Security
Security and data handling
What WOLE stores, what its AI is shown, who else handles your data, and what happens when a shopper or your store asks for data to be removed. Plain answers, and only what the product does today.
What the AI sees
Each reply is written from a narrow set of inputs. Here is all of it.
- The conversation
- The last 10 turns of the shopper's messages, plus up to 3 photos the shopper sent.
- Your instructions
- Your brand voice settings and house rules.
- What WOLE looked up
- Product details, active promotions, the page the shopper is on, and excerpts from your FAQ, policies, pages, files and links that match the question.
- Order status, and nothing more
- Order name, date, fulfillment status, tracking number, carrier, tracking link and delivery status. Order lookups never read addresses, line items, or the customer's email or phone.
What WOLE stores
The data behind your inbox, your knowledge and your team.
- Shoppers
- A random visitor id and a “Visitor #N” label, an optional name, an email if Shopify, an order lookup or the shopper provides one, a phone number from Shopify, the language and the Shopify customer id.
- Conversations and messages
- Message text and the cards shown, the page URL, the rating, which sources an answer cited, and the AI's confidence.
- Your knowledge
- FAQ answers, the text taken from your policies, pages, links and files, and the embeddings used to search it.
- Your team
- Each teammate's name, email, Shopify staff id, role, permissions, photo and preferences.
- Files stay in Shopify
- Attachments shoppers send and photos you upload are stored in your store's own Shopify Files. WOLE keeps links to them.
- A visitor record on page load
- When the widget shows on a page, WOLE creates a pseudonymous visitor record, even if the shopper never opens the chat.
How access is protected
Keys and credentials are encrypted, session secrets are hashed, and requests are checked before WOLE acts on them.
- Keys and credentials
- API keys, webhook signing secrets and channel credentials are encrypted with AES-256-GCM before they're stored.
- Sign-in sessions
- Session secrets for signing in outside the Shopify admin are stored only as SHA-256 hashes.
- Signed tokens
- Tokens for the live chat connection are HMAC-signed.
- Storefront requests
- The widget talks to WOLE through Shopify's app proxy, and WOLE checks Shopify's signature on them.
- Forwarded email
- Emails forwarded to WOLE are accepted only when the relay that delivers them signs the request.
- Webhooks you receive
- Each request WOLE sends to your endpoint is signed with your endpoint's own secret, so you can check it came from WOLE.
- Your catalog
- WOLE reads your products and orders and never changes them.
Shopify privacy requests
WOLE handles all three of Shopify's privacy webhooks. Running one twice does no harm.
Customer data request
WOLE emails the store owner a text export of that customer's profile, conversations, messages and file links, for you to pass on within 30 days.
Customer redact
WOLE deletes the customer's visitor records, conversations, messages, handoff history and tags, then removes their files from your Shopify Files.
Shop redact
48 hours after you uninstall, WOLE deletes your shop's conversations, shoppers, knowledge, rules, settings, channel credentials, teammates and sessions.
After a shop redact, WOLE keeps the credit ledger, which records usage against conversation and message ids, and your plan record. Files stay in your own Shopify Files. There is no retention setting in the app today.
In the shopper's browser
No cookies
The chat widget sets no cookies. Shopify's app proxy strips them from WOLE's responses.
What it remembers
A random visitor id in local storage, kept for 30 days from the last visit, plus a few display choices, such as a dismissed teaser.
No third-party scripts
No analytics or tracking scripts. The widget's fonts are served by WOLE, not fetched from Google.
Who else handles data
The services WOLE passes data to, and what each one receives.
- Anthropic
- Claude can write the replies, depending on how WOLE is configured. When it does, it receives what the AI sees, listed above. It also drafts voice examples, translates your wording and rewrites replies that use a word you've banned.
- Gemini always creates the embeddings that search your knowledge, from your content and shoppers' questions. Depending on how WOLE is configured, it can also write the replies.
- Tools you connect
- Only if you connect them: your webhook endpoint, Klaviyo or Gorgias receive the chat events you send them. Once there, you and that tool govern that data.
- Shopify
- Stores attachments in your Shopify Files and your widget settings in one app data field.
- An email delivery service
- Sends teammate alerts (a shopper's name or visitor number, a snippet and a link, never a transcript), credit alerts, data exports and replies to shoppers who left their email.
- Crisp
- Runs the in-app chat with the WOLE team, where it's switched on. It receives the teammate's name, email, role and shop domain, never shopper data.
Team access
Teammates sign in through Shopify. Access is split into 13 permissions, from billing to the widget, with Agent, Manager and Admin presets or a custom set. The store owner always has every permission, and a teammate can only pass on access they have themselves.
WOLE's server enforces these permissions when a change is saved, so hiding a button is never the only lock.
Questions about security
Does WOLE change my products or orders?
No. It reads them. Its only writes to Shopify are files in your store's Files (chat attachments and photos) and one app data field that holds your widget settings.
Does the chat widget use cookies?
No. It keeps a random visitor id and a few display settings in browser storage, and it loads no third-party analytics or tracking scripts.
Which AI providers see shopper messages?
Replies are written by Anthropic's Claude or Google's Gemini, depending on how WOLE is configured. Google's Gemini always creates the search embeddings for your knowledge. Klaviyo, Gorgias or your own webhook receive chat data only if you connect them.
What happens to my data when I uninstall?
Shopify sends a shop redact request 48 hours after you uninstall, and WOLE deletes your shop's conversations, shoppers, knowledge, settings and credentials. The credit ledger and your plan record are kept. Files stay in your own Shopify Files.
Can I set how long chats are kept?
Not today. There's no retention setting in the app. A customer's data is deleted when Shopify sends a customer redact request, and your shop's data after uninstall as above.
See it on your own store
Install WOLE free and try the assistant in the Sandbox before shoppers ever see it.