Privacy Policy

1. Information We Collect

Personal Information

When you create an account or use our Service, we may collect:

• Name and email address
• Store name and business information
• Phone number (if provided)
• Billing and payment information

Store & Product Data

To provide our services, we collect and process:

• Inventory and product information (descriptions, images, pricing, SKUs)
• Order and transaction data
• Customer information from your store
• Consignment and memo records
• Repair order details

AI Sales Agent & Storefront Chat Data

When our AI sales agent is active on a merchant's storefront, we collect data from visitors who interact with it:

• Chat messages and conversation transcripts
• Visitor identifier (anonymous browser ID, or email/name if voluntarily provided)
• Products viewed, searched for, or recommended during conversations
• Buying intent signals (e.g., browsing, comparing, ready to purchase)
• Page context (which product or collection page the visitor was on)
• Lead capture information (name, email, phone — only when voluntarily provided by the visitor)

Customer Memory & Person Graph

To provide personalized shopping experiences, we build a customer profile (person graph) that may include:

• Stated preferences (style, budget, product categories of interest)
• Relationship context (who the visitor is shopping for, e.g., "gift for wife")
• Interaction history (past conversations, products viewed, purchases made)
• Buying signals and objections expressed during conversations

This data is stored per-store and is not shared between merchants. Each merchant's customer data is completely isolated.

Follow-up Email Data

When a visitor provides their email during a conversation, we may send follow-up emails on behalf of the merchant. We track:

• Whether the email was opened (via tracking pixel)
• Whether links in the email were clicked
• Whether a purchase was subsequently made

Usage Data

We automatically collect certain information when you access the Service, including:

• IP address and browser type
• Device information and operating system
• Pages visited and features used
• Date, time, and duration of visits
• Referring URLs

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and manage your account
• Sync your inventory and orders across connected marketplace platforms
• Power the AI sales agent to provide personalized product recommendations to storefront visitors
• Build and maintain customer profiles (person graph) to enable continuity across shopping sessions
• Send follow-up emails to leads captured through the AI concierge on behalf of merchants
• Detect buying signals and intent to optimize the shopping experience
• Attribute sales revenue to AI-assisted conversations for merchant analytics
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and customer service requests
• Monitor and analyze usage patterns and trends
• Detect, investigate, and prevent fraudulent transactions and other illegal activities
• Comply with legal obligations

3. Data Sharing & Third-Party Services

We may share your information with third parties in the following circumstances:

Marketplace Integrations

When you connect third-party platforms (such as Shopify, WooCommerce, Amazon, eBay, Walmart, or Etsy), we share product and order data as necessary to sync your inventory and fulfill orders. Each platform's use of your data is governed by their own privacy policies.

Payment Processors

We use third-party payment processors to handle billing. Your payment information is transmitted directly to these processors and is subject to their privacy policies.

AI Service Providers

We use third-party AI providers (such as Anthropic and OpenAI) to power our AI sales agent. Conversation messages and product data are sent to these providers for processing. These providers do not use your data to train their models and are bound by their own data processing agreements. We do not send personally identifiable information (such as email addresses or phone numbers) to AI providers — only conversation text and product data.

Vector Database Providers

We use vector database services to enable semantic product search. Product titles, descriptions, and attributes are converted into numerical representations (embeddings) for similarity matching. No customer personal data is stored in vector databases.

Analytics Providers

We may use third-party analytics services to help us understand how the Service is used. These services may collect information about your use of the Service using cookies and similar technologies.

Legal Requirements

We may disclose your information if required to do so by law, or in the good faith belief that such action is necessary to comply with a legal obligation, protect our rights or property, prevent fraud, or protect the safety of our users.

4. Cookies & Tracking

We use cookies and similar tracking technologies to track activity on our Service and store certain information. Cookies are files with a small amount of data that are sent to your browser from a website and stored on your device.

We use session cookies to operate our Service and preference cookies to remember your settings. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

5. Data Retention

We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal or regulatory purposes.

AI & Conversation Data Retention

• Conversation transcripts: Retained for the duration of the merchant's active subscription, then deleted within 30 days of account closure.
• Customer profiles (person graph): Retained while the merchant's account is active. Deleted upon merchant request or account closure.
• Follow-up email tracking: Retained for 12 months, then anonymized.
• Anonymous visitor IDs: Stored in the visitor's browser via localStorage. We do not control the retention of browser-side identifiers.

5a. Account and Data Deletion

You may request deletion of your account and associated data at any time. To delete your account:

• Contact us at support@shopmata.com with the subject "Account Deletion Request"
• We will verify your identity and process the deletion within 30 days
• Upon deletion, we will permanently remove your personal information, store data, product data, conversation transcripts, customer profiles, and AI-generated data
• We may retain certain data for legal compliance, fraud prevention, or security purposes, and will notify you if any data is retained and the reason

Account deactivation alone is not sufficient for data deletion. You must explicitly request data deletion. We will confirm deletion completion via email.

