Privacy & Data

Data Retention

Supportify automatically deletes chat data to comply with GDPR and Shopify's data protection requirements:

• Chat sessions and messages are automatically deleted after 90 days.
• Billing records are retained for the legally required period (typically longer, for tax and accounting purposes).
• Knowledge base documents are retained as long as you're using the app.

What Data We Collect

Customer Email Verification

When customers want to access order data through the chat, they need to verify their email address first. This protects your customers from unauthorized access to their order information.

How it works:

1. Customer provides their email address.
2. We send a verification code to that email.
3. Customer enters the code in the chat.
4. If the code matches, the AI can access order data for that email.

Customers get a maximum of 3 attempts to enter the correct code, and codes expire after 5 minutes.

GDPR Rights

Under GDPR, both you and your customers have specific data rights:

• Right to access — Request a copy of all personal data we hold.
• Right to deletion — Request that personal data be erased.
• Right to rectification — Request corrections to inaccurate data.
• Right to data portability — Receive data in a machine-readable format.
• Right to restrict processing — Limit how data is used.
• Right to object — Object to specific types of processing.

Requesting Data Exports

You can request a data export from the Privacy section of the Supportify app (or contact us directly). The export includes:

• All customer chat sessions and messages
• Support tickets
• Customer data stored in our system
• Billing records

The export is provided as a ZIP file and is available for download for 30 days.

What Happens When You Uninstall

If you uninstall Supportify from your Shopify store, here's what happens:

1. The chat widget disappears from your storefront immediately.
2. Your data is deleted — all chat sessions, messages, chatbot configurations, tools, and customer data are removed from our servers.
3. Billing stops — your Shopify subscription is cancelled and no further charges are made.
4. Knowledge base documents are deleted — any uploaded files are removed.
5. OAuth connections are revoked — if you connected Gmail or Outlook, those connections are cleaned up.

Security Practices

A quick overview of how we keep your data safe:

• Encryption at rest and in transit — All data is encrypted. OAuth tokens (Shopify, Gmail, Outlook) are encrypted with AES-256.
• EU hosting — Data is processed on servers in the EU (Stockholm region).
• No credit card storage — All billing goes through Shopify. We never see or store payment information.
• Rate limiting — API endpoints are rate-limited to prevent abuse.
• Audit logging — Billing operations and data access are logged for compliance.
• Webhook verification — All Shopify webhooks are verified using HMAC signatures.