Privacy Policy

Last updated: 2026-10-24

This Privacy Policy explains what data Any Store AI ("the Service") collects and how it is used, when a merchant connects a Shopify store or a customer interacts with the chat widget. The Service is run by Sumon Mondal, trading as FroGman, in Dhaka, Bangladesh ("we", "us").

1. Data we collect

Merchant account data: your name and email. A Shopify install signs you in through Shopify, with no password. Sign-in to the full dashboard is handled by Clerk.
Store connection data: your store's domain and an access token from Shopify. It is used to read your products, policies, orders, checkouts and customers, and to create carts, discount codes and return requests, within the permissions you approve in Shopify. Access tokens are encrypted at rest.
Conversation data: messages exchanged between your customers and the chat widget, stored so conversation history can be displayed and so the assistant has context across a session.
Details a shopper shares in chat: a name or email the shopper gives, saved with the chat so the store can reply.
Photos a shopper adds: stored with the chat and deleted after 30 days.
Order details: for an order question, the order number and email the shopper gives are checked against the store's Shopify orders, and the status is read from Shopify. A signed-in shopper's orders are read live and not stored. To send post-purchase emails, like cross-sell and winback, we keep fulfilled orders from Shopify: the customer's email, their marketing consent, the items and the total.
Abandoned checkouts: when a store turns on checkout reminders, the email, marketing consent, items and checkout link of checkouts that weren't completed, read from Shopify.
Returns: return requests a shopper makes in the chat. Returns are created in Shopify, and we keep a record that the request was made.
Earlier reviews and store credits: we no longer send review requests or issue store credits. Ratings and comments customers left through our earlier review emails, and the store credit codes issued for them, are kept with the order they belong to and deleted with it, for example on a customer or store erasure request.
Marketing consent: when a shopper joins a store's newsletter in the chat and the store collects signups in Shopify, we create or update that Shopify customer and their email marketing consent. Unsubscribes are passed back to Shopify. When Shopify tells us a customer turned marketing emails off, we stop sending them marketing emails.
Newsletter signups: if a customer agrees in the chat to receive a store's emails, their email address and when they agreed. We send one email asking them to confirm; only once they confirm are they added to that store's own mailing list (its Shopify customers, Klaviyo or Mailchimp) and shown any signup code.
Back in stock alerts: the email a shopper leaves to hear when a product is back.
Chat visitor details: when a customer uses the chat, their approximate location (country, region and city, worked out from their connection by our network provider; the IP address itself is not stored), browser, device type, language and time zone, and the store pages they view while chatting (the address only, without anything after a "?"). Shown to the store alongside the chat and kept for as long as the chat. If the customer is signed in to their store account, the chat confirms this with Shopify so the assistant can look up their own orders without asking for their email.
Rewards: when a store runs a rewards program with us, the customer's Shopify customer id, name and email, and a history of the rewards they earned, used or lost on that store's orders (order ids and amounts), with the reward codes and store credit we applied for them in Shopify.

2. Cookies and local storage

The chat widget uses your browser's local/session storage (not third-party tracking cookies) to remember which conversation you're in, whether you've already dismissed its proactive prompt, and a random anonymous visitor id. The visitor id is kept between visits on the same store so the store can tell your chats apart from other visitors'; it contains nothing about you, is only used by that store's chat, and is removed when you clear your browser's site data. If the store's cookie banner says you declined analytics, the id lasts for your visit only. When analytics are allowed, the chat also reads the store's own Google Analytics ids, if present, so the store's Google Analytics can count the chat. The merchant dashboard sets a session cookie so you stay signed in between visits. None of this is used for advertising or cross-site tracking.

3. How we use data

Data is used to operate the Service: signing merchants in, reading your store's data, writing chat replies, sending the emails a store turns on, and keeping conversation history. We do not sell merchant or customer data.

4. Legal basis for processing

Where the EU/UK GDPR applies, we process merchant account data on the basis of contractual necessity (operating the account you created), and conversation/store data on the basis of our legitimate interest in providing the chat and cart features you installed the Service for, balanced against your rights as described in this policy. Newsletter signups are processed on the basis of the customer's consent, given in the chat and confirmed by email; it can be withdrawn at any time through the unsubscribe link in the store's emails.

5. Third parties

Chat replies are written by OpenAI, with Anthropic as a backup. They receive the shopper's messages, any photos the shopper adds, and the store data needed for the answer. OpenAI also writes other text for the store, like greetings and suggested answers, from the store's content and the questions shoppers ask.
Voyage AI turns knowledge content and shopper questions into search data.
OpenRouter may write suggested product questions from product details only. It receives no shopper data.
Store data is read from Shopify's APIs.
Hosting, network security, email delivery, error monitoring, sign-in and backups are provided by the services on our subprocessor list, under their own data-processing terms.
Integrations a merchant connects, like Klaviyo, Mailchimp, HubSpot, Zapier or Google Analytics, only receive data once the merchant connects them.

The full current list is published as our Subprocessor List. Merchants processing EU/UK personal data may also request our Data Processing Agreement.

6. Data retention

Chats are deleted 12 months after their last message.
Test chats from the dashboard are deleted after 7 days, or 30 while a support request uses one.
Photos a shopper adds are deleted after 30 days.
Orders lose the customer's email and items 12 months after fulfilment.
Abandoned checkouts are deleted after 30 days.
Newsletter signups are deleted after 30 days if not confirmed, and 13 months after they are confirmed.
Back in stock alerts end after 90 days.
Rewards data is kept while the store runs its program and is deleted with the customer's other data: when Shopify sends us the customer's or the store's deletion request, or the store deletes the shopper.
Activity logs are deleted after 13 months.
An unsubscribe is kept, so we never email that address again.
Database backups are encrypted before they leave our server. Our own copies are kept for 30 days.

7. Security

Store access tokens are encrypted at rest. Access to production systems is restricted, and backups are encrypted before leaving our infrastructure.

8. Your rights

You may request deletion of your account and associated data, or disconnect a store to revoke the Service's access to it, at any time. We handle Shopify's privacy requests as follows:

Store erasure: Shopify asks us to erase a store 48 hours after it uninstalls the app. We then delete that store's data, unless the app was installed again.
Customer erasure: handled automatically. The customer's orders, checkouts, chats, signups and alerts for that store are deleted.
Customer data requests: answered by our team within 30 days, sent to the store owner.

If you are a California resident, you may have additional rights under applicable law; contact us below to exercise them.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by the "Last updated" date above.

10. Contact

Privacy questions can be sent to support@anystoreai.com.