Privacy Policy
Pod.AI — AI customer chat for Shopify stores · Last updated: 9 November 2026 (encryption, backups, access log)
Pod.AI ("the App") is a Shopify app operated by Dropking AI ("we", "us"), under the POD.AI brand. It adds a customer chat to a merchant's online store that answers questions about products, shipping, policies and orders, and passes questions it cannot answer to the merchant's team. This policy explains what data the App accesses, why, where it is stored, how long it is kept and how it is deleted.
For data about their customers, the merchant is the data controller and Dropking AI acts as a processor on the merchant's behalf. For merchant account data (shop domain, settings, access token) Dropking AI is the data controller.
1. Data the App reads from Shopify
| Access scope | What we read | Why |
|---|---|---|
read_products | Products: title, handle, price, images, variants and availability, product type, collections, selected metafields | Showing product answers and product cards in the chat |
read_orders | One order at a time: order number, status, line items, totals, fulfilment and tracking numbers / carrier | "Where is my order?" answers. An order is only shown when the customer gives both the order number and the matching e-mail address. Orders are fetched live and not copied into our database. |
read_shipping | Delivery profiles, zones and rates | Shipping cost and destination answers |
read_discounts | Discount codes and their validity | Answering whether a code is valid |
read_legal_policies | Shipping, refund, privacy and terms policies; shop name, contact e-mail, currency, tax setting, primary domain | Policy answers; shop facts are cached in memory for a short time only |
Protected customer data (the order's e-mail address, and the customer name / shipping country on an order) is only used to verify and answer the customer's own order question. Chat-influenced revenue in the merchant dashboard is computed from order attribution data (UTM tags) without storing customer details.
2. Data collected in the chat
- Chat messages customers type, the App's replies, detected language and intent, and the store page the chat was opened on. Card numbers and similar payment data are detected and never stored.
- E-mail address and order number when a customer provides them (order lookup or "talk to a person").
- Handoffs: when the App passes a conversation to the merchant's team, the handoff record holds the reason, a short summary, the customer's messages and their e-mail for the reply.
- Anonymous storefront events: chat opened, product card clicked, add to cart via a card, and a daily "chat installed" heartbeat. These contain no personal data.
The App does not use first-party tracking cookies of its own. It stores a random chat ID and the time of the last heartbeat in the visitor's browser storage so the conversation can continue across pages. When Google Analytics is enabled, GA may set its own cookies / storage after analytics consent; events are anonymous (no chat content or customer identifiers). We do not sell data, use it for advertising, or combine it across stores.
3. Where data is stored
Data is stored on our application server in Germany (Frankfurt), separated per shop. Collections used: podai_conversations, podai_handoffs, podai_events, podai_settings, podai_shops (the shop's access token, encrypted at rest) and podai_gdpr (a log of privacy requests with hashed customer identifiers).
Encryption at rest. Every Pod.AI record (chat messages, shopper e-mail addresses, order numbers, handoff contents, event data, settings) is encrypted with AES-256-GCM before it is written to disk, with a key held only in the server's protected environment configuration; shop access tokens are additionally encrypted on their own. Encrypted backups: a daily backup is encrypted (AES-256-GCM) before it is written, stored outside any web-accessible directory with owner-only permissions, and kept for 14 days. Access logging: every access to personal data — merchant staff viewing conversations or handoffs, order lookups in the chat, and privacy requests — is recorded in an append-only access log (who, what, when, which record IDs; never the data itself, identifiers only as keyed hashes). The access log is kept for 12 months and the merchant can review it in the App. All traffic uses HTTPS. Requests from the storefront are verified with Shopify's app-proxy signature; admin requests use Shopify session tokens.
4. Third parties (sub-processors)
| Service | Data sent | When |
|---|---|---|
| Shopify | API requests for the data above | Always |
| Carrier tracking APIs (e.g. YunExpress, 4PX) | Tracking number only | When a customer asks about a shipped order and the carrier is supported |
| 51Tracking | Tracking number and carrier code only | Fallback parcel tracking, if enabled |
| Large language model provider (optional; e.g. OpenAI, xAI or DeepSeek, as configured) | The customer's message, recent chat context and the store's public product / policy facts needed to answer | Only if an LLM is configured and the merchant has "LLM answers" switched on. Otherwise answers come from built-in rules and the store's own data. |
| Google Analytics 4 (optional) | Anonymous event names only (e.g. chat opened, settings saved). No message text, e-mail, name, order number or conversation ID. IP anonymized. | Only when a measurement ID is configured on the server (PODAI_GA_ID). Storefront loads GA only after analytics consent via Shopify's Customer Privacy API when the store has a cookie banner. |
No customer e-mail addresses or names are sent to carriers or 51Tracking. The App does not send e-mails to customers.
5. Retention
- Conversations and handoffs: deleted automatically 12 months after the last activity (and each shop keeps at most its 1,000 most recent conversations).
- Anonymous storefront events: deleted after 13 months.
- Privacy-request log (hashed identifiers only): 3 years, as proof of compliance.
- When the App is uninstalled, all data of the shop is deleted when Shopify sends the
shop/redactrequest (48 hours after uninstall).
6. Data subject rights and GDPR requests
The App implements Shopify's mandatory privacy webhooks:
customers/data_request: we record which conversations and handoffs relate to the customer so the merchant can provide them (shown in the App's admin).customers/redact: we delete that customer's conversations, handoffs and related chat events.shop/redact: we delete all data of the shop.
Customers should send access, correction or deletion requests to the store they shopped with. The merchant can also delete individual conversations through these requests. Under the GDPR and the Swiss FADP you have the right to access, rectify, erase, restrict and object to processing, and to complain to a supervisory authority.
7. Security
AES-256-GCM encryption of all stored App data and of backups, encrypted access tokens, an append-only personal-data access log, HMAC-verified webhooks, signed storefront requests, per-shop data separation, least-privilege read-only scopes, rate limiting, and payment-data and prompt-injection filtering in the chat. Security incidents are handled under our Security & Incident Response Policy (affected merchants are notified without undue delay and within 72 hours). Merchants can rely on our Data Processing Addendum.
8. Changes and contact
This policy is published at podai.swisspro.site/privacy (legacy path /shopify-agent/privacy still works).
We will post changes on this page and update the date above. Data controller: Dropking AI. For privacy questions about the App, e-mail support@swisspro.site. More about the agent: podai.swisspro.site/agent.html.