Privacy Policy

1. Information we access from your store

When a merchant installs the App and authorizes it, we access the following Shopify data on a read-only basis — we request read-only permissions and do not modify your store’s data:

• Products and inventory
• Orders and fulfillment/tracking status
• Customer name, email address, and city/province/country — used only to look up and verify orders and to answer support questions (we do not access full street addresses)
• Sales reports
• Shop policies (refund, shipping, privacy, terms)

2. How we use it

We use this data to power an AI assistant that answers questions — in the Shopify admin for merchants, and on the storefront for shoppers. Store data is generally read live from Shopify at the time of a request. To ground the assistant in your store, we may index store content (product descriptions, pages, blog articles, and policies) into a knowledge base so the assistant can answer accurately.

3. Shopper interactions (storefront assistant)

When a shopper uses the chat assistant, we process their messages to generate responses. For order lookups, a shopper may provide an order number and the email address on that order; we use these solely to verify ownership and retrieve that order’s status. We do not use shopper data for advertising and we do not sell it.

4. AI processing and sub-processors

To generate responses, relevant context is sent to our AI engine (operated by Core Agents Lab and hosted on DigitalOcean) and to third-party AI model providers (such as Anthropic) under agreements that restrict use of the data to providing the service. We do not sell personal data, and we do not permit these providers to use your data to train their models.

5. Data storage and retention

Chat conversations and the knowledge-base index for a store are stored to provide the service. Chat conversations are retained for up to 90 days. Contact details captured during an order lookup or support handoff (name, email, and order reference) are retained no longer than needed to provide the service, and in any case no more than 90 days. Data associated with a store is also deleted when the merchant uninstalls the App or upon a verified deletion request. We honor Shopify’s mandatory privacy webhooks (customers/data_request, customers/redact, and shop/redact).

6. Your rights (GDPR / CCPA)

Merchants and shoppers may request access to, correction of, or deletion of their personal data. Merchants can trigger deletion by uninstalling the App or through Shopify’s data-request tools; anyone may also contact us directly at [email protected]. We respond to verified requests as required by applicable law.

7. Security

All data is transmitted over encrypted connections (TLS/HTTPS). Personal data and access credentials (such as Shopify access tokens) are encrypted at rest, and access to systems and data is restricted to what is needed to operate the service.

8. Cookies and local storage

The storefront assistant may store a session identifier in the browser’s local storage to maintain a continuous chat session. It does not use advertising or cross-site tracking cookies.

9. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent version.

10. Contact

Questions or requests regarding this policy or your data can be sent to [email protected] (Core Agents Lab).