Privacy & Data

Supportify automatically deletes chat data to comply with GDPR and Shopify's data protection requirements:

• Chat sessions and messages are automatically deleted after 90 days without activity. If you need a different period, contact us and we set it for your store.
• Support tickets are your case history and are kept while you have an account. Files attached to tickets are deleted after 90 days.
• Photos uploaded for virtual try-on are deleted after 24 hours.
• Billing records are retained for the legally required period (typically longer, for tax and accounting purposes).
• Knowledge base documents are retained as long as you're using the app.

When customers want to access order data through the chat, they need to verify their email address first. This protects your customers from unauthorized access to their order information.

How it works:

1. Customer provides their email address.
2. We send a verification code to that email.
3. Customer enters the code in the chat.
4. If the code matches, the AI can access order data for that email.

Customers get a maximum of 3 attempts to enter the correct code, and codes expire after 5 minutes.

Under GDPR, both you and your customers have specific data rights:

• Right to access — Request a copy of all personal data we hold.
• Right to deletion — Request that personal data be erased.
• Right to rectification — Request corrections to inaccurate data.
• Right to data portability — Receive data in a machine-readable format.
• Right to restrict processing — Limit how data is used.
• Right to object — Object to specific types of processing.

You can request a data export from the Privacy section of the Supportify app (or contact us directly). The export includes:

• All customer chat sessions and messages
• Support tickets
• Customer data stored in our system
• Billing records

The export is provided as a ZIP file and is available for download for 30 days.

If you uninstall Supportify from your Shopify store, here's what happens:

1. The chat widget disappears from your storefront immediately, and your email and social channels stop being read.
2. Billing stops — your Shopify subscription is cancelled and no further charges are made.
3. 48 hours later, your data is deleted — Shopify then asks us to erase your store's data, and we delete your conversations, messages, tickets, chatbot configuration, tools and knowledge base documents.
4. OAuth connections are revoked — if you connected Gmail or Outlook, we revoke our access and delete the tokens.

A quick overview of how we keep your data safe:

• Encryption in transit and for credentials — All traffic is encrypted with TLS. Access tokens for Shopify, Gmail, Outlook and other integrations are encrypted with AES-256-GCM.
• EU hosting — Our servers and database run in the EU (Amsterdam). AI processing happens mainly in the US, with every provider listed on our sub-processor page.
• No credit card storage — Billing goes through Shopify or Stripe. We never see or store card numbers.
• Rate limiting — API endpoints are rate-limited to prevent abuse.
• Audit logging — Billing operations and the actions Supportify staff take in our admin tools are logged.
• Webhook verification — All Shopify webhooks are verified using HMAC signatures.

The full list of measures is in our data processing agreement.