Get Started

Privacy Policy | HumAssistant AI Chatbot & Live Chat (Shopify App)

AI Chatbot for Shopify Stores

Last Updated: April 2026

1. Introduction

This Privacy Policy describes how the HumAssistant app (“we,” “our,” or “the App”), developed and operated by HumCommerce, collects, uses, and protects your information when you use our Shopify application that provides an AI-powered chatbot for your Shopify store.

By installing and using this App, you agree to the collection and use of information in accordance with this policy.

Important: We do not sell, rent, or monetize your merchant or customer data. We act solely as a data processor to provide AI chatbot functionality on your storefront.

This policy does not apply to third parties that HumCommerce does not own or control.

2. Information We Collect

2.1 Shopify API Permissions

During installation, the App requests the following Shopify API access scopes to function properly:
  • read_products: To provide product information and recommendations to customers via the chatbot
  • read_orders: To assist customers with order-related queries (status, tracking, history)
  • read_customers: To personalize chatbot responses for logged-in customers
  • read_inventory: To provide accurate stock availability information to customers
  • read_locations: To answer location and store-related queries
  • read_content: To use store content (FAQs, policies, pages) as knowledge for the chatbot
  • read_themes: To embed the chatbot widget into your storefront

You explicitly grant these permissions during the OAuth installation process. You can revoke access at any time by uninstalling the App.

2.2 Shopify Store Data

Based on the granted permissions, we collect and process the following data from your Shopify store through the Shopify API:

Products and Catalog

  • Product information (names, descriptions, prices, SKUs, images, variants)
  • Product categories, collections, and tags
  • Inventory levels and availability
  • Product metadata used by the chatbot for recommendations

Orders (when needed for customer queries)

  • Order details (order numbers, dates, statuses)
  • Order line items, fulfillment, and tracking information
  • Customer-order associations (only when a customer is authenticated and queries their own order)

Customers

  • Customer names and email addresses (for personalization, when logged in)
  • Customer purchase history (to provide context-aware recommendations)

Store Content

  • FAQ pages, policies, blog posts, and other public content
  • Theme and storefront information needed to render the chatbot widget

2.3 Chat Conversation Data

When customers interact with the HumAssistant chatbot, we collect:
  • Chat messages and queries entered by the customer
  • Bot responses and suggestions provided
  • Conversation timestamps and session identifiers
  • Anonymized session metadata (browser type, device type, locale)
  • Optional feedback (thumbs up/down ratings on responses)

Note: We do not collect customer email addresses, credit card information, or full addresses through chat conversations unless the customer voluntarily provides
such information in the course of a query. Chat sessions are associated with anonymous session IDs unless the customer is logged into the merchant’s store.

2.4 AI / Vector Database Data

To enable intelligent search and conversational responses, the App processes:
  • Vector embeddings of your product catalog and store content (stored in ChromaDB)
  • Semantic search indexes built from your products, FAQs, and policies
  • Conversation context used to maintain coherent multi-turn dialogues

2.5 Merchant Account Information

When you install the App, we collect:
  • Your Shopify shop domain
  • Merchant email address and name
  • Shopify access tokens (for API communication)
  • App configuration settings (chatbot persona, branding, enabled features)
  • Store subscription status and plan details
  • Locale, timezone, and currency preferences

2.6 Logs and Activity Data

We maintain logs of:
  • Chatbot activity, queries received, and responses sent
  • Error messages and troubleshooting information
  • API calls between the chatbot, Integration Hub Core App, and Shopify
  • Aggregate usage analytics (number of conversations, popular queries, response times)
  • System performance metrics

3. How We Use Your Information

3.1 Core Functionality

  • AI Chatbot Responses: Use product, order, and content data to answer customer queries on your storefront
  • Product Recommendations: Provide personalized product recommendations using semantic search and embeddings
  • Order Support: Help authenticated customers with order status, tracking, and history queries
  • Knowledge Base Q&A: Answer customer questions using your FAQs, policies, and store content
  • Conversation Continuity: Maintain context across a chat session for natural multi-turn conversations

3.2 Service Improvement

  • Troubleshooting: Diagnose and resolve chatbot issues
  • Model Tuning: Use anonymized and aggregated query patterns to improve chatbot accuracy
  • Performance Monitoring: Monitor response times, accuracy, and user satisfaction
  • Feature Development: Understand usage patterns to improve the App

Note: We do not use your customer data or chat conversations to train third-party general-purpose AI models. Conversation data is used only to improve chatbot
performance for the HumAssistant service.

