Privacy Policy
If you're chatting with a store
Ustam powers the chat assistant on the stores that use it. To provide that chat, we process the following information about you, and this is what each item is used for:
- Your messages — used to generate the assistant's replies, to show the store's support team the conversation if a person takes over, and to keep the thread available if you come back to it. They're encrypted with a key belonging to that one store, separate from every other store's chats.
- The page you're viewing and what's in your cart — used to answer about the product in front of you and to give cart-aware help, such as checking a total or a shipping threshold. Your cart is used during the chat and not stored afterwards.
- Your name and email — used to address you in the conversation and to let the store reply or continue by email. They come from the store account you're signed in to, or from what you type in the chat.
- Your phone number — used to call or message you back when you've asked to hear from a person, and to route the conversation on channels that identify you by number, such as WhatsApp.
- A chat identifier stored in your browser — a random ID and the current conversation ID, saved in your browser's local storage so the chat reopens where you left it. It isn't tied to your identity and isn't shared with other sites; clearing your browser storage removes it. The chat sets no cookies.
- Technical request data — our servers record standard log entries for requests, including IP address, browser type, and timestamps, used to run the service securely and diagnose faults. Our error-monitoring provider receives the same technical details when something breaks in the chat window.
Your information is available to the store you're chatting with, and is processed by Ustam and the providers we use to run the chat — our AI provider, our hosting and infrastructure providers, and our error-monitoring provider. They process it only to provide those services to us, under contractual confidentiality and data-protection obligations, and our AI provider does not use it to train its general models. We don't sell personal information, don't use it for advertising that follows you across the web, and don't add you to Ustam's marketing.
To see, correct, or delete your chat data, ask the store — it decides what's kept — or email info@ustam.ai and we'll handle it with them. Everything below is the same policy in full detail, written for store owners.
For merchants using the Ustam app
Ustam "the App" provides AI-powered customer support chat assistant service "the Service" to merchants who use Shopify to power their stores. This Privacy Policy describes how personal information is collected, used, and shared when you install or use the App in connection with your Shopify-supported store.
Personal Information the App Collects
We collect personal information directly from the relevant individual, through your Shopify account, and through the technologies described below.
Information Accessed from Your Shopify Account
When you install the App, we are automatically able to access certain types of information from your Shopify account:
- Store information — shop name, domain, email address, address, phone number, currency, and timezone; used to configure and identify your account
- Product catalog — product titles, descriptions, prices, variants, and inventory; used to power AI assistant responses
- Customer profiles — name and email address of customers who are actively logged in and using the chat; used solely to personalize the chat experience
- Order information — order status and details for logged-in customers who ask about their orders; used to provide accurate order support
- Store content — pages, blogs, and articles (read_content); used so the AI assistant can answer questions about your store
- Legal policies — refund, privacy, shipping, and terms policies (read_legal_policies); used so the assistant can answer policy-related questions
Information Collected Directly from Merchants
When you create an account and use the App, we additionally collect:
- Registration information — name and email address provided when you create an account
- Subscription and billing status — plan tier and billing status managed through Shopify App Billing (we do not collect or store payment card numbers)
- Usage and analytics data — feature usage, conversation volumes, and performance metrics used to operate and improve the Service
- Device and browser information — IP address, browser type, and time zone collected when you access the admin dashboard
Information from Merchant Customers (Chat Users)
To provide the storefront chat, we process the following information about a merchant's customers:
- Name — when the customer is logged in to the merchant store, or when the customer shares a name during the chat
- Email address — when the customer is logged in to the merchant store, or when the customer shares an email during the chat (including when asked so the store can follow up or connect them with a human)
- Phone number — when the customer shares a phone number during the chat (including when asked for human handoff), or when required by a connected channel (for example, WhatsApp)
- Conversation messages and content exchanged during the chat session
- Current page context — the page type (e.g. product, collection, home) and page path the customer is currently viewing on the storefront; used to provide relevant chat assistance. Page navigation events are recorded in the conversation to help support staff understand the customer's browsing context.
- Cart summary — the number of items, total price, and product titles in the customer's shopping cart; used to provide cart-aware assistance. Cart data is not stored beyond the active chat session.
