Merci AI Assistant Privacy Policy

Effective date: October 30, 2026

Contact: merci.bot.support@gmail.com

Merci AI Assistant ("the app", "we") is a Shopify app that adds an AI shopping assistant to a merchant's online store. The assistant answers shoppers' questions about the store's products, prices, variants, discounts and availability. This policy explains what data the app accesses, stores and shares, and how it is deleted.

1. Who this applies to

• Merchants who install the app on their Shopify store.
• Shoppers who use the chat widget on a merchant's storefront.

2. Data we access from Shopify

The app asks Shopify for one permission (access scope): read_products, which gives read-only access to product-related data. The app cannot read orders or customers and cannot change anything in the store.

With this permission the app reads product data and keeps only the store's public product catalog: products that are active and published, with their title, handle, vendor, product type, tags, plain-text description (shortened to 2,000 characters), featured image URL, options, variants, prices, compare-at prices and whether each variant is available for sale. It also reads the store's currency, its primary domain (to build links to product pages) and its Shopify shop ID.

3. Data we store

All data in the app's database belongs to a store (identified by its *.myshopify.com domain); the database holds no data about individual shoppers. The hosting platform's request logs are described in section 8.

The data is stored in the app's database on Railway (railway.com), in its US East region (Virginia, United States).

4. Data we do not store

• Chat conversations. Messages and the assistant's replies are not saved in our database or written to our logs, and neither are their topics (for example what a question the assistant couldn't answer was about). Only the counters in section 3 are kept: daily totals per store, which can't be traced back to a shopper or a conversation (no chat, visitor, session or device ID is stored with them).
• Shopper personal data. We do not collect shoppers' names, email addresses, phone numbers, addresses, orders or Shopify customer accounts. Shopify adds the ID of a logged-in customer to storefront requests sent to the app; the app never reads, stores or logs it.
• IP addresses. To limit how many messages (and activity reports, section 5) one visitor can send, the app keeps, in the server's memory only, a keyed hash of the visitor's IP address (and of a random visitor ID created by the widget), with timestamps for the last minute and a count for the current day (UTC). The key is random and changes whenever the server restarts; the raw IP is not kept, and the hashes are not linked to the data stored for the store. This data is never written to disk. It expires on its own: the per-minute entries at most about 6 minutes after the visitor's last message or activity report, the daily count at most 5 minutes after the UTC day ends (so no hash is kept longer than about 24 hours and 5 minutes), and all of it when the server restarts. Uninstalling the app does not delete these hashes in a separate step; they expire within these times. Storefront chat requests reach the app through Shopify's App Proxy, so the shopper's IP address does not appear in the hosting platform's request logs either (section 8).
• Merchant staff data. The app uses offline access tokens only. It does not request, read or store the names, emails or other account details of the store owner or staff. The only staff data kept is in the hosting platform's request logs: when staff open the app in the Shopify admin, these logs record their IP address and browser user-agent for 7 days (section 8).

5. Data in the shopper's browser

The chat widget keeps the current conversation (up to 40 recent turns), the products it has shown, and a random anonymous visitor ID in the browser's sessionStorage. This data stays in that browser tab and is removed when the tab is closed. The widget does not use cookies or localStorage. Starting a new chat clears the conversation.

For the merchant's analytics the widget tells the app, through the same App Proxy, that a new chat started (a yes/no flag sent with each message, "yes" only with the first one), that an "Add to cart" in the chat succeeded, or that "Contact the store" was clicked. Such a report contains only the kind of event: no product, link, text, visitor ID or other identifier. The app adds one to that day's total for the store.

6. Data we share

• OpenAI. To produce an answer, the app sends OpenAI's API (model gpt-4o-mini):
  • the shopper's current message (at most 500 characters);
  • up to the last 10 messages of the same conversation, which the widget sends with each request;
  • the product data relevant to the question: name, brand, product type, description, product page URL (on the store's own domain), currency, prices, compare-at prices, sale status, availability, sizes, colors and up to 30 variants per product;
  • instructions for the assistant.

