Legal

Privacy Policy

Effective August 31, 2026

Cartfilo ("Cartfilo," "we," "us") is an AI shopping-assistant chat app that Shopify merchants install on their storefront. This page explains what personal data we collect through the app, why, how long we keep it, how we secure it, and how you or your shoppers can exercise your data rights. It applies to the storefront widget, the admin dashboard, and this website.

We wrote this policy to describe what the app actually does, not a generic template — if a section below stops matching the product, treat the product as wrong and tell us (privacy@cartfilo.com).

Information we collect

From your Shopify store, through Shopify's API

When you install Cartfilo, Shopify grants us read-only access to:

• Products, inventory, and collections — to index your catalog so the assistant can search and recommend from it. We never write to your catalog.
• Orders — order ID, total price, currency, and timestamp, so we can calculate real conversion and revenue metrics on your dashboard instead of estimates. When a chat session leads to a purchase, we resolve which order came from which conversation.
• Customers — used specifically to match a shopper who's given us their email (through the contact-capture form described below, or on an order) to their existing Shopify customer record. This lets your support staff see who they're talking to, and lets us reject an obviously fake contact email before your staff waste time on it. We request and store name, email, and phone only — never a customer's address.

We never request permission to modify your products, orders, or customers.

From you, the merchant, directly

At install, Shopify gives us your store's name and domain, and your store's contact name, email, phone number, and business address (the same contact details on file with Shopify for your store — we don't ask you to re-enter them). We use this to operate your account, send billing and handoff-notification email, and provide support — never to market to your shoppers.

If you configure store-specific settings — an FAQ, brand aliases, office hours, saved replies, your own SMTP credentials — that content is stored to power those features and is visible only inside your own admin.

From shoppers using the chat widget

Cartfilo doesn't require a shopper to create an account. What we collect depends on how far the conversation goes:

• Chat messages. What a shopper types is processed to search your catalog, answer questions, and build a cart. It's stored against an anonymous browser session for your plan's retention window (see below), then deleted.
• A device identifier and a session identifier. Generated by the widget and stored in your browser's localStorage (device, persists across visits) and sessionStorage (conversation session, cleared when the tab closes) — not a tracking cookie, and not used for advertising or cross-site tracking. We don't use cookies at all.
• Contact details, only if offered. If a shopper's conversation is handed to a human and no one is immediately available, the widget shows a short form asking for a name (optional), an email (required), and a phone number (optional), so your team can follow up by email or phone. Obviously disposable/throwaway email domains are rejected at that point rather than stored as a real lead.
• A match to a real Shopify customer, only if one exists. If the email given above (or on a completed order) matches an existing Shopify customer, we link that conversation to that customer record using the read-only lookup described above. If it doesn't match anything, nothing further happens.

We do not sell shopper or customer data, and we do not use it to build advertising profiles.

How we use information

We use the data above to:

• Search your catalog and generate cart recommendations in response to what a shopper types.
• Route a conversation to your team when the assistant can't handle it, and let your team reply.
• Calculate the dashboard's usage, conversion, and revenue metrics.
• Bill your store according to your plan.
• Flag a contact-capture lead as possibly fraudulent (an obviously fake email, or a customer with an unusually high refund rate) for your staff's own judgment — this is a visible signal only. We never automatically block a shopper based on it.
• Operate, secure, and support the app itself (debugging, fraud prevention, and responding to your support requests).

AI processing

To interpret a shopper's message and pick relevant products, the message text is sent to a third-party AI language-model API. The specific provider currently configured is Google Gemini, with Anthropic and OpenAI available as automatic failover if the primary provider is unavailable — the exact provider or providers active at any given time is a configuration detail, not a fixed commitment to one vendor.

The model is never sent a shopper or customer's name, email, phone number, or Shopify customer identity — those fields are resolved separately, inside our own database, and never appear in what we send the model. What the model does receive is the shopper's raw message text and a numbered list of candidate products (names, prices, stock); it responds with indices into that list, and we fill in the real product data from our own database afterward — the model never invents or is trusted with pricing or stock data directly. No merchant or shopper data is used to train any third-party model.

Data retention

Chat conversations and messages are kept for a fixed window tied to your plan, then permanently deleted:

A linked Shopify customer record (name, email, phone), and order data used for revenue reporting, are kept for as long as your store is installed, or until deleted under the rights described below — whichever comes first. Uninstalling the app stops all further processing and starts the deletion described in the next section.

Your rights, and Shopify's mandatory data requests

As a Shopify app, we implement Shopify's three mandatory compliance webhooks, and apply them the same way for every merchant and shopper regardless of where they're located — not only where a specific privacy law happens to require it:

• Data request. When a customer asks a merchant for a copy of their data, Shopify notifies us and we email the store owner a full export of what we hold on that customer — name, email, phone, and their order history with us — within Shopify's 30-day window.
• Customer redaction. When a merchant asks us to delete a specific customer's data, we permanently delete that customer's stored identity record and every conversation and message linked to them.
• Shop redaction. Roughly 48 hours after a merchant uninstalls Cartfilo, Shopify notifies us and we permanently delete that store's conversation history and the store's account with us entirely.

You don't have to wait for one of these flows: email privacy@cartfilo.com directly to ask what we hold about you or a shopper, or to have it deleted, and we'll act within 30 days.

Security

Specifically, not just "industry-standard security":

• Shopper and customer identity fields — name, email, phone, and the browser IP captured from an order — are encrypted at rest with AES-GCM, using an encryption key kept separate from the key that encrypts Shopify API access tokens, so a compromise of one doesn't expose the other.
• Email addresses are also indexed with a keyed HMAC, so we can recognize a returning shopper by email without ever storing or querying a plaintext email column for that lookup.
• Every merchant's data is isolated at the database level — a request scoped to one store cannot read another store's data, enforced by the database itself, not just application code.
• Application logs are restricted to store, session, and conversation identifiers. Message text, names, emails, and addresses are never written to logs.

No system is unbreakable, and we won't claim otherwise. If you believe you've found a security issue, email privacy@cartfilo.com and we'll respond directly.

Who we share data with

We don't sell personal data. We share it only with:

• Shopify — as required for the app to function on their platform.
• Our AI language-model provider(s) — described above, message text only.
• Your own SMTP provider — only if you've configured one under your store's email settings, so handoff-notification email is sent from your own domain instead of ours.

We don't use third-party analytics or advertising trackers on the storefront widget.

International data

Data is processed and stored on infrastructure we operate, regardless of where your store or shoppers are located. If that infrastructure is outside your country, your data is transferred internationally to reach it, in the same way installing any cloud-based Shopify app requires.

Children's privacy

Cartfilo is a tool for Shopify merchants and their shoppers, and isn't directed at children. We don't knowingly collect personal data from anyone we know to be under 16 through the chat widget.

Changes to this policy

If how we handle data changes, we'll update this page and change the effective date above. We won't quietly narrow your rights or expand what we collect without reflecting it here first.

Contact

Questions about this policy, or a request about your data: privacy@cartfilo.com