Supportify
Start free

Legal

Privacy Policy

Last updated: October 2026

1. Introduction

Supportify AS ("Supportify", "we", "us", or "our"), organisation number 936 919 634, operates the Supportify AI platform, the Supportify Shopify application, the merchant dashboard and the Supportify iPhone app. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website and use our services, including our email channel integrations with Google Gmail, Microsoft Outlook, and other third-party services.

Two roles. When a store uses Supportify to talk to its own customers, the store decides what happens to those customers' data: it is the controller and we are its processor. That processing is governed by our Data Processing Agreement, and the companies we use for it are listed on our sub-processor page. If you are a store's customer and want to exercise your rights, contact the store; we will help it answer you. For our own merchant accounts, billing, analytics and website, we are the controller, and this policy describes what we do.

2. Information We Collect

For Merchants (Our Customers)

  • Account information: name and email address of the people on your team, store name and store URL, and how you sign in (password, Google or Shopify)
  • A phone number, if you choose to receive SMS alerts, and a device token, if you use the iPhone app
  • Billing information, processed through Shopify's billing system or, for stores not on Shopify, through Stripe. We never see or store card numbers
  • Chatbot configuration and knowledge base content you provide
  • Usage analytics (session counts, feature usage, pages visited in the dashboard and apps)

For End Customers (Shoppers)

We process this on behalf of the store the shopper is contacting (see "Two roles" above).

  • Messages sent through the Supportify widget, email, Instagram, Messenger, WhatsApp, phone or SMS
  • Email addresses, names and phone numbers the shopper gives, including an email address given to verify their identity
  • Images and files the shopper sends, including photos uploaded for virtual try-on where a store offers it
  • Call audio and transcripts, where a store uses the phone channel
  • Session metadata: IP address, browser and device type, the page being viewed, language and country

For Connected Email Channels (Gmail, Outlook)

When a merchant connects an email inbox (such as Gmail or Outlook) to Supportify, we access the following data from that inbox:

  • Inbound email messages received in the connected inbox (sender address, subject line, message body, and attachments up to 10 MB)
  • Email metadata such as message headers, thread IDs, and labels, used to maintain conversation threading and avoid processing duplicate messages
  • Account profile information (email address and display name) to identify the connected account

We do not access emails outside the connected inbox (e.g., Drafts, Spam, or Sent folders are not read). We only read new incoming messages that arrive after the integration is connected.

For Connected Shopify Stores (Admin API Data)

To let the AI assistant answer shopper questions, the Supportify Shopify app requests access to store data through the Shopify Admin API. We retrieve only what is needed to respond to a given request and do not keep long-term copies beyond what is described in "Data Retention" below. This data includes:

  • Products and catalog — products, variants, prices, inventory levels, discounts, and gift cards, used to answer product, availability, and pricing questions.
  • Custom data (metaobjects and metafields) — merchant-defined content shown on product pages, such as size guides, materials, and brand information, used so the assistant can answer detailed product questions.
  • Orders and customers — order details and the associated customer information (name, email address, shipping and billing address, phone number, and order history). This is used for order lookup, returns and complaints, order edits, draft orders, and verifying a shopper's identity before sharing order data. Customer personal data is processed only to handle the specific request at hand.
  • Store content and theme — blog posts, pages, and policies that are synchronized into the chatbot's knowledge base, and theme data used to detect widget installation.

Order and customer records are read on demand from Shopify when needed to answer a request; they are not mirrored into a separate long-term store. Any such data that appears within a conversation (for example, an order summary shared with a shopper) is subject to the conversation's retention period described below.

For Visitors to Our Website

  • The campaign parameters in the link you arrived by and the site that sent you, with your IP address and browser, recorded under a random visitor ID kept in your browser, so that we can see which campaigns lead to installs
  • Only if you accept marketing cookies: the identifiers set by the Meta Pixel and Leadsy, and the pages you visit while they are loaded (see "Cookies and Your Choice" below)
  • Anything you type into a form on the site, such as your email address or a demo booking
  • Messages you send to the chat assistant on our website

Cookies and Your Choice

The first time you visit, the website asks whether it may load two marketing tools. Neither is loaded, and nothing reads the cookies they set, until you press Accept. If you press Decline, or do not answer, neither is ever loaded, and the site works just the same.

