PixelChat Privacy Policy

PixelChat is an AI shopping assistant for Shopify stores, operated by Pixel Movers, 80-C Model Town, Lahore 54000, Pakistan ("PixelChat", "we", "us"). This policy explains what information we handle when a merchant installs PixelChat, when shoppers use the PixelChat chat assistant on a merchant's store, and when someone browses this website, signs up for product updates or sends a support request through it.

1. Information we collect

From merchants, when you install and use PixelChat:

• Your store's domain and Shopify store identifier, and the access token Shopify issues when you install the app
• Your PixelChat settings, such as assistant name, store description, welcome message, tone, industry template and colours
• Content you add to PixelChat's knowledge base
• Your store's published Shopify policies (shipping, refund, privacy, terms and similar), which we import from Shopify and which can include your contact details
• Your product catalogue, which we read from Shopify to answer shopper questions
• The email address you set for receiving shopper enquiries, and the WhatsApp number you set for shoppers to contact you

From shoppers, when they use the chat assistant:

• The messages they send and the assistant's replies
• Their name, email address and/or phone number: if they give them in the chat or through the contact form, or, if they're signed in to their customer account on the store, as the store provides them (to greet them, fill in the contact form and look up their orders without asking for their email). A signed-in shopper's email address, and phone number if their account has one, are saved with the conversation when they chat, even if the account has no name, so the store's team can see how to reach them and follow up.
• For order enquiries: the order number, and the email address they provide or the one already on file for the chat (a signed-in shopper's account email, or one they gave earlier in the chat), used to look up that order's status in the merchant's store
• If they sign in with their store customer account: a token that lets the assistant retrieve their own orders and account details from Shopify on their behalf

Order lookups: when a shopper asks about an order in the chat, PixelChat looks it up in the store's Shopify admin with the order number and the shopper's email address. If an email is already on file for the chat (the email of the customer account they're signed in to on the store, or one they gave earlier in the chat), PixelChat uses it without asking again; otherwise the shopper gives it. If the shopper has signed in to their customer account through the chat, PixelChat can also look the order up through that account. A signed-in shopper's account email, as the store provides it, is used by PixelChat itself and is never sent to our AI provider. For this, PixelChat holds Shopify's permissions for customers' names, email addresses, phone numbers and addresses: Shopify requires all four before it will provide the link to an order's status page. PixelChat uses them only to check that the order's email matches the shopper's email, and to give the shopper that link. An order lookup never adds the customer's name, email address, phone number or address to what PixelChat keeps: from the store's admin it reads only the order's email, to make that check, and doesn't keep it, and it removes all four from anything the customer account returns before storing it. The link leads to Shopify's own order status page: on most stores the shopper signs in to their customer account to see it, while on stores still using classic customer accounts the link itself opens the page, so PixelChat gives it only to a shopper who gave the order number and whose email matches the one used on the order. The link is kept with the conversation and deleted with it, 14 days after the conversation's last activity.

Proactive messages: if a store has turned on PixelChat's proactive messages (short offers of help that appear after a while, or when a shopper adds to their cart or is about to leave), PixelChat shows them only when the shopper's cookie choices on that store allow marketing. It checks this through Shopify's customer privacy settings, and stops as soon as the shopper withdraws that choice. Opening and using the chat itself doesn't depend on those choices: the shopper starts it.

In the shopper's browser: the chat stores its conversation identifier, its most recent message and which proactive messages it has already shown (so each appears at most once per visit) in session storage, which is cleared when the browser tab is closed. To keep the shopper's conversation private, the chat keeps a random key in their browser tab; only that tab can read or continue the conversation, and the key is gone when they close the tab. If a shopper chooses "Don't show these again" on a proactive chat message, that choice is kept in local storage; closing a single message isn't remembered. When a shopper signs in to their customer account through the chat, PixelChat's own domain (app.pixelchatapp.com) sets a cookie holding a one-time random value, so we can make sure the sign-in is completed in the same browser that started it. Only PixelChat's sign-in pages receive this cookie, and scripts can't read it. It is deleted when the sign-in finishes, or after 15 minutes at most. Because it is strictly necessary for security, it doesn't depend on the shopper's cookie choices.

