This policy explains what personal data ChatMerchant handles, why, and what your choices are. ChatMerchant connects your Shopify store to ChatGPT. The data controller is Anderseen OÜ, a company registered in Estonia. You can reach us at the address at the end of this page.
In short
We keep the minimum needed to run the connection. We do not store your prompts or your ChatGPT conversations. The only copy of your products we keep is the ChatGPT Ads feed file, and only if you create one. We do not sell data and we do not run advertising trackers.
What we collect and store
- Store details from Shopify. Your store address (your-store.myshopify.com) and the store contact email Shopify gives us when you install the app.
- Shopify access tokens. The tokens Shopify issues when you install the app, stored so ChatMerchant can act in your store when you ask. They are used for nothing else.
- Sign-in records for connected apps. When you connect ChatGPT, we store which app connected, the permission it was given, and when. The access codes themselves are stored only as one-way hashes.
- A usage log. For each action ChatGPT performs we record your account, the name of the tool that ran and the time. We do not record what you typed or what the tool returned. These entries are deleted after 30 days.
- Optional keys you add yourself. If you add an OpenRouter API key for image generation, or connect your Google account for Search Console or Analytics data, we store that key or Google access so those features work. You can remove them at any time.
- ChatGPT Ads feeds (only if you create one). A feed is a text file of the products in the collection you choose: titles, descriptions, prices, images, links and stock status. It is saved at a private web address that ChatGPT Ads reads, and refreshed about once a day. It contains the same product information your online store shows publicly.
- Messages you send us. If you use the contact form we receive your name, email address and message.
- Technical logs. Our servers keep short-lived logs of errors and security events to keep the Service working and safe.
What we do not store
We do not store the text of your ChatGPT conversations, and we do not keep copies of your products, pages or other store data, with one exception: the ChatGPT Ads feed file you ask us to create. When ChatGPT asks for store data, we fetch it from Shopify at that moment and pass it back to ChatGPT. We do not keep it.
Why we use your data
- to provide and operate the Service, including connecting ChatGPT to your store (performance of our contract with you);
- to keep the Service secure and prevent misuse (our legitimate interest);
- to answer your questions and support requests (our contract and legitimate interest);
- to meet legal and billing obligations (legal obligation).
Data that goes to ChatGPT
When you ask ChatGPT to look at or change your store, the information it needs, such as product text, prices or page content, is sent from your store through ChatMerchant to ChatGPT. From that point OpenAI processes it under its own terms and privacy policy, and under your own ChatGPT settings. Only connect ChatMerchant to a ChatGPT account you control, and be mindful of what you ask it to read.
Who else receives data
- Shopify, because the Service works through your Shopify store.
- OpenAI, as described above, when you use ChatGPT with the connector.
- OpenRouter, only if you add your own key and ask for image generation. Prompts for the image are sent to OpenRouter using your key.
- Google, only if you connect Google Search Console or Analytics. We read the reports you ask for.
- Our hosting and email providers, who process data on our behalf to run the website and to receive messages sent through the contact form.
We do not sell your data and we do not share it with advertisers. Some of these providers are outside the European Economic Area, for example in the United States. Where this applies, transfers rely on appropriate safeguards such as the European Commission's standard contractual clauses or an adequacy decision.
Cookies
We use a session cookie to keep you signed in to your dashboard and short-lived security cookies during sign-in. We do not use advertising or tracking cookies on this site.
How long we keep data
- Account and store details: while the app is installed. After you uninstall the app we delete or anonymise them within 30 days, unless the law requires us to keep something longer (for example billing records).
- Usage log entries: 30 days.
- ChatGPT Ads feeds: until you delete the feed, or the app is uninstalled, whichever comes first.
- Contact messages: as long as needed to answer you and keep a reasonable record.
Your rights
Under the GDPR you have the right to access, correct or delete your personal data, to restrict or object to its use, and to receive a copy of it. To use any of these rights, contact us. You can also delete most data yourself: sign ChatGPT out under Connected apps, remove optional keys under Integrations, or uninstall the app in Shopify.
If you are unhappy with how we handle your data you can complain to your local data protection authority. In Estonia this is the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).
Information about your customers
ChatMerchant does not ask for access to your customers' or orders' personal data, and does not keep any. If Shopify tells us a customer has asked for their data to be deleted or exported, we confirm that we hold none. When a store uninstalls the app, we act on Shopify's data deletion requests.
Children
The Service is for merchants and is not aimed at children.
Changes to this policy
We may update this policy. The date at the top shows when it last changed.