Privacy policy

Last updated: October 20, 2026.

The service is operated by Maliao, an individual developer, at No. 269 Chenghua North Road, Fengze District, Quanzhou, Fujian, China 362000. Privacy contact: support@getshopreply.com.

This policy describes the GetShopReply customer support service and its Shopify integration. For questions or privacy requests, contact support@getshopreply.com. A store using GetShopReply is responsible for its own customer privacy notice and for deciding what support information to collect.

Information we process

For Shopify stores, we store the shop domain and identifier, app installation identifier, encrypted app access and refresh credentials, subscription status and reply usage. We store policies, FAQs and store information entered by the merchant. The Shopify app may request read access to orders and products when a merchant uses Pro order tracking or return eligibility. It matches an order number with the checkout email the shopper provides, and does not request payment card details. Customer name, phone and address fields are not requested for this feature.

When a visitor uses the assistant, we process their question, the assistant’s replies, timestamps and a random conversation identifier. If the visitor chooses human follow-up, we store the email address and question they submit. Please do not submit passwords, payment card information or other sensitive information in chat.

Standalone merchant accounts also have an email address and a password hash. Shopify installations create separate service accounts without a password login.

How information is used and shared

We use this information to answer store support questions, provide human handoff, operate the merchant dashboard, enforce reply allowances, manage subscriptions and respond to privacy requests. Merchants can see the emails and questions submitted to their store.

Questions, recent conversation context and relevant store policies and FAQs are sent to DeepSeek through its API to generate replies. The service is hosted on Vultr. We use Namecheap Private Email for support correspondence and SQLite for the Shopify app’s application database. SQLite is database software, not an external database hosting provider. These service providers process information needed to run the service under their own terms and privacy practices. Processing may occur outside your country, including in China and in countries where our hosting and other providers operate. Contact us for information about processing locations and applicable transfer safeguards.

Shopify processes Shopify app subscription payments. GetShopReply does not receive payment card details through the Shopify Billing API. Existing standalone subscriptions may use Paddle as merchant of record; payment details are entered in Paddle’s payment interface and are subject to its terms and privacy policy. We do not store full payment card numbers.

Separate standalone order-lookup pilot

For standalone stores where the separate order-lookup pilot is enabled, its form uses an order number and checkout email to find a matching Shopify order and send a one-time verification code through Resend. After verification it retrieves fulfillment and tracking information. These form entries and results are not sent to the AI model or saved in ordinary chat history. Order details entered into ordinary chat remain subject to the chat processing described above.

The pilot stores a short-lived encrypted order reference and keyed verification hashes, with five-minute code expiry and minute-by-minute cleanup. Rate-limit identifiers expire within 24 hours plus cleanup. Returned fulfillment details are not persistently stored. Browser lookup state is cleared on closing the lookup or after expiry. Shopify and Resend separately process information under their own retention policies. This pilot is separate from the Shopify app described here, which does not request order access.

Browser storage

The widget uses browser local storage for a random conversation identifier and an email address if supplied for follow-up. Clearing site storage removes those browser values, but does not itself delete server records. Standalone account login uses a session cookie. The embedded Shopify dashboard uses short-lived App Bridge authentication tokens.

Retention and deletion

For Shopify installations, chat records, human-handoff questions and visitor email mappings are removed after 90 days by an hourly cleanup task. Encrypted privacy exports are removed after 30 days or when the merchant marks them delivered. Store configuration and subscription metadata remain while the app is installed.

A verified Shopify uninstall notification deletes that installation’s service account, policies, FAQs, chat records and handoff data, and revokes its stored credentials and widget identifier. Minimal installation metadata is kept until Shopify’s shop-redaction notification. A customer-redaction notification deletes matching handoff data and conservatively clears that store’s conversation history, including anonymous conversations that cannot be reliably matched.

Standalone account retention and any historical records should be discussed with the operator when requesting deletion. Hosting backups and third-party provider retention are governed by the operator’s infrastructure and provider arrangements; request details before using the service if these affect your requirements.

Access, correction and other requests

Visitors should contact the store where they used the assistant, or contact GetShopReply using the address above. Merchants can edit policies and FAQs in the dashboard and handle Shopify customer data requests there. We may need information to verify a requester’s identity. An anonymous conversation may be impossible to locate without a conversation identifier or a captured email. Rights and response requirements depend on applicable law.

Security and updates

Shopify API credentials and generated privacy exports are encrypted before database storage. Merchant dashboard requests are authenticated and scoped to the requesting store. No system can guarantee absolute security. We will update this page when relevant service practices change.