  • Meta Pixel (Meta Platforms Ireland) — measures visits and whether our Facebook and Instagram ads led to them. It sets the _fbp cookie, and _fbc when you arrive from an ad, and with them we can tell Meta when an installation came from one of its ads (see section 6).
  • Leadsy — a visitor-identification tag that tries to recognise the company or person visiting, so that we can follow up with businesses that showed interest. It sets cookies whose names begin with _reb2b, including one holding the approximate location looked up from your IP address.

Your answer is kept in your browser's local storage, so that you are not asked on every page. You can change it at any time with , which is also at the foot of every page. If you withdraw consent after accepting, we delete what the Meta Pixel and Leadsy stored on this site and reload the page so that neither tool keeps running. Cookies these services set on their own domains can only be removed from your browser's settings.

Vercel Speed Insights, which measures how quickly our pages load, sets no cookies and stores nothing in your browser, so it runs whatever you choose. The customer ticket pages that stores' emails link to load none of these tools and do not ask.

3. How We Use Your Data

Chat and Messaging Data

Messages are processed by AI models to generate customer support responses, to decide whether an incoming email is from a customer or is spam, and to organise conversations (language, summaries, tags). The main model is Anthropic's Claude. Other providers are used for particular tasks or as a standby, and every one of them is named, with what it receives and where, on our sub-processor page. We do not use this data to train AI models, and we do not allow our AI providers to.

Email Channel Data (Gmail, Outlook)

We use data from connected email inboxes solely for the following purposes:

  • Reading inbound customer emails to generate AI-powered support responses on behalf of the merchant
  • Sending reply emails back to customers, threaded under the original conversation
  • Marking emails as read after processing to prevent duplicate responses
  • Filtering automated emails (e.g., newsletters, bounce notifications) to avoid responding to non-customer messages

Email data is processed in real time. We store the message content in our database to maintain conversation history for the merchant and to provide context for follow-up messages within the same thread.

Merchant and Website Data

We use merchant account data to provide the Service, bill for it, send service and security notices, and support you. We use usage analytics to understand which features are used and to improve them. We use website data to understand how visitors find us and to measure our advertising.

4. Data Storage and Security

Our servers, database and cache run on Fly.io in Amsterdam, the Netherlands (EU). The merchant dashboard and this website are served by Vercel, with server functions in Stockholm, Sweden (EU). Files are kept in Tigris object storage. The AI models that read and write messages mostly run in the United States, so message content is processed there under the safeguards listed on our sub-processor page.

We use TLS encryption for all data in transit. Access tokens and credentials for connected accounts (Shopify, Gmail, Outlook and other integrations) are encrypted with AES-256-GCM. The full list of security measures is Annex 2 of our Data Processing Agreement.

5. Data Retention

Chat sessions, chat messages, and associated data (including email conversation content) are automatically deleted after 2 years of inactivity, unless the store has agreed a different period with us. Files attached to conversations are deleted with them. Photos uploaded for virtual try-on are deleted after 24 hours.

Support tickets are the store's case history and are kept while the store has an account, unless the customer is erased from them under a data request. Files attached to tickets are deleted after 90 days.

When a merchant disconnects an email channel, the OAuth credentials (access and refresh tokens) are immediately deleted from our systems. Conversation history from that channel is kept for the rest of the retention period unless the merchant requests earlier deletion.

Shopify store data accessed through the Admin API (such as products, custom data/metaobjects, orders, and customer records) is read on demand to answer a specific request and is not retained as a separate long-term copy. Where such data becomes part of a chat or email conversation, it follows the same retention as the rest of the conversation. When a merchant uninstalls the app, the stored access tokens are deleted and the store's associated data is removed when Shopify sends its mandatory data-erasure (GDPR) webhook, 48 hours after uninstall.

