Privacy Policy

This policy explains what data WOLE collects, what it is used for, who else receives it, and how long it is kept. It covers Shopify merchants who install WOLE, their teammates, and the shoppers who chat with their stores.

Who we are

WOLE, an AI shop assistant and live chat app for Shopify, is provided by WOLE ("we", "us"). You can reach us about this policy or your data at hello@wolechat.com.

A merchant installs WOLE on their own Shopify store. For data about that store's shoppers, we act on the merchant's behalf, and the merchant's own privacy policy also applies to their shoppers.

Data from merchants and their teams

Teammates. Each teammate's name, email, Shopify staff id, role, permissions, photo, notification and display preferences, and when they were last seen. Teammates sign in through Shopify.
Your store's knowledge. The FAQ answers you write, the text taken from your store policies, published pages, the links you add and the files you upload, and the numeric embeddings used to search that text.
Settings. Widget settings, brand voice and house rules, handoff rules and business hours, tags, translations of your wording, and channel connections.
Billing. Your plan and a ledger of the credits your store uses.
Data read from Shopify. To answer shoppers, WOLE reads your products, orders and active promotions from Shopify when a question needs them. When a teammate opens a shopper's profile in the inbox, WOLE reads that customer's details and recent orders from Shopify to show them. WOLE does not change your products or orders.
In-app chat with our team. Where it is switched on, the chat with the WOLE team inside the app runs on Crisp, which receives the teammate's name, email, role and shop domain. It receives no shopper data.

Data from shoppers

A visitor record is created when the widget loads. Whenever WOLE's chat widget is shown on a page of the store, it starts a session and creates a pseudonymous visitor record, even if the shopper never opens the chat. While the page is open, it keeps a live connection and reports when the shopper was last active, so the merchant's team can see who is online.

For each shopper, WOLE may store:

a random visitor id and a "Visitor #N" label;
a name, if the shopper gives one;
an email address, from Shopify, from an order lookup, or typed into the chat, with a note of where it came from;
a phone number, only from the shopper's Shopify customer record;
their language, their Shopify customer id if they are signed in, the channel they used, and when they were first and last seen;
whether the merchant has blocked them, and the reason given.

For each conversation and message, WOLE stores:

the conversation's status, assigned teammate, page address, detected language, the shopper's rating and comment, and timestamps;
message text, links to attachments, the product, order, discount and contact cards shown, which sources an AI answer cited, the AI's confidence, and the AI model and amount of text it processed.

To answer questions about the page a shopper is on, the widget sends the page type, the product or collection being viewed, and up to 10 lines of the shopper's cart. To look up an order, a shopper who is not signed in gives an order number and email address.

How the AI uses data

WOLE's AI writes replies using a large language model from an outside provider. Depending on how WOLE is configured, this is Anthropic's Claude or Google's Gemini. For each reply, the model receives:

the store's brand voice settings and house rules;
the last 10 turns of the conversation, and up to 3 photos the shopper sent;
what WOLE looked up for that question: product details, active promotions, the page the shopper is on, and excerpts from the store's FAQ, policies, pages, files and links;
for order questions, only the order name, date, fulfillment status, tracking number, carrier, tracking link and delivery status. Order lookups never read addresses, line items, or the customer's email or phone.

Google's Gemini always creates the embeddings that search a store's knowledge, from the store's content and from shoppers' questions. Anthropic's Claude is also used to rewrite a reply that contains a word the merchant has banned, to draft brand-voice examples, and to translate the merchant's wording. When a teammate uses "Draft with AI", the conversation is sent to the model to write the draft.

Files

Attachments shoppers send and photos merchants upload are stored in the merchant's own Shopify Files. WOLE keeps links to them. WOLE also stores the widget's settings in one app data field in the merchant's Shopify store.

Facebook Messenger

Only if a merchant connects a Facebook Page: messages from that Page's shoppers come into WOLE's inbox from Meta, and replies go out through Meta. The Page access token is encrypted before it is stored.

Support email

Only if a merchant forwards their support address to WOLE: the emails that arrive are stored as conversations, like chat messages, with the sender's name and email address. Replies go out by email in the store's name.

Tools a merchant connects

Only if a merchant connects them, WOLE sends chat events to their own webhook endpoint, to Klaviyo or to Gorgias. These events can include the shopper's name and email, the conversation, its transcript, a rating or an order. Data sent to a tool the merchant connects is governed by the merchant and that tool.

