Privacy Policy

1. What we collect

We collect three kinds of information, and only for the purposes named here.

• Your account: the email address you sign up with, your name if you give one, and the settings you choose. If you join the waitlist before launch, only your email address is stored, and we use it to tell you about the launch and to send occasional product updates until you unsubscribe.
• Your store: when you connect a Shopify store we receive an access token and, through it, read your orders, products, inventory and customers. We ask Shopify only for the scopes a worker needs, and you can see the exact list on your Shopify apps page.
• What the crew does: every shift, proposal, approval and decision is recorded in a work log, along with how many tokens each worker used, so you can see what happened and what it cost.

2. What we do not collect

We do not collect payment card numbers; billing is handled by our payment provider, who sends us only what is needed to know your plan is paid. We do not sell or rent any of the information above, and we do not use your store data to train any model.

3. Where your store data lives

Each connected store runs in its own container. Your Shopify access token and any AI keys you bring are fetched at runtime and held in that container’s memory only. They are never written to logs, never written to disk inside the container, and never included in anything sent to a language model.

Data the workers read from your store stays within your container and the control-plane records that belong to your account. Rows in our database are protected so that one account cannot read another’s.

4. AI providers

Workers reason using large language models from Anthropic and, as a fallback, OpenAI. When a worker runs, the relevant parts of your store data are sent to that provider to produce a result, under the provider’s business terms, which do not permit training on your data. If you bring your own key, requests go to your provider account instead.

Everything that reaches a model from outside, including webhooks, customer messages and product text, is scanned for injected instructions first.

5. Who can see your data

You, and anyone you add to your team account. If an agency manages your store, the agency members you have allowed. Our own staff can look inside your account only with a stated reason; every such action is recorded and shown to you in your dashboard with a visible badge.

We share data with the service providers we need to run the product: hosting, database, email delivery, payments and the AI providers above. Each receives only what its job requires. We disclose data when the law requires it and will tell you unless we are prohibited from doing so.

6. How long we keep it

While your account is open, and for thirty days after you close it, so that an accidental closure can be reversed. Work logs for workers you let go are kept until you delete them yourself. Waitlist addresses are kept so we can tell you about the launch and send occasional product updates; every message has an unsubscribe link, and unsubscribing removes the address.

7. Your rights

You can export or delete your account data from your settings, or by writing to us. Disconnecting a store revokes our access token with Shopify immediately. If you are in a jurisdiction that grants you rights of access, correction, portability, restriction or objection, we honour them; write to hello@storeworkers.ai and we will respond within thirty days.

8. Cookies

We set the few cookies needed to keep you signed in and to remember your preferences. The cookie policy lists each one.

9. Changes

If we change this policy in a way that affects you, we will email the address on your account before the change takes effect. The date at the top is the date the current version came into force.