How we protect your store and your shoppers’ data.

• Dashboard access requires a signed-in session, checked in middleware and again on every page you load.
• Each merchant’s sites, leads, domains, and conversations are resolved from your session server-side. You only ever see your own workspace.
• Every action that changes a site, domain, or intent re-checks that it belongs to your workspace before it runs, not just once at login.
• Requests from Shopify are verified before we trust them: signed OAuth callbacks, signed embedded-app session tokens, and signed storefront requests.
• Shopify Admin API tokens are encrypted at rest (AES-256-GCM). The database key with full access never reaches the browser; the browser only ever gets a locked-down key with no access to tenant tables.

• Your try-on photo is sent directly to our AI provider to generate the preview. We do not store the uploaded photo on our servers.
• The generated result is kept for up to 30 minutes, then automatically deleted by a cleanup job that runs every 10 minutes.
• The generated result is only reachable through short-lived signed links, capped at 5 minutes and tied to your own session. It never has a public URL.

• Shop redact (after uninstall): the store’s operational data is removed. Billing and transaction records are kept for accounting and legal purposes.
• Customer redact: that customer’s matched visitor record, conversations, and uploaded attachments are removed.
• Customer data request: the records we hold on that customer are compiled for the merchant, who responds to the shopper, as Shopify’s process requires.

Automated fulfillment of these requests is built but currently switched off. Today our team fulfills each request after it is recorded.

• No analytics events or analytics cookies are collected until a visitor gives consent. The default is off.
• What we track is behavior, like which step a shopper reached, not personal content. No photos, emails, phone numbers, or message text are ever sent to analytics.
• Short-lived authentication tokens in URLs are stripped before any error or analytics event leaves your browser or our servers.
• Error and performance monitoring runs across the app so we can fix problems. It is not tied to the analytics choice, and the same token scrubbing applies.

• API requests are rate-limited per IP and session. If the rate limiter itself is unavailable, requests are rejected rather than let through unchecked.
• Knowledge-base URL imports are restricted to public HTTPS destinations and block known private and internal network addresses.
• The support AI treats store knowledge, merchant notes, and shopper messages as reference data, never as instructions. Account and order actions are authorized by your verified session, never by anything the AI outputs.
• Calls to AI providers are bounded by a hard timeout and are not automatically retried, so a stalled provider cannot cascade into duplicate work.
• Every release runs a dependency audit and a container vulnerability scan before it can ship. The exact image we deploy is re-scanned, and each deploy is verified live against the deployed commit before it is considered complete.