3.3 Compliance and Legal

  • Privacy Requests: Respond to customer data requests and deletion requests as required by law
  • Legal Compliance: Comply with applicable privacy laws and regulations

3.4 Legal Basis for Processing (GDPR Article 6)

We process your data on the following legal bases:
  • Contractual Necessity (Art. 6(1)(b) GDPR): To fulfill our contract with you and provide chatbot functionality based on your configured settings
  • Legitimate Interests (Art. 6(1)(f) GDPR): To improve service quality, ensure security, and prevent abuse
  • Consent (Art. 6(1)(a) GDPR): Where required, for optional features such as marketing communications
  • Legal Obligation (Art. 6(1)(c) GDPR): To comply with applicable laws and regulations

4. Data Storage and Security

4.1 Data Storage

  • All data is stored securely on our servers using industry-standard encryption
  • All data is stored securely on our servers using industry-standard encryption
  • Chat conversation history and configuration data is stored in MongoDB
  • Shopify access tokens are encrypted at rest using AWS Secrets Manager
  • Static assets (chatbot widget JS, branding) are stored on Amazon S3 / Google Cloud Platform
  • Database access is restricted and monitored

4.2 Security Measures

  • Encryption: Sensitive data, including access tokens, is encrypted in transit and at rest using secure encryption algorithms
  • Access Controls: Access is limited to personnel necessary for service operation; all access is logged and regularly audited
  • Secure Transmission: All data transmitted between our servers and Shopify uses HTTPS/TLS encryption
  • Token Management:Shopify access tokens are securely stored and managed via AWS Secrets Manager
  • Monitoring:We monitor our systems for security threats, conduct regular security audits, and apply updates promptly

While we use commercially reasonable means to secure information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee that information will not be improperly accessed, disclosed, or destroyed by breach of any of our safeguards.

4.3 Data Location

Your data is stored on secure cloud servers (AWS / GCP). Data may be processed in both EU and non-EU regions depending on infrastructure configuration. For transfers to third countries, we rely on EU Standard Contractual Clauses (SCCs) and other appropriate safeguards to ensure compliance with applicable data protection laws.

5. Third-Party Integrations

5.1 Shopify

  • The App integrates with Shopify to access your store data via Shopify’s APIs
  • We only access data that you authorize through the Shopify OAuth process
  • Your relationship with Shopify is governed by Shopify’s Terms of Service and Privacy Policy

5.2 HumCommerce Integration Hub

  • HumAssistant connects to the HumCommerce Integration Hub Core Application as an intermediary between the Shopify App and the AI chatbot backend
  • All data flows are governed by this Privacy Policy and the Integration Hub’s data handling practices

5.3 AI / Language Model Providers

  • The App uses large language models (LLMs) to generate chatbot responses
  • Customer queries and relevant store context are sent to LLM providers solely to generate responses
  • We have data processing agreements with our LLM providers to ensure your data is not used to train their public models
  • We do not share personally identifiable information (PII) with LLM providers beyond what is necessary to answer the query

5.4 Cloud Infrastructure Providers

  • We use Amazon Web Services (AWS) for secrets management, asset storage, and hosting
  • We use Google Cloud Platform (GCP) for asset storage where applicable
  • These providers act as sub-processors and are contractually bound by data protection obligations equivalent to ours

5.5 No Other Third Parties

We do not sell, rent, or share your data with any third parties except as necessary to provide the App’s core functionality (Shopify, our LLM providers, and our cloud infrastructure providers).

