the assurance picture is thin: no public SOC 2 or ISO 27001 evidence was found, processing runs on AWS in the US and Australia under SCCs with no documented EU hosting option, the retention period after termination is unspecified, and the LLM provider named on a product page (OpenAI) does not appear on the published sub-processor list. The rating would drop to limited if Nosto confirms the full LLM sub-processor chain with no personal data sent to it, shows a current SOC 2 Type II or ISO 27001 certificate, and offers EU-only processing. It would rise to high if a deployer used it to set individual prices or credit-like terms, or fed special-category data (health, religion) into segments, which the DPA forbids.