5b. Shopify-Specific Data Handling

When merchants install our Shopify app, the following applies:

• We access product, inventory, and order data through Shopify's API using OAuth access tokens.
• We store product data locally to power AI search and recommendations.
• We receive webhook notifications for product updates, inventory changes, and orders to keep data in sync.
• When the app is uninstalled, we deactivate the merchant's storefront tokens and stop all AI services. Stored data is deleted within 30 days unless the merchant re-installs.
• We comply with Shopify's mandatory GDPR webhooks: customer data requests, customer data erasure, and shop data erasure.

5c. WooCommerce-Specific Data Handling

When merchants install our Shopmata Concierge WordPress plugin or otherwise connect a WooCommerce store, the following applies:

• The plugin generates a WooCommerce REST API key with read/write permissions and sends it to Shopmata over HTTPS during the one-time handshake.
• We use that key to read product, inventory, and order data, push inventory updates back to the merchant's store, and create coupons when the AI agent issues a discount code.
• We register WooCommerce webhooks (product created/updated/deleted/restored, order created/updated) so changes flow into Shopmata in near real time. Webhook payloads are verified and processed by our servers only.
• The chat widget loaded on the merchant's storefront sends visitor messages, page context, anonymous visitor IDs, logged-in customer email and name (when available), and cart contents (product IDs, quantities, subtotal) to Shopmata. No payment information is ever collected by the widget.
• The plugin records the WordPress version, WooCommerce version, plugin version, and (for multisite) the blog ID at handshake time. We do not collect any other site or visitor data through the plugin itself.
• When a merchant disconnects the plugin, we mark the integration inactive, revoke the storefront token, and stop syncing. Stored WooCommerce-sourced data is deleted within 30 days unless the merchant re-connects.
• The WooCommerce REST API keys created by the plugin remain in the merchant's WordPress install after disconnect; merchants can delete them under WooCommerce → Settings → Advanced → REST API.

5d. Amazon-Specific Data Handling

When merchants connect their Amazon Seller account, the following applies:

• We access product listings, inventory levels, and order data through Amazon's Selling Partner API (SP-API) using OAuth access tokens.
• We store product data locally to enable cross-platform inventory sync, AI-powered product recommendations, and catalog enrichment.
• Order and customer data from Amazon is used solely for order management, fulfillment tracking, and sales analytics within the merchant's Shopmata account.
• We do not sell, share, or transfer Amazon customer data to any third parties other than as required to provide our services (e.g., AI processing for product recommendations).
• Amazon customer personally identifiable information (PII) is handled in strict accordance with Amazon's Data Protection Policy and is not used for marketing purposes.
• When a merchant disconnects their Amazon account, we deactivate the integration and stop syncing data. Stored Amazon-sourced data is deleted within 30 days unless the merchant re-connects.
• We implement appropriate security measures including encryption in transit (TLS/HTTPS) and at rest for all Amazon marketplace data.

5e. Third-Party Services and SDKs

Our service integrates with the following third-party services that may collect or process data:

• Anthropic (Claude AI): Processes conversation text and product data for AI recommendations. Does not receive customer PII. Data is not used for model training.
• OpenAI: Generates product embeddings for semantic search. Receives only product titles and descriptions. No customer data.
• Amazon Web Services (SES): Sends transactional and follow-up emails. Receives recipient email addresses and email content.
• Stripe: Processes subscription billing payments. Receives payment method and billing information. Shopmata does not store credit card numbers.
• Shopify: Exchanges product, order, and customer data via API for merchants using the Shopify platform.
• Amazon SP-API: Exchanges product, order, and inventory data for merchants using the Amazon marketplace.
• eBay: Exchanges listing, order, and inventory data for merchants using the eBay marketplace.
• Qdrant: Self-hosted vector database for product search. Stores only product text embeddings. No customer data.
• Meilisearch: Self-hosted search engine for product catalog search. Stores product data only.

Each third-party service is bound by its own privacy policy and data processing terms. We select service providers that maintain appropriate security standards and do not use merchant or customer data for their own purposes beyond providing the contracted service.

5f. Consent and User Control

We obtain consent for data collection through the following mechanisms:

• Merchants: By creating a Shopmata account or installing our app, merchants consent to the data collection described in this policy. Merchants can revoke consent by deleting their account or uninstalling the app.
• Store visitors: Visitors who interact with the AI concierge consent to conversation data collection through their voluntary participation. Lead information (email, name) is only collected when voluntarily provided by the visitor.
• Platform connections: When merchants connect third-party platforms (Shopify, Amazon, eBay), they explicitly authorize data access through the platform's OAuth consent flow.

Users may withdraw consent at any time by contacting us at support@shopmata.com. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

6. Data Security

We implement appropriate technical and organizational measures to protect the security of your personal information, including encryption of data in transit and at rest, regular security assessments, and access controls.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct any inaccurate or incomplete personal information.
• Deletion: Request that we delete your personal information, subject to certain exceptions.
• Portability: Request a copy of your data in a structured, commonly used, and machine-readable format.
• Opt-out: Opt out of the sale or sharing of your personal information (where applicable under CCPA).

To exercise any of these rights, please contact us at support@shopmata.com. We will respond to your request within 30 days.

8. Children's Privacy

Our Service is not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information.

9. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to such transfers.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

Changes to this Privacy Policy are effective when they are posted on this page. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

11. Contact Information

If you have any questions about this Privacy Policy, please contact us at support@shopmata.com.