Billing records are retained for the legally required period for accounting purposes.

6. Data Sharing

We share data with other companies only to provide and run the Service, and only as described here. We do not sell data, and we never share shoppers' data with anyone for advertising.

  • Service providers that process shoppers' data for us — hosting, AI models, email and phone delivery, and error monitoring. Each is listed with what it receives, where, and the transfer safeguard on our sub-processor page.
  • Platforms the store connects — Shopify and other e-commerce platforms, Google (Gmail API), Microsoft (Graph API), Meta (Instagram, Messenger, WhatsApp), and the carriers, warehouses and other tools the store chooses. We exchange data with them on the store's instruction, to read and send messages and act on orders.
  • Billing — Shopify, or Stripe for stores not on Shopify, receives the billing contact and usage.
  • Product analytics and error monitoring — Mixpanel (EU data residency) receives how merchants use the dashboard and apps, including the signed-in user's name and email. Sentry receives error reports from our servers, dashboard and apps.
  • Our own marketing — if you accept them, our website uses the Meta Pixel and Leadsy to measure visits and identify who visits (see "Cookies and Your Choice"), and it always uses Vercel Speed Insights to measure page performance. When a store installs Supportify or starts paying, we tell Meta through its Conversions API, sending the installer's IP address and browser, the store's domain, a hashed (not readable) store email address and, if the installer accepted marketing cookies on our website, Meta's cookies. Demo bookings go to HubSpot, and newsletter sign-ups to Klaviyo. None of these receive shoppers' data.

7. Google API Services — Limited Use Disclosure

Supportify's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we:

  • Only use Gmail data to provide and improve the AI customer support features visible in the application's user interface
  • Do not transfer Gmail data to third parties except as necessary to provide the Service (i.e., sending message content to the AI providers listed on our sub-processor page to classify it and generate responses), for security purposes, or to comply with applicable laws
  • Do not use Gmail data for serving advertisements or for retargeting, personalized, or interest-based advertising
  • Do not use Gmail data to train generalized AI or machine-learning models
  • Do not allow humans to read Gmail data unless: (a) the merchant has given affirmative consent to view specific messages (e.g., reviewing a conversation in the admin dashboard), (b) it is necessary for security purposes (e.g., investigating abuse), or (c) it is required to comply with applicable law

8. Revoking Access to Connected Email Accounts

Merchants can disconnect a connected email account at any time through the following methods:

  • From the Supportify app: Navigate to the Channels section in the Shopify admin and click "Disconnect" on the email integration. This immediately deletes the stored OAuth credentials and stops all email processing.
  • From Google Account settings: Visit myaccount.google.com/permissions and remove Supportify's access. We will detect the revocation on our next sync attempt and automatically deactivate the integration.
  • From Microsoft Account settings: Visit your Microsoft account app permissions page and remove Supportify's access.

Upon disconnection or revocation, all stored OAuth tokens are immediately and permanently deleted from our database. Conversation history from the channel is retained for the rest of the store's retention period.

9. Your Rights (GDPR)

Under GDPR, you have the right to:

  • Access your personal data
  • Rectify inaccurate personal data
  • Request erasure of your personal data
  • Restrict processing of your personal data
  • Data portability
  • Object to processing

If you contacted a store through Supportify, the store is responsible for your data, so please send your request to the store; if it reaches us, we pass it on. Shopify merchants can also submit data requests through Shopify's GDPR webhook system, which we process automatically. You also have the right to complain to a data protection authority; in Norway that is Datatilsynet.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify affected users of any material changes before they take effect. Continued use of the Service after changes are published constitutes acceptance of the updated policy.

11. Contact Us

For any privacy-related questions, to exercise your rights, or to request deletion of your data, contact us at: support@supportify.no

Supportify AS
Tordenskiolds gate 2
0160 Oslo, Norway