Privacy Policy

1. Who is responsible

For store-owner accounts (email, login, billing status, agent settings), tidyAgent is the controller. For visitor chat content on your live storefront, you are typically the controller and tidyAgent is the processor acting on your instructions to provide the Service. Shopify is a separate controller for App Store billing and the Shopify account.

2. Data we collect

Store owners. Name, email, password hash (or Google login identifiers), workspace settings, agent names and photos you upload, plan entitlements reported by Shopify Billing (shop, subscription status), and support messages you send us.

Connected store. Display name, URL, locale, currency, and content we are allowed to read under your plan (pages, CMS/catalog, and similar public or API-accessible business information).

Visitors. Chat messages, optional email if lead capture is on, timestamps, and technical identifiers needed to keep a conversation (for example a visitor id in the widget). We do not ask visitors for payment cards through tidyAgent.

Logs. Standard server logs (IP, user agent, request path) for security and debugging, retained for a short period.

3. How we use data

• to authenticate you and isolate each Shopify store’s workspace;
• to scan and index store knowledge so the AI can answer visitors;
• to generate replies, spoken audio (if enabled), and specialist handoffs;
• to show you conversations, analytics, and leads in the dashboard;
• to enforce plan limits and investigate abuse;
• to send operational email (login, security, service notices) — not unrelated marketing unless you opt in.

4. Processors and sharing

We share data only as needed to run the Service:

• Shopify — install, permissions, Admin APIs, and App Store billing;
• AI model providers (for example Google Gemini, Groq, OpenAI) — prompts built from your knowledge and the visitor message, to generate a reply;
• speech providers (Google Cloud Text-to-Speech and, if configured, Amazon Polly) — text of replies you enable for voice;
• image hosting (Cloudinary, if configured) — agent photos you upload;
• hosting and database providers that store the application and PostgreSQL data.

We do not sell visitor chats or owner lists. We do not use CRM or order data to build a marketing database for ourselves.

5. Cookies and similar tech

The dashboard uses a session cookie after you sign in. The public widget uses a signed init token scoped to one store — not a client-supplied organization id. On the live Shopify store, you are responsible for cookie banners and visitor consent tools required by your audience (including GDPR/ePrivacy where they apply).

6. Retention

Account and knowledge data are kept while the app is installed and the workspace is active. After uninstall or a deletion request, we delete or anonymize personal data within a reasonable period unless we must keep a record for security, billing disputes, or law. Conversation logs follow the same rule unless you export or delete them sooner from the dashboard where that control exists.

7. Security

Traffic is served over HTTPS. Passwords are stored as hashes, not plaintext. Tenant queries are bound to the verified organization for the session. You still need a strong password and should revoke access if a teammate leaves.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export personal data, or to object to certain processing. Owners can start with the dashboard and support@tidyflowapp.com. Visitors should contact the store owner first; we will assist the owner as processor.

If you are in the EEA/UK, you may also complain to a supervisory authority. We process owner-account data to perform the contract (provide the app) and, where needed, for legitimate interests such as securing the Service.

9. Children

The Service is for business store owners, not for children. Do not use tidyAgent to target visitors you know are under 16 (or the age required in your country) with personal data collection.

10. International transfers

Data may be processed in the country where our hosts and AI providers operate. If we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as standard contractual clauses where required.

11. Changes

We may update this policy. The “Last updated” date will change. Continued use after an update means you accept the new policy.

12. Related terms

Use of the Service is also governed by the Terms of Use.