Privacy Policy

1. Overview

ShopPilot AI Chat Assistant ("the App") is developed and maintained by Digi Horizon Technologies. This Privacy Policy explains how we collect, use, store, and protect information when merchants install the App on their Shopify store and when customers interact with the chat widget on those stores.

2. Information We Collect

From Merchants (Store Owners)

• Shopify store domain and access token (required to operate the App)
• Product catalog data (titles, descriptions, prices, images) — synced from your store
• Blog articles and custom knowledge base content you upload
• App configuration settings (bot name, colors, AI model selection)
• Billing and subscription status (managed entirely by Shopify Billing API)

From Store Customers (End Users)

• Anonymous chat session messages (temporary, not linked to customer identity)
• Customer-provided text in chat (questions, order numbers typed in conversation)
• Browser session data (session ID, referrer URL) — not persisted after session ends

We do NOT collect: passwords, payment card information, full customer names, email addresses, or any biometric data.

3. How We Use Your Information

• To provide AI-powered product recommendations and answer customer questions
• To sync your store catalog so the chatbot can reference real products
• To display order status information when customers ask (read-only)
• To improve chatbot response accuracy over time (anonymised, aggregate only)
• To send in-app notifications about usage, billing, and app updates

We do not sell, rent, or share your data with third parties for marketing purposes.

4. Third-Party Services

The App uses the following third-party AI providers to process chat messages:

• OpenAI API — Chat messages are sent to OpenAI for AI response generation. OpenAI does not retain conversation data beyond the API call under our usage agreement.
• Google Gemini API — Optional alternative AI provider with the same data handling guarantees.

Merchants who use their own API keys (BYOK — Bring Your Own Key) are governed by their individual agreements with these providers.

5. Data Retention

• Chat sessions: Anonymised session logs retained for up to 30 days, then automatically deleted
• Product catalog cache: Retained while the App is installed; deleted on uninstall
• Knowledge base content: Retained until manually deleted by the merchant
• App configuration: Deleted within 30 days of app uninstallation

6. Customer Rights (GDPR / CCPA)

If you are a merchant or a customer located in the European Union, United Kingdom, or California, you have the right to:

• Request access to the personal data we hold about you
• Request correction or deletion of your personal data
• Object to or restrict processing of your personal data
• Request data portability

To exercise these rights, contact us at ashvin@digihorizon.in. We will respond within 30 days.

7. Shopify Mandatory Privacy Webhooks

We fully support all three of Shopify's mandatory privacy webhooks:

8. Security

We implement industry-standard security measures including AES-256 encryption for stored API keys, HTTPS for all data in transit, and strict per-tenant data isolation so no store can access another store's data.

9. Cookies

The chat widget uses a single first-party session cookie (cc_session_id) to maintain conversation continuity during a browser session. This cookie expires when the browser is closed and contains no personally identifiable information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify merchants of significant changes via in-app notification and by updating the "Last updated" date above.

11. Contact Us

For any privacy-related questions or requests: