Privacy Policy — AI Chat Widget

Last updated: August 20, 2026

AI Chat Widget (“the App”) is a Shopify app that adds an AI-powered shopping assistant to a merchant’s storefront. This policy explains what data the App collects, how it’s used, and how it’s handled when a shopper or merchant asks for it to be removed.

Who this applies to

This policy covers two groups: merchants who install the App in their Shopify admin, and shoppers who chat with the widget on a merchant’s storefront.

Information we collect

From shoppers, when they start a conversation

• Name, and an email address or phone number (required to start a chat)
• The content of messages sent to and received from the assistant
• An order number, if the shopper asks about an order’s status

From merchants

• Store information provided by Shopify during installation (shop domain, access token, granted scopes)
• Widget configuration the merchant sets: welcome message, system prompt, brand color, selected collections, and any optional knowledge-base entries or their own AI provider API key

The App does not collect payment card details, and does not request a myshopify.com domain be typed in manually — installation happens entirely through Shopify’s standard OAuth flow.

How we use this information

• To generate the assistant’s replies — shopper messages are sent to Google’s Gemini API (or, on the Pro plan, the merchant’s own Gemini API key) along with relevant product data looked up live from the merchant’s store
• To look up order status when a shopper asks about an order
• To let the merchant see conversation history and shopper contact details in their Shopify admin, and to notify the merchant when a shopper asks to speak with a person
• To operate and secure the App itself (e.g. billing, support)

The assistant is instructed to only describe real products and prices retrieved from the merchant’s store — it does not have access to any other merchant’s data.

Who we share it with

• Google (Gemini API) — processes shopper message content to generate assistant replies, per Google’s Gemini API terms
• Shopify — product, order, and store data is read through Shopify’s Admin API under the scopes the merchant approved at install
• Our infrastructure providers — data is stored on Supabase (PostgreSQL) and the App runs on Vercel

We do not sell shopper or merchant data.

How long we keep it

Conversations and messages are kept for as long as the merchant has the App installed, so they remain visible in the merchant’s Activity page. When a merchant uninstalls the App, all of that shop’s data — conversations, messages, widget settings, and knowledge-base entries — is permanently deleted within 48 hours.

Your rights

A shopper can ask the merchant they chatted with to request a copy of their data, or to have it deleted. The App supports both requests directly from Shopify (the customers/data_request and customers/redact webhooks), and will remove a shopper’s stored conversations and messages on request.

Security

All traffic to and from the App is encrypted with TLS. Application data lives in a dedicated, isolated database schema, accessible only through the App’s own server — never through a public API or shared database access.

Contact

Questions about this policy or your data can be sent to info@gvozdovic.com.