Privacy Policy

1. Information We Collect

We act as a Data Processor for the storefront customer data you import or provide, and a Data Controller for the data relating to your merchant account.

A. Merchant Account Information (Data Controller)

• Registration details: Email address, name, password, profile image, and user ID.
• Store details: Domain (e.g. store.myshopify.com), store name, and offline Shopify OAuth access tokens.
• Billing data: Merchant subscription plan status, merchant customer ID, and transaction records.
• Consent and Security Logs: State of Terms of Service and Privacy Policy acceptance, timestamp of agreement, and the registration IP address (to maintain a compliance audit trail).

B. Customer and Telephony Data (Data Processor)

When a customer interacts with your AI voice assistant, we collect:

• Caller Phone Number: To establish connections, lookup orders, and link call histories.
• Audio Recordings: Voice data of both the customer and the AI agent during call sessions.
• Call Transcripts and Summaries: Text transcripts generated in real-time and structural summaries.
• Shopify Store Data: Dynamic info fetched during calls, including customer emails, order statuses, tracking numbers, catalog data, and shipping addresses.
• Support Tickets: Subjects, descriptions, customer contact logs, and statuses for escalations.

2. How We Use the Information

We process this information to:

1. Provide, maintain, and improve our AI voice agents.
2. Authenticate merchants and authorize secure calls to the Shopify REST/GraphQL APIs.
3. Transcribe speech, evaluate intent, and generate voice responses in real time.
4. Calculate and enforce subscription quotas (minutes limits, connected stores, active assistants).
5. Generate and track support tickets created during calls.
6. Trigger automated abandoned cart recovery calls.

3. Data Processing and Categories of Processors

To process voice calls, transcribe speech, synthesize audio responses, and evaluate customer intent, we share data with third-party service providers. By using our service, you instruct us to share relevant call data and customer details with the following categories of processors:

We maintain data processing agreements with these providers to ensure your data is kept secure and used only for the purpose of executing voice calls.

4. Call Recordings and Data Retention

Storage: Call recordings (MP3/WAV format) and transcripts are hosted in secure cloud storage buckets managed by our third-party telephony providers and indexed in our local PostgreSQL database.

Default Retention Policy:

• Audio Recording Files: In line with our third-party telephony providers' policies for usage-based plans, raw audio recording files (MP3/WAV) are retained for fourteen (14) daysafter a call is completed, after which they are automatically and permanently deleted from our telephony partners' servers. Following this 14-day window, call audio playbacks will no longer be available.
• Transcripts and Summaries (90-Day PII Scrub): Written transcripts, call summaries, and customer phone numbers are automatically redacted/deleted after ninety (90) days from the call date via our automated compliance cleanup systems. Only anonymized metadata (e.g., call duration, timestamps, and routing direction) is retained permanently for merchant billing and performance analytics.

Deletion:

Merchants can request the permanent deletion of specific call history records, recordings, or transcripts before the default deletion period by contacting our support team at support@thatwasai.com. Upon request, we will purge the corresponding records from our database and transmit a deletion instruction to our telephony partners to delete the audio files from their storage buckets.

If you uninstall our Shopify application or delete your account, we will purge all associated store credentials and merchant account details, and request the deactivation/deletion of your voice assistants on our partners' servers. Call records and transcripts will be queued for permanent purging within ninety (90) days, unless we are required to retain specific logs to comply with legal obligations or resolve disputes.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our Platform and maintain certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept essential cookies, you may not be able to use some parts of our Platform.

We categorize the cookies used on our website and dashboard as follows:

• Strictly Necessary (Essential) Cookies: These cookies are required for core website security, system integrity, and session authentication (e.g. keeping you logged in to your merchant dashboard). They do not collect personal information for marketing purposes, and your prior consent is not required for their installation.
• Performance, Analytics, and Advertising Cookies: We use third-party analytics and advertising services (such as Google Analytics, Microsoft Clarity, and Meta Pixel) to track traffic, page views, click behaviors, user flows, session recordings, and measure ad campaign performance. This allows us to optimize user interface designs, resolve performance bugs, and deliver relevant marketing campaigns. These cookies are non-essential, and we require your prior opt-in consent before loading these tracking scripts and placing cookies on your device.

6. Security of Your Data

We implement industry-standard security measures to protect your data. Shopify access tokens and platform credentials are encrypted in transit using SSL/TLS. Dashboard endpoints and Server Actions are protected by authentication verification checks. Our database is secured using SSL connections, strict credential pooling, and row-level access structures.

7. GDPR and CCPA Rights

If you or your customers are located in the European Economic Area (EEA), the United Kingdom, or California, you possess specific privacy rights, including the Right of Access, Rectification, and Erasure ("Right to be Forgotten").

If a customer contacts you to erase their personal data (e.g. call recording or transcript), you can forward the deletion request to support@thatwasai.com to initiate a database purge and transmit a deletion request to our third-party telephony partners.

8. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

9. Contact Us

If you have any questions about this Privacy Policy or wish to make a data access/deletion request, please contact us via email at: support@thatwasai.com.