Privacy Policy

Who we are

KeepMySale is an AI customer-support assistant for Shopify stores. It is operated by EFO Commerces, a business in the Netherlands registered with the Chamber of Commerce (KvK) under number 89053338. You can reach us at eo.commerces@gmail.com.

For the account of the store owner (the merchant) we are the data controller. For the data of the merchant's own customers we are a processor: the merchant decides why that data is used, and we process it only to provide the service.

What we process

• Merchant account:shop domain, shop name, the owner's email address, the subscription status, and the access token Shopify gives us when you install the app (stored encrypted).
• Store data from Shopify: orders (order number, items, totals, payment and fulfilment status, tracking details) and customers (name, email address, phone number where Shopify provides it).
• Support messages: the emails between your customers and you, when you connect your Gmail account or forward mail to us, including the replies drafted or sent through KeepMySale.
• Google account details: your Google email address and profile name, used to show which mailbox is connected.
• Return and refund records: the offers made to a customer, the outcome, and refunds issued through Shopify.

We do not use advertising or analytics trackers. The only cookies we set are the session cookies needed to keep you signed in.

Why we use it

To show your orders and conversations, to classify incoming customer emails, to draft or send answers (for example where an order is), to propose partial refunds or store credit in a return conversation within the limits you set, and to issue refunds you approve. We do not sell data and we do not use your or your customers' data to train models ourselves.

AI processing

To understand and answer a customer's message we send the text of that message and the relevant order details (such as order number, items and tracking status) to our AI providers: Google (Gemini) and, if that is unavailable, Groq. They process it only to return a response. Replies in draft mode are not sent until you approve them; you control whether the AI may send automatically, and you stay responsible for what is sent in your name.

Google user data

If you connect Gmail, KeepMySale requests permission to read, send and modify mail in that mailbox and to see your email address and profile name. We use this only to read customer support emails, mark them as processed, and send replies you or your settings approve. We do not use it for advertising, and we do not allow people to read your mail except where needed for security, to comply with law, or with your consent.

KeepMySale's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time in your Google account under Security → Third-party access, or by disconnecting Gmail in KeepMySale Settings.

Who else processes data

• Supabase: database and sign-in (hosted in Ireland, EU).
• Vercel: hosting of the application.
• Shopify: the platform you install the app on; we read and write store data through its API.
• Google (Gmail API, Gemini) and Groq: email access and AI processing, as described above.
• Amazon Web Services (SES): sending and receiving email when you use forwarding instead of Gmail.
• Mollie: payments, if and when a paid plan is active for your account.

Some of these providers process data outside the European Economic Area. Where that happens we rely on the safeguards the provider offers, such as standard contractual clauses.

How long we keep it

We keep merchant and store data while the app is installed. If you uninstall, Shopify asks us to erase the shop's data 48 hours later, and we do. A customer of yours who asks to be erased is removed through Shopify's privacy requests: we delete their record and conversations and strip their email from their orders. You can also delete your whole account yourself under Settings → Account. Refund records may be kept in anonymised form where the law requires financial records.

Security

Connections use TLS. Shopify and Google access tokens are encrypted at rest (AES-256). Access to the database is restricted to the application and the operator. No system is perfectly secure; if a breach affects your data we will tell you and, where required, the authorities.

Your rights

Under the GDPR you may ask for access to your data, correction, erasure, restriction, a portable copy, and you may object to processing. If you are a customer of one of our merchants, please also contact the store you bought from. Write to eo.commerces@gmail.com; we answer within one month. You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

If this policy changes in a way that matters, we will update the date above and tell merchants by email.