Privacy Policy
This Policy describes how information is handled when you use zavoka AI.
This Privacy Policy explains how zavoka AI ("zavoka," "we," or "us") collects, uses, shares, and protects information when merchants, their staff, or store visitors use our website, Shopify application, AI Sales Executive, and related services (the "Service"). By using the Service, you acknowledge this Policy. If you are a merchant, you are responsible for providing any privacy notices required for your own customers.
1. Information we handle
- Merchant and account information: store URL, work or billing email, account identifiers, Shopify connection status, subscription and payment status, and support or enterprise inquiry details.
- Store and configuration information: information made available through Shopify permissions and settings you choose, such as your assistant's name, store name, appearance, tone, welcome message, verified business notes, FAQs, policy and discount information, preferred-product settings, and widget position.
- Usage, analytics, and service information: trial dates and limits, AI chat usage counts, plan details, installation and service events, product recommendation, product-click, checkout-start, lead, and AI-attributed purchase events, plus order totals used to provide merchant-facing sales and conversion insights.
- Conversation information: messages and relevant store context submitted to the assistant may be processed to generate responses and saved with pseudonymous visitor and conversation identifiers for continuity and merchant review. Depending on the enabled configuration, requests may be sent to an AI service provider. Do not enter sensitive personal information into a chat.
- Shopper leads: if a visitor chooses to request store follow-up, we store the name and email they provide, their explicit consent, and associated visitor/conversation identifiers for the merchant.
- Shopify checkout and order information: when available through the merchant's Shopify permissions and webhooks, we process checkout identifiers, cart items and totals, order identifiers and totals, payment/fulfillment status, order-status links, and shipment tracking numbers or links to support checkout, order tracking, cart recovery, and analytics. For cart-recovery emails, we store and use a shopper email address only when Shopify indicates the shopper has subscribed to marketing.
- Technical information: information necessarily provided by your browser or hosting environment when you access the Service, such as IP address, device/browser details, and request logs, subject to the configuration of our hosting providers.
- Local browser storage and sales attribution: the storefront widget stores pseudonymous visitor and conversation identifiers in local storage for chat continuity. After a visitor sends a chat message, the widget also writes those identifiers to Shopify cart attributes so qualifying orders can be matched to that assistant conversation.
2. How we use information
We use information to provide and maintain the Service; connect a merchant's Shopify store; authenticate accounts; operate the AI assistant and dashboard; track usage and plan limits; create Shopify cart/checkout links; display order and shipment status; calculate merchant-facing sales and conversion analytics; and, when a merchant enables cart recovery, send a limited cart reminder after Shopify indicates the shopper has subscribed to marketing. We also process subscriptions and payments, provide support, send service, billing, and trial-related messages, protect the Service against fraud, abuse, and security incidents, and comply with legal obligations. Cart-recovery email settings can be disabled by the merchant, and recipients can unsubscribe using the link in each such message. Essential account, security, billing, and service notices are operational communications and may still be sent when they are necessary to provide or protect the Service.
3. How information is shared
We do not sell personal information. We share information only as reasonably needed for the purposes described in this Policy, including with:
- Shopify: to authorize the app, connect a merchant store, and provide requested Shopify features.
- Payment providers: such as Stripe, to create and manage subscriptions and payments. Payment card details are handled by the payment provider rather than stored by zavoka.
- AI service providers: when enabled, to process prompts and return AI-generated responses.
- Email delivery providers: such as Resend, to deliver merchant-requested cart-recovery emails and service, billing, or support messages. Cart-recovery emails are sent only when the merchant has enabled the feature and Shopify checkout data indicates marketing subscription.
- Hosting and database providers: to operate the website and backend and store account, checkout, order, analytics, and service records.
- Professional advisers or authorities: where necessary to comply with law, protect rights and safety, or establish, exercise, or defend legal claims.
- Business transfers: if the Service is involved in a merger, acquisition, financing, or sale, information may be transferred subject to appropriate safeguards.
Third-party providers process information under their own terms and privacy practices. Their names and roles may change as the Service evolves.
4. Merchant and shopper responsibilities
Merchants control their own storefront, Shopify configuration, product information, marketing settings, and customer-facing disclosures. Merchants are responsible for determining whether they have a lawful basis to provide shopper information to the Service and any AI or email providers, giving required notices, obtaining required consents, and responding to shopper requests relating to their store. The cart-recovery feature relies on Shopify-provided marketing-consent information and merchant settings; merchants remain responsible for ensuring its use complies with applicable marketing and privacy laws. If zavoka processes personal information on a merchant's behalf, the merchant should contact us to discuss any required data-processing terms.
5. Retention
We retain information for as long as reasonably necessary to provide the Service, maintain account and billing records, support order tracking and merchant analytics, resolve disputes, enforce agreements, and meet legal or security requirements. Checkout, order, activity, and email-suppression records may be retained for operational, unsubscribe, fraud-prevention, or legal purposes; retention periods vary by information type and purpose, and are not fixed in this Policy. Shopify access credentials are removed when the app is disconnected as described in the Service flow; other account or billing records may remain where needed for legitimate operational or legal purposes.
6. Security
We use reasonable technical and organizational safeguards intended to protect information. No internet transmission or storage system can be guaranteed completely secure. You are responsible for protecting your account credentials and notifying us promptly if you suspect unauthorized access.
7. International processing
We and our service providers may process information in countries other than the country where you or your customers are located. Data protection laws in those countries may differ. Where required, appropriate safeguards will be used for international transfers.
8. Your choices and rights
Depending on where you live, you may have rights to request access to, correction, deletion, or a copy of personal information, or to object to or restrict certain processing. You may also withdraw consent where processing is based on consent. To make a request, contact us using the details below. We may need to verify your identity and may direct shopper requests to the merchant that operates the relevant store.
You can remove the app through Shopify Admin. Disconnecting the app removes its saved Shopify access token from our service, but may not immediately delete all account, billing, or legally required records. You can also clear local storage through your browser settings; doing so may sign you out or affect the chat experience.
9. Children's privacy
The Service is intended for business users and is not directed to children. We do not knowingly collect personal information directly from children through the Service. If you believe a child has provided information to us, contact us so we can review it.
10. Changes to this Policy
We may update this Policy as our Service or legal requirements change. The revised version will be posted on this page. If a change is material, we will take reasonable steps to provide notice. Continued use after the revised Policy is posted constitutes acknowledgment of the updated Policy, where permitted by law.
11. Contact
For privacy questions or requests, contact us at contact@zavoka.com.
This Policy describes the current Service based on the available project configuration. Confirm the legal identity of the service operator, applicable jurisdictions, actual vendor settings, retention periods, and any required data-processing agreements before publication.