Automatically: our web server's log records the IP address and browser of requests that reach our servers directly, with the path requested and the time. Those are requests for the PixelChat admin pages and, when a shopper signs in to their customer account through the chat, the PixelChat page where the sign-in starts and their return from it. The chat's other requests reach us through Shopify, so our logs see Shopify's address, not the shopper's. Our web servers do not record page query strings, and our application logs are designed not to contain names, email addresses, phone numbers, order numbers or message content. We also collect error reports, from which personal data is removed before they leave our servers.

Analytics for the store: PixelChat keeps counts for the store's Analytics page: how many chats shoppers started and how many were passed to the store's team, counted per hour, and each product added to the cart from the chat, with the time it was added (only when the shopper's cookie choices on that store allow analytics). None of these contain messages or contact details. We keep them for 13 months; after that, adds to cart are kept only as monthly totals.

Common topics: once a chat has been quiet for six hours, PixelChat sorts it into one general topic from a fixed list, such as "Shipping and delivery" or "Returns and refunds", so the store can see what shoppers ask about most. To do this, the shopper's first three messages, with email addresses, phone numbers, links and long numbers removed, are sent to our AI provider, Anthropic, which returns only the name of the topic. We keep only the topic and a count, never the messages, and the store sees a topic only when at least five conversations fall into it. The counts are kept for 13 months. The conversation itself is still deleted 14 days after its last activity.

Orders after a chat add-to-cart: when a product is added to a shopper's cart from the chat, and only if the shopper's cookie choices on that store allow analytics, PixelChat adds a random code to the cart. The code is made up at random: it doesn't identify the shopper, the conversation or the product. It goes with the cart to checkout, where it isn't shown, and stays on the order, where the store's staff can see it among the order's details.

When the order is paid, Shopify sends PixelChat the order's reference, its cart attributes (which include the code), its total, and whether it is a test order. Shopify does not send PixelChat the customer's name, contact details or address, or the items ordered. PixelChat reads only its own code from the cart attributes; anything else in them, such as a gift message, is neither stored nor logged. If the order was paid within 7 days after the chat add-to-cart, PixelChat counts it for the store's Analytics page, as "sales after a chat add-to-cart". It keeps a coded reference to the order (not its order number), when the order was paid, and its total. We keep the codes for 8 days and the counted orders for 13 months. A counted order shows only that it followed a chat add-to-cart, not that the chat caused it.

Access records: to protect shoppers' data, we keep a record when it is accessed in these ways:

• when an order is looked up, or a shopper's customer account is consulted, in a chat
• when a store's staff open a page in PixelChat that shows shoppers' details
• when our own personnel access our database

For a store's staff, the record includes their Shopify user ID. For shoppers, it includes a coded reference to the conversation, not the conversation itself. The records contain no names, email addresses, phone numbers, order numbers or messages. We keep them for 12 months, review them monthly, and use them only for security and to investigate misuse.

From visitors to this website:

• When they browse it: the pages they visit, the referring website, and their country, browser, operating system and device type, collected without cookies and not used to identify them
• If they sign up for product updates: their email address
• If they send a support request through the contact form: their name, email address, store URL, the topic they choose and their message

2. How and why we use information

We use this information to provide PixelChat: answering shoppers' questions about products, stock, orders and store policies; adding items to their cart when asked; passing enquiries to the merchant's team; showing merchants their conversations; giving merchants statistics about their chats, the topics shoppers ask about, and orders paid after a chat add-to-cart; keeping the service secure; and diagnosing errors.

For merchant information, our legal bases are performing our contract with you and our legitimate interest in operating and securing the service. For shopper information, we process it on the merchant's instructions, and the merchant determines the legal basis.

If you sign up for product updates on this website, we use your email address only to send you those updates. Our legal basis is your consent, which you can withdraw at any time by unsubscribing.

If you send a support request through this website, we use what you send only to answer it. Our legal basis is our legitimate interest in responding to your request.

We use visit statistics for this website to understand how it's used. Our legal basis is our legitimate interest in running and improving it.

We do not sell personal information, use it for advertising, or share it between merchants. Each store's data is kept separate.

3. AI-generated responses

PixelChat's replies are generated by an artificial intelligence model. To produce a reply, the conversation, together with the product, order and policy information needed to answer it, is sent to our AI provider. Our AI provider does not use this data to train its models, and retains it only for a limited period for safety and abuse monitoring. AI responses can occasionally be inaccurate; shoppers should confirm important details such as prices and order information with the merchant.

