Privacy Policy

Account Editor Chatbot for Shopify · Operated by ITGeeks · Effective: 19 July 2026

This policy explains what personal data the Account Editor Chatbot app ("the App", "we") processes, why, where it is stored, how long it is kept, and the rights available to merchants and their customers. It applies to merchants who install the App on their Shopify store and to the shoppers ("customers") who interact with the App on those stores.

We act as a data processor on behalf of the merchant, who is the data controller for their customers' personal data. Our processing is governed by our Data Processing Addendum.

1. Personal data we process

Category	Data	Source
Customer identity	Shopify customer ID; name, email address, phone number (mirrored from the merchant's Shopify store when needed to deliver a reply or notification)	Shopify APIs, via the merchant's authorization
Order data	Order contents, totals, status, shipping method, delivery address (when the customer edits it), refund and cancellation details	Shopify APIs
Conversation content	Chat messages, voice conversation transcripts, support ticket threads, live-agent chat threads, feedback and ratings. Voice audio is never stored — it is transcribed in real time and discarded.	Provided by the customer while using the App
Cart and browsing context	Cart contents, the storefront page a chat was opened from, market/currency context	The merchant's storefront
Channel data	WhatsApp phone number and message content (only when the customer contacts the store on WhatsApp); email address and message content for transactional emails	Provided by the customer
Merchant data	Store domain, store settings, support-agent names and email addresses configured by the merchant	The merchant

We practice data minimization: the storefront widget sends only an opaque customer ID; contact details are resolved server-side only at the moment they are needed (for example, to deliver a support reply). Internal audit and compliance logs store identifiers and counts, never copies of contact data.

2. Why we process it (purposes)

Answering customer questions about products, policies, orders, and deliveries (chat and voice).
Customer self-service on orders: edits, cancellations, address corrections, tracking, invoices, reorders — always initiated and confirmed by the customer.
Escalating a conversation to the merchant's human support agents when the customer asks for it (live-agent handoff and support tickets).
Transactional notifications about the customer's own orders and tickets (email, WhatsApp), subject to the consent rules in section 5.
Cart features the merchant has enabled (offers, cart recovery, checkout assistance).
Aggregated analytics for the merchant about how the App performed on their store.

We do not sell personal data, use it for advertising, build cross-store profiles, or use one merchant's data for any other merchant. Processing is limited to the purposes above.

3. Sub-processors

We share personal data only with the sub-processors needed to run the App, under their respective data protection terms:

Sub-processor	Purpose	Data involved
Shopify	Commerce platform; source of truth for customer and order data	All commerce data
OpenAI	Language model responses; real-time voice conversation and transcription	Conversation content; customer first name in voice sessions
MongoDB Atlas	Primary encrypted database	All stored data listed above
Fly.io	Application hosting and private networking (US region)	Data in transit through the App
Meta Platforms (WhatsApp Business)	WhatsApp message delivery, only when the customer uses WhatsApp	Phone number, message content
Email delivery provider (SMTP, e.g. AWS SES)	Transactional email delivery	Email address, message content
Google (Places API)	Address autocomplete during address correction, when used	Address text typed by the customer

4. Storage, security, and retention

Encryption in transit: all connections use HTTPS/TLS; database connections use TLS; internal service traffic runs over an encrypted private network (WireGuard).
Encryption at rest: the database (MongoDB Atlas) and host volumes encrypt all data at rest (AES-256), including automated backups.
Tenant isolation: every record is keyed to a single store; every query is scoped to that store. No cross-store access paths exist.
Access control: merchant admin access requires Shopify authentication; internal APIs require signed per-store credentials; webhook payloads are HMAC-verified; customer contact changes require one-time-code verification.
Access logging: automated agent actions, security-relevant failures, and all data-deletion operations are logged to audit collections.

Retention periods

Data	Retention
Chat conversation history	90 days, then deleted automatically
Request metrics	90 days
WhatsApp send/delivery logs	90 days
Support photo uploads	30 days
Automated agent event log	30 days
Cart snapshots (cache)	10 days
Webhook deduplication records	7 days
Chat session state (cache)	~30 minutes
Contact-change verification codes	15 minutes
Customer profile mirror, support tickets, cart recovery records, analytics events	For as long as the App is installed on the store; deleted on uninstall or on a customer deletion request (below)
Deletion audit log	Retained as legal proof that deletions were performed; contains identifiers and counts only, no personal contact data

5. Consent

Marketing communications are gated on the customer's marketing consent state recorded in Shopify; customers who have not consented are not sent marketing messages.
WhatsApp messages use Meta-approved templates and respect Meta's customer-service window rules; conversations are only initiated in response to the customer.
Order information is only shown to authenticated customers; guests are asked to sign in before any order data is disclosed.
We do not use personal data for automated decision-making that produces legal or similarly significant effects. All order changes are explicitly requested and confirmed by the customer before execution.

6. Your rights (customers)

Customers can exercise their privacy rights through the merchant whose store they shopped at, or through Shopify's built-in privacy tools. The App implements Shopify's mandatory privacy webhooks:

Data access request — logged and made available to the merchant to fulfil within 30 days.
Customer data deletion — all records matching the customer (ID, email, phone) are deleted from every collection, caches are purged, and the deletion is audit-logged. Executed immediately on receipt.
Store deletion — when a merchant uninstalls the App, all of that store's data (including all of its customers' data) is deleted after Shopify's 48-hour grace period, and the deletion is audit-logged.

7. International transfers

Data is hosted in the United States (Fly.io region IAD; MongoDB Atlas). Where data is transferred from other regions, it is protected by the safeguards in our Data Processing Addendum and the sub-processors' own transfer mechanisms.

8. Changes and contact

We will update this policy when our processing changes and revise the effective date above. Questions or privacy requests: support@accounteditor.com.