The app does not send OpenAI the visitor ID, IP addresses or any Shopify customer data. Requests go to the Chat Completions endpoint with OpenAI's store: false option. OpenAI processes this data on our behalf, as a data processor, under the OpenAI Data Processing Addendum that is part of its terms for the API (OpenAI Data Processing Addendum), and under its API data controls (Data controls in the OpenAI platform). According to that page, data sent to the OpenAI API is not used to train OpenAI's models unless the API customer opts in. We have not opted in: sharing of inputs and outputs, feedback, and evaluation and fine-tuning data with OpenAI is turned off in our OpenAI account. For this endpoint OpenAI keeps abuse monitoring logs, which may contain the request content, for up to 30 days unless longer retention is required by law or is reasonably necessary to protect OpenAI's services or any third party from harm.

• Shopify. The app reads catalog data from Shopify's Admin API. To find out which plan a store is on, it sends the store's Shopify shop ID to Shopify's Partner API. Subscriptions and payments are handled by Shopify; the app never sees payment details.
• Hosting. The app runs on Railway (railway.com) in its US East region (Virginia, United States). Railway processes the stored data, the logs described in section 8 and network traffic on our behalf (Railway Privacy Policy).

We do not sell data and do not share it with anyone else.

7. Retention and deletion

• While the app is installed:
  • the product cache is kept and refreshed when Shopify reports product changes; a full re-sync runs when the cache is older than 24 hours and the app is used (the admin page, a product webhook or a chat message);
  • when a product is deleted or unpublished, its data is removed from the cache; only a marker with the product's ID and the time remains until the next full re-sync;
  • daily usage counters are kept for 90 days, then deleted. The deletion runs every 6 hours while the app's server is running;
  • plan data is kept while the app is installed.
• When the merchant uninstalls the app (Shopify's app/uninstalled webhook): the app immediately deletes all of the store's data (session and tokens, product cache, sync state, usage counters, plan). After the app is uninstalled, we keep the store's domain and the time of the uninstall until the deletion of the store's data has finished, and for no more than 24 hours after that. This uninstall marker makes the app finish an interrupted deletion, and stops any work still running at that moment from writing data back. The rate-limit hashes kept in memory (section 4, "IP addresses") are not stored with the store's data and the app cannot look them up by store, so this step does not delete them; they expire on their own within the times stated there.
• 48 hours after uninstall (Shopify's shop/redact webhook): if the store has not reinstalled the app, the app deletes all remaining data of the store; the uninstall marker is kept as described above (until this deletion has finished, and for no more than 24 hours after it).
• Reinstall: the new installation's data is kept, and the uninstalled installation's data is deleted. If Shopify cannot confirm the new installation when an uninstall notification is processed (for example, Shopify's systems are unavailable), all of the store's data is deleted and the new installation starts afresh. If the store reinstalls the app before the uninstall notification has been processed, the app keeps some store-level data for the new installation: the product cache (public product data; a full sync from Shopify replaces it, right away or the next time the app is used) and the usage counter for the day of the uninstall (shared with the new installation). If the uninstall notification is never processed, the shop/redact webhook deletes the rest, except that, besides the product cache and that counter, it may also keep the usage counter for the day before the uninstall, and the sync state and plan data from about the last day before the uninstall. Usage counters are deleted after 90 days in any case. The uninstall marker is removed once Shopify issues the app a working token for the store again.
• Customer data requests and deletion (Shopify's customers/data_request and customers/redact webhooks): the app stores no data linked to individual customers, so there is nothing to export or delete. These requests are acknowledged.

8. Logs

Server logs contain the request method, path (without query string), status code and duration, plus operational messages such as the store's domain, numbers of products, messages and tokens, plan names and error reasons; an unexpected server error can be logged with its technical details. The app's own log lines contain no chat messages, no access tokens and no shopper data.

The hosting platform (Railway) also logs each HTTP request to the app: method, path (without query string), host, status code, timing, size, a request ID, the network region, the IP address the request came from and the browser's user-agent string. Storefront chat requests reach the app through Shopify's App Proxy, so for them the logged IP address belongs to Shopify's proxy network, not to the shopper; the user-agent is the shopper's browser's. For requests that come directly to the app, such as the app page in the Shopify admin or this policy page, the logged IP address is the visitor's. Railway keeps the server logs and these request logs for 7 days on our current Railway plan.

9. Security

• Requests from the storefront reach the app only through Shopify's App Proxy, which signs them; the app rejects unsigned requests.
• Webhooks from Shopify are verified by their signature.
• Secrets (API keys, tokens) are kept in the server's environment, not in code.

10. Changes and contact

We will update this policy when the app's data handling changes. Questions: merci.bot.support@gmail.com.