6. Merchant vs Customer Data

6.1 Merchant Data

  • Definition: Data related to you as the store owner (shop configuration, app settings, chatbot persona, knowledge base content)
  • Control: You are the data owner; we are the data processor
  • Usage: Used solely to provide the chatbot service
  • Not Sold: We never sell, rent, or monetize merchant data

6.2 Customer Data

  • Definition: Data related to your store’s customers (names, emails, chat conversations, order history viewed via the chatbot)
  • Control: You are the data controller; we are the data processor acting on your behalf
  • Usage: Processed only to provide chatbot responses and improve the service for your store
  • Not Sold: We never sell, rent, or monetize customer data
  • GDPR Rights: Customer data deletion requests are honored automatically via Shopify’s mandatory compliance webhooks

6.3 Data Controller and Processor Relationship

Under GDPR and similar privacy laws:
  • You (the Merchant) are the Data Controller for your customer data
  • We (HumCommerce) are the Data Processor acting on your instructions
  • We process data only as necessary to provide the chatbot service
  • We do not use customer data for any purpose other than facilitating chatbot interactions on your store
  • A Data Processing Agreement (DPA) is available upon request to govern our role as a processor

7. Data Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal data to third parties, except:
  • To LLM Providers: Customer queries and necessary store context are sent to our LLM providers solely to generate chatbot responses
  • To Shopify: Data access is through Shopify’s API as authorized by you
  • Legal Requirements: We may disclose data if required by law or in response to valid legal requests, including to meet national security or law enforcement requirements
  • Service Providers (Agents): We use trusted cloud infrastructure providers (AWS, GCP) to operate our services; they are contractually bound to provide the same level of privacy protection as set forth in this policy
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, customer information may be transferred to the successor entity, which will continue to honor this Privacy Policy

8. Your Rights and Choices

8.1 Access to Your Data

  • You can access your store’s chatbot configuration and analytics through the HumAssistant Dashboard
  • You can view conversation logs and chatbot performance metrics
  • You can export your knowledge base and configuration data
  • You can request access to personal information we hold about you by contacting us

8.2 Data Deletion

  • Uninstall the App: When you uninstall the App from your Shopify store, we will delete your data as required by Shopify’s policies
  • Shop Redaction: After app uninstallation, Shopify sends a shop redaction request, and we will permanently delete your data within the required timeframe
  • Customer Redaction: We honor customer data deletion requests received through Shopify’s privacy webhooks
  • Manual Deletion: You can contact us to request deletion of your data

8.3 Data Correction

  • You can update your chatbot configuration, persona, and knowledge base at any time through the App settings
  • You can edit or remove specific conversations or training content via the Dashboard
  • You can request correction of inaccurate or incomplete personal information by contacting us

8.4 Revoke Access

  • You can revoke App access at any time by uninstalling the App from your Shopify admin
  • Uninstalling will stop the chatbot from operating and initiate data deletion procedures

8.5 Additional Rights for EU/EEA and UK Residents

If you are located in the European Economic Area or the United Kingdom, you have additional rights under the GDPR / UK GDPR, including:
  • The right to object to processing based on legitimate interests
  • The right to data portability (receive your data in a machine-readable format)
  • The right to restrict processing in certain circumstances
  • The right to lodge a complaint with a supervisory authority

8.6 California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the CCPA/CPRA, including:
  • The right to know what personal information is collected and how it is used
  • The right to delete personal information collected from you
  • The right to opt out of the sale or sharing of personal information (note: we do not sell or share personal information for cross-context behavioral advertising)
  • The right to non-discrimination for exercising your privacy rights

9. Data Retention

  • Active Accounts: We retain your data for as long as the App is installed and active on your Shopify store
  • After Uninstallation: After you uninstall the App, we retain data only as necessary to comply with legal obligations and resolve disputes. Data is then permanently deleted within 48–72 hours of uninstallation (as per Shopify’s shop redaction webhook)
  • Chat Conversations: Conversation logs are retained for up to 90 days for troubleshooting and service improvement, then automatically deleted or anonymized
  • Logs: Error logs and activity logs may be retained for a limited period (up to 90 days) for troubleshooting purposes
  • Vector Embeddings: Embeddings derived from your store content are deleted when the App is uninstalled