Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how [YOUR LEGAL ENTITY NAME] (ABN [ABN]) (StoreChat AI, we, us) collects, holds, uses and discloses personal information, and how we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

It covers two groups of people: the merchants and their staff who install and use StoreChat AI (the Service), and the shoppers who chat with the assistant on a merchant's store. Much of the shopper information we handle is processed on behalf of the merchant whose store it relates to. That merchant is responsible for its own privacy policy and for telling its shoppers how their information is handled; this policy explains what we do with it. Where this policy and a merchant's own policy both apply, this one governs our handling only.

2. The personal information we collect and hold

From merchants (account holders): your name, email address, store/website domain, login credentials (passwords are stored only as a one-way hash — we never see or keep the plain password), your plan and usage records, and the content of any support messages you send us. Payment card details are handled by Shopify or our payment provider — we do not collect or store full card numbers.

From shoppers (via the chat widget, on the merchant's behalf): the messages they send the assistant and any personal information they choose to put in them; details a shopper provides for a specific action — for example an email address and order number or postcode to look up an order, or contact details submitted through lead capture; and a randomly generated visitor/session identifier used to keep a conversation continuous.

Synced from the merchant's store: to answer questions we sync store data through the store platform's authorised API. This includes catalogue and content data, and — for order lookup — order records that may contain a customer's name, email, order status and shipping city/state.

Collected automatically: technical and usage information such as log data, approximate location derived from IP address, device/browser type, and how the Service is used, for security, diagnostics and improving the Service.

Sensitive information: we do not seek sensitive information (as defined in the Privacy Act) and shoppers should not enter it into the chat. If sensitive information is provided to us anyway, we handle it in accordance with this policy and the APPs.

3. How we collect personal information

• directly from you when you install the Service, create or manage an account, choose a plan, or contact support;
• from shoppers when they interact with the chat widget on a merchant's store;
• from the merchant's store platform (such as Shopify) via its authorised API, using access the merchant grants at install; and
• automatically through your and shoppers' use of the Service, as described above.

Where it is reasonable and practicable, we collect personal information directly from the individual it concerns. Some shopper information reaches us indirectly through the merchant's store — the merchant is responsible for having a lawful basis to provide it and for any notices or consents required where it sells.

4. Why we collect, hold, use and disclose it

We use personal information for the purposes for which it was collected and related purposes you would reasonably expect, including to:

• provide, operate and maintain the Service and generate the assistant's answers;
• send chat content and store data to third-party AI providers so a response can be generated (see clause 5);
• verify and look up orders when a shopper requests it, and capture and forward leads to the relevant merchant;
• set up accounts, manage plans and usage, and provide support;
• secure, monitor, troubleshoot, analyse and improve the Service; and
• meet our legal, tax and regulatory obligations.

We do not sell personal information. We do not use chat content or store data to train our own AI models, and we use third-party AI providers under commercial terms that do not use the data we send them to train their models. We only use or disclose personal information for another purpose where the law permits (for example, with consent, or where required or authorised by law).

5. Who we disclose it to

We disclose personal information to:

• the merchant whose store a shopper interacted with — shopper chat data, leads and order-lookup activity are made available to that merchant in its dashboard;
• our service providers (sub-processors) who help us run the Service, currently including the store platform ([Shopify]), our AI provider ([Anthropic / Claude]), our transactional email provider ([Postmark]) and our cloud hosting provider ([hosting provider]). They may only use the information to provide their service to us;
• professional advisers, or a buyer, in connection with a business sale, restructure or advice, subject to confidentiality; and
• others where required or authorised by law, or to protect the rights, safety or property of any person.

6. Overseas disclosure

Some of our service providers are located, or store data, outside Australia. This means personal information may be disclosed to, or accessed from, overseas recipients — likely in the [United States][ and other countries where our providers operate]. Before disclosing personal information overseas we take steps that are reasonable in the circumstances to have the recipient handle it consistently with the APPs. By using the Service you acknowledge that, to the extent an overseas recipient handles your information other than in accordance with the APPs, APP 8.1 may not apply.

7. Direct marketing

We may send merchants service messages (such as billing, security and product notices) and, where permitted, occasional marketing about StoreChat AI. You can opt out of marketing at any time using the unsubscribe link or by contacting us, and we'll action it promptly. We do not use shopper information for our own direct marketing. Any marketing also complies with the Spam Act 2003 (Cth).

8. Cookies, storage and tracking

The chat widget stores a small identifier and session data in the shopper's browser (for example in local storage) so a conversation stays continuous and the widget works correctly. We and our providers may use log data and similar technologies for security and to understand and improve how the Service is used. Shoppers can clear this data through their browser; doing so may reset an in-progress chat.

9. How we keep information secure

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure — including encryption of data in transit, one-way hashing of passwords, access controls, and use of reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. We also take reasonable steps to destroy or de-identify personal information when it is no longer needed for any purpose for which it may be used or disclosed and we are not required by law to keep it.

10. How long we keep it

We keep personal information for as long as needed to provide the Service and for the purposes described in this policy — generally while your account is active — and afterwards only as long as we need it to meet legal, tax, accounting or dispute-resolution obligations, after which we delete or de-identify it. Merchants may request deletion of their account data; some records may be retained where the law requires.

11. Accessing and correcting your information

You may ask us for access to the personal information we hold about you, and to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details in clause 14. We will respond within a reasonable time (usually within 30 days), and may need to verify your identity first. Access is generally free, though we may charge a reasonable cost for retrieving and supplying it; there is no charge to make a request or a correction. If we refuse access or correction, we'll explain why and how you can complain.

Because much shopper information is held on a merchant's behalf, if you are a shopper we may need to refer your access, correction or deletion request to the merchant whose store you used, and we'll help facilitate it where we can.

12. Data breaches

We comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). If a data breach involving personal information is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law, and take reasonable steps to contain and remediate it.

13. Complaints

If you think we have breached the APPs or mishandled your personal information, please contact us first using the details below so we can try to resolve it. We will acknowledge your complaint and aim to respond within a reasonable time (usually 30 days). If you are not satisfied with our response, you can complain to the OAIC: www.oaic.gov.au, phone 1300 363 992.

14. Contact us

For privacy questions, requests or complaints, contact our privacy contact:

[YOUR LEGAL ENTITY NAME]
Email: [privacy@yourdomain.com]
Post: [postal address]

15. Children

The Service is a business tool and is not directed at children. We do not knowingly collect personal information from children. Shoppers who use a merchant's chat should meet the minimum age set by that merchant and its region.

16. Changes to this policy

We may update this policy from time to time to reflect changes to our practices or the law. The current version is always available at this page, with the "last updated" date at the top. If a change is material we'll take reasonable steps to notify merchants (for example, in-app or by email). Continuing to use the Service after a change takes effect means you accept the updated policy.