When Shopify sends a customer redact request for a customer WOLE holds records of, WOLE passes the erasure on to the tools that can take it, before deleting its own copy:

Klaviyo. WOLE asks Klaviyo to delete the customer's profile, once for each email address WOLE knows for them. This needs the merchant's Klaviyo private key to carry the data-privacy:write scope.
Gorgias. WOLE deletes the tickets it opened for the customer. It does not delete the customer's record in Gorgias, which the merchant's other channels share.
Webhook endpoint. Data the merchant's own endpoint received is the merchant's to delete. WOLE cannot reach it.

If WOLE cannot complete the erasure in Klaviyo or Gorgias, for example because the Klaviyo key lacks that scope, it emails the store owner what is left to delete there by hand.

Email

WOLE sends email through an email delivery provider. It sends:

alerts to teammates, with the shopper's name or visitor number, a short snippet and a link, never a full transcript;
credit usage alerts and customer data exports to the store owner;
a teammate's reply to a shopper who gave an email address and has left the chat, sent in the store's name.

Who else receives data

AI providers: Anthropic (Claude) and Google (Gemini), as described above.
Shopify: WOLE reads store data through Shopify's Admin API and stores files and widget settings in the merchant's store.
Meta: only if the merchant connects a Facebook Page.
Tools the merchant connects: a webhook endpoint, Klaviyo or Gorgias, as described above.
An email delivery provider for the emails listed above.
Hosting providers that run WOLE's database and short-lived cache.
Crisp, for the in-app chat with our team where it is switched on. It receives no shopper data.

Browser storage

The chat widget sets no cookies; Shopify's app proxy strips them from WOLE's responses. The widget uses the shopper's browser storage to remember a few things:

wole-shopper-id:<shop> and wole-shopper-seen:<shop> in local storage: a random visitor id, kept for 30 days from the last visit;
wole-show-on-store:<shop> in local storage: the store’s last known setting for showing the widget;
wole-teaser-dismissed-until in local storage: how long a dismissed teaser message stays hidden (7 days);
wole-auto-opened:<shop> in session storage: that the chat already opened itself during this visit.

Signed-in customers are recognized through the customer id Shopify signs. The widget loads no analytics or tracking scripts, and its fonts are served by WOLE rather than fetched from Google.

How long data is kept

Data is kept while the app is installed. There is no retention setting in the app.
We can turn on automatic deletion of guest visitor records (shoppers not linked to a Shopify customer) after a period without activity. When it is off, those records are kept like the rest.
When a merchant uninstalls WOLE, Shopify sends a shop redact request 48 hours later. WOLE then deletes the shop's conversations, shoppers, knowledge and embeddings, tags, handoff rules and hours, settings, channel connections and credentials, connected tools and their event logs, teammates and sign-in sessions, media records, widget settings, brand voice, translations and languages, billing settings and Shopify sessions.
After that, WOLE keeps the credit ledger, which records usage against conversation and message ids, and the store's plan record. Files stay in the merchant's own Shopify Files.
When Shopify sends a customer redact request, WOLE deletes that customer's visitor records, conversations, messages, handoff history and tags, matched by Shopify customer id, email or phone, and then deletes their files from the merchant's Shopify Files. Before that, it passes the erasure on to Klaviyo and Gorgias if the merchant connected them, as described under "Tools a merchant connects".
Shopper presence (when a shopper was last active) is held only briefly, in short-lived storage.
The copies of chat events WOLE keeps for delivery to a connected tool, and their delivery log, are deleted after 30 days.

Security

Channel credentials, and the keys and signing secrets for tools a merchant connects, are encrypted with AES-256-GCM before they are stored.
Session secrets for signing in outside the Shopify admin are stored only as SHA-256 hashes, and live chat tokens are signed.
Storefront requests reach WOLE through Shopify's app proxy, and WOLE checks Shopify's signature on them.
Messages from Meta are accepted only with a valid Meta signature.
Teammates' access is split into permissions that WOLE's server checks whenever a change is saved.

Your rights and how to make a request

Shoppers. If you chatted with a store that uses WOLE, ask that store for a copy of your data or for it to be deleted. Shopify passes those requests to WOLE: for a data request, WOLE emails the store owner a text export of your profile, conversations, messages and file links to pass on to you; for a deletion request, WOLE deletes your data as described above. You can also clear the widget's browser storage at any time in your browser settings.

Merchants and teammates. Email us at hello@wolechat.com to ask what data we hold about you, to correct it, or to have it deleted. Uninstalling WOLE starts the deletion described above.

Changes to this policy

When this policy changes, we will update this page. If a change matters to how your data is used, we will tell merchants before it takes effect.

Contact

WOLE, hello@wolechat.com.