Roles
- You are the controller for your shoppers' data.
- COEC processes that data on your behalf under the Data Processing Agreement, which you accept at signup.
- COEC is controller for your account and billing data, as described in our privacy policy.
What the assistant processes
The messages shoppers write and photos they upload, their orders when they are signed in or verified, email addresses and names they give, and technical data such as language and the current page. Card numbers and ID numbers typed into the chat are removed automatically.
Retention defaults
- Conversations: 90 days after they end by default, adjustable within your plan's maximum
- Newsletter sign-ups and leads: 24 months without activity
- Analytics events: 13 months
- Uploaded photos: 24 hours
- Backups: 30 days
You can shorten conversation retention or delete conversations when they close.
Data subject requests
Export or delete a shopper's data from the dashboard or the API. ShopAssist also handles Shopify's customer and shop redaction requests and hooks into the GDPR tools of WordPress, PrestaShop and Magento.
No training on your data
Neither COEC nor our managed AI providers train or fine-tune models on your data.
EU processing
Hosting, databases, backups and email stay in the EU. Managed AI runs only on EU deployments of our listed sub-processors. With your own AI key, the provider you choose processes the data under your agreement with them.
Storage and consent in the widget
The widget stores nothing on the shopper's device until the chat is opened, and follows the consent from your cookie banner. See widget storage.
Your shopper privacy notice
The docs have a privacy notice template in 11 languages you can add to your own privacy policy.
Transfers
Where a sub-processor has a parent outside the EEA, Standard Contractual Clauses apply. Merchants outside the EEA receive their exports under the matching SCC module.