When a merchant asks PixelChat to suggest a store description or welcome message, the store's name and description, its product titles and tags, and the chosen tone are sent to our AI provider to write the suggestion. Nothing is saved until the merchant saves it.

4. Service providers (sub-processors)

Each provider receives only what it needs for its purpose and is bound by a data processing agreement. We may also disclose information where required by law.

5. International transfers

Our providers process data in the United States, the European Union, the United Kingdom and Japan, and Pixel Movers may access data from Pakistan to operate and support the service. Transfers to Japan and within the EU and UK rely on those jurisdictions' adequacy status. Other transfers rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

6. How long we keep information

• Conversations — including any name, email or phone number given in the chat, and sign-in tokens — are deleted automatically 14 days after the conversation's last activity.
• Contact-form enquiries are deleted 30 days after they are received. If we could not deliver an enquiry to the merchant by email, we keep it for up to 90 days so the merchant can still see it in PixelChat.
• Product-update sign-ups are kept until you ask us to delete them. If you unsubscribe, we keep your address marked as unsubscribed so you don't receive further updates.
• Support requests sent through this website are delivered to our support inbox and kept for as long as we need them to handle your request and any follow-up.
• Visit statistics for this website are kept for 12 months.
• Server logs, including IP addresses and browser details, are kept for 15 days.
• Access records are kept for 12 months.
• Analytics counts (chats started, chats passed to the store's team, adds to cart and topics) are kept for 13 months; after that, adds to cart are kept only as monthly totals.
• Cart codes for counting orders after a chat add-to-cart are kept for 8 days, and orders counted after a chat add-to-cart (a coded order reference, the payment time and the total) for 13 months.
• Backups of our database are encrypted and kept for 14 days, so deleted information may remain in backups for up to 14 days after deletion.
• When a merchant uninstalls PixelChat, Shopify sends us a data-erasure request about 48 hours later. We then delete that store's conversations, knowledge base, enquiries, sign-in tokens, analytics and personal settings. We keep a minimal record that the store's data was erased.
• Copies prepared for a data request are stored encrypted and deleted after 30 days, or sooner if the shopper's data is erased.
• Records of privacy requests — when a store asks us, through Shopify, to delete or provide a customer's data, we keep a record that the request was handled: the Shopify customer ID it named and how many records were affected. It contains no contact details and none of the deleted data. We keep it for 3 years, as evidence that we complied, and then delete it.

7. Security

Data is encrypted in transit, and our database is encrypted at rest. The access and refresh tokens Shopify issues to PixelChat are encrypted individually as well, with a key that is never stored in the database. The app connects to the database with limited rights: it can read and change records, but not change the database's structure or anyone's permissions. Changes to the structure, and backups, use a separate owner account that the app doesn't have. Backups are taken every night, encrypted before they leave our server and kept for 14 days. We're alerted if a backup fails or doesn't run, and we test restoring one every three months and after any change to the backup. Access to production systems is restricted, each store's data is isolated from every other store's, and personal data is removed from logs and error reports. No system is completely secure, but we work to protect the information we hold.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to certain processing.

• Merchants can contact us using the details below.
• Shoppers should contact the merchant whose store they used, as the merchant controls that data. When a shopper asks a merchant to delete their data, Shopify passes the request to us, and we delete matching conversations and enquiries — including those identified only by an email address or phone number given in the chat. We keep a record that the request was handled (the Shopify customer ID and how many records were affected), but not the deleted data.
• Visitors to this website can unsubscribe from product updates at any time, and can contact us using the details below to access or delete their email address or the support requests they sent.

Customer data requests: if a shopper asks a store for the personal data it holds about them, the store can ask PixelChat through Shopify. PixelChat then gathers what it holds about the shopper: their chat conversations as they were shown, the details they gave, and their messages through the chat's contact form. It finds them by the shopper's Shopify customer account, and by the email address or phone number they gave in the chat when it matches exactly. It makes them available to the store to send to the shopper. That copy is stored encrypted and deleted after 30 days, or sooner if the shopper's data is erased.

You may also complain to your local data protection authority.

9. Children

PixelChat is not directed at children under 16, and we do not knowingly collect their personal information.

10. Changes to this policy

We will post any changes on this page and update the effective date. For material changes, we will notify merchants through the app or by email.

11. Contact us