Privacy Policy

1. Overview

Zactar ("we", "our", or "us") provides customer support workflow software for Shopify merchants through a browser extension and backend API services. This Privacy Policy describes how we collect, use, process, and protect your information and that of your customers when you install and use our services.

2. Shopify Protected Customer Data & Scope of Access

When a merchant authorizes Zactar on Shopify, we request access to orders, fulfillments, and customer contact details strictly for the purpose of Customer Support. Specifically:

• Order Context: Order number, line items, fulfillment status, tracking numbers, and delivery checkpoint events.
• Customer Details: Customer name, email address, phone number, and shipping address to match inbound support threads and surface order context.
• Minimal Storage: Customer order details retrieved from Shopify are processed primarily in memory to generate support drafts and context panels. Beyond short-lived encrypted caching and pseudonymised security/audit logs described in Section 6, we do not maintain a permanent database of your customers' personal profiles.

3. Browser Extension & Email Data Handling

Our browser extension runs locally in your browser. When viewing a message in a supported webmail inbox (such as Gmail, Yahoo Mail, Outlook, Zoho Mail, etc.), it identifies the sender email or order number to query context from your connected Shopify store. Zactar:

• Does NOT read, scan, or index unrelated messages in your personal inbox.
• Does NOT sell, rent, or monetize email or customer data.
• Does NOT automatically send emails or execute order mutations without merchant review or authorization.

4. AI Processing & Infrastructure Subprocessors

We use enterprise AI model APIs (such as Google Cloud / Gemini, OpenAI, or Anthropic) and cloud hosting providers (such as DigitalOcean) to generate draft replies and operate our backend. Customer inquiry text and relevant order facts are transmitted over encrypted TLS connections to enterprise API endpoints configured not to train public foundation models on API inputs. We may engage or update reputable cloud and AI subprocessors as needed to maintain and improve the service, and we may use aggregated, de-identified usage telemetry to improve our product.

5. GDPR, CCPA & Shopify Mandatory Webhooks

Merchants act as the data controller for their store customers' personal data, and Zactar acts as a data processor on the merchant's instructions. We honor Shopify's mandatory privacy compliance webhooks:

• customers/data_request: Reports any stored customer records associated with a shop.
• customers/redact: Deletes or anonymizes that customer's associated log/cache entries.
• shop/redact: Purges active merchant tokens, settings, and cached store data following app uninstallation in accordance with Shopify's webhook lifecycle.

6. Data Retention

We retain data only as long as reasonably necessary to provide and secure the service:

• Email content & draft cache: Inbound email text is processed in memory to produce a draft. Generated drafts and associated order context may be held in a short-lived encrypted cache (typically around 1 hour) so reopening the same thread is fast, after which they expire automatically.
• Access & security logs: Lookups of customer data are logged with pseudonymised (keyed one-way hashed) identifiers for security and audit purposes and rotated out automatically (typically within 90 days, or earlier upon redaction requests).
• Store records & backups: Store access tokens, paired browsers, and settings are revoked on uninstall and purged via shop/redact. Encrypted infrastructure backups rotate out automatically on our cloud provider's standard retention cycle. Aggregated, non-identifiable usage counts and billing records are retained as needed for accounting, analytics, and legal compliance.

7. Security & Changes

• Encryption & isolation: All traffic uses HTTPS/TLS. Shopify access tokens and cached drafts are encrypted at rest (authenticated AES encryption), and testing environments are kept separate from production data.
• Access control & incident response: Production systems are restricted to authorized operator access over SSH keys and two-factor authentication. If we confirm a material security breach affecting personal data, we will take prompt containment measures and notify affected merchants without undue delay as required by applicable law.
• Policy updates: We may update this Privacy Policy from time to time by posting the revised version on this page and updating the date above.

8. Contact Us

If you have any questions or data requests, contact us at: support@zactar.com.