- Browser-stored chat identifiers — a randomly generated visitor ID and the current conversation ID, held in the customer's browser local storage so the chat can be resumed. The widget sets no cookies.
- Technical request data — IP address, browser type, and timestamps recorded in server logs for requests made by the chat widget, and the equivalent technical details sent to our error-monitoring provider when an error occurs in the chat window; used to operate, secure, and debug the Service.
Note: On the storefront chat widget we do not collect addresses, payment information, or order data beyond what is needed to answer a specific support query. Name, email, and phone may also be collected when the customer provides them in chat, including when contact details are needed to escalate to a human. Cart data (item count, total, and product titles) is used during the active chat session to power responses and is not stored as a separate database record; page navigation during a chat may be recorded as conversation events. If you connect additional channels (such as WhatsApp), we collect identifiers required by that channel (for example, a phone number for WhatsApp).
Tracking Technologies
We collect information using the following technologies:
- Authentication cookies — when you sign in to the merchant admin dashboard, we use cookies (such as session and CSRF tokens) to keep you signed in securely.
- Google Analytics — on our marketing website (ustam.ai), we use Google Analytics to understand how visitors use the site. You can opt out via your browser settings or Google's tools. We do not load Google Analytics or any advertising or product-analytics tracker in the chat widget on merchant storefronts.
- Browser local storage in the chat widget — the widget stores a randomly generated visitor ID, the current conversation ID, and display preferences (such as language, theme, and whether the window is open) in local storage so a conversation can be resumed. It sets no cookies and does not read device fingerprinting signals.
- Log files — server logs recorded for requests to the App, the dashboard, and the storefront chat, which may include IP address, browser type, and date/time stamps.
- Error monitoring — when something fails in the chat window or dashboard, diagnostic details are sent to our error-monitoring provider. These reports can include the IP address and request headers of the browser that hit the error, and are used only to find and fix faults.
How Do We Use Your Personal Information?
We use the personal information we collect from you and your customers in order to provide the Service and to operate the App. Additionally, we use this personal information to:
- Provide, maintain, and improve the App and the Service
- Communicate with you about your account, billing, and updates to the Service
- Analyze usage patterns to enhance the user experience and develop new features
- Detect and prevent fraud, abuse, and security incidents
Sharing Your Personal Information
We do not sell your personal information. We may share your information only with the following parties and in the following circumstances:
- AI service providers (such as OpenAI) — conversation content and related context are shared to generate assistant responses. These providers process data solely on our behalf under confidentiality obligations, and do not use it to train their general models.
- Error-monitoring providers — diagnostic reports from the chat widget and dashboard, which may include IP address and request headers, used solely to detect and fix faults.
- Analytics providers (such as Google) — on our marketing website only, as described under Tracking Technologies above.
- Infrastructure and hosting providers — cloud database and server providers used to store and process data on our behalf.
- Legal compliance — when required by applicable law, regulation, court order, or to protect the rights and safety of Ustam or others.
- Business transfers — in connection with a merger, acquisition, financing, or sale of all or a portion of our assets.
Data Security
Protecting this data is something we design for rather than bolt on. We encrypt personal information at rest and in transit, control who can reach it, and review our security regularly.
Chat message content, conversation summaries, and feedback comments are additionally encrypted with a separate per-company (tenant) key. Each company's chat data is cryptographically isolated from every other company's, so a database read by itself does not yield readable conversation text. Inbox search across this encrypted content uses a per-company index of hashed search tokens rather than the message text itself, so search queries are matched against hashes — not plaintext — at the database layer.
Decryption happens only inside our application servers while serving a request (for example, when an authorized staff user opens a conversation, or when a message is delivered to the customer's chat channel). The keys that unlock this data are held by our application and are not shared with sub-processors except as needed to operate the Service (see "Sharing Your Personal Information" above).
No system connected to the Internet can honestly promise perfect security, so we also keep as little as we can, for as long as we genuinely need it, and tell you promptly if something goes wrong.
Data Retention
We retain your personal data only for as long as necessary to provide our services. Personal data is automatically deleted when:
- You request deletion of your personal data
- A shop uninstalls our app — all shop and related data is deleted within 48 hours of uninstallation
- The data is no longer needed for the purpose for which it was collected
Data Deletion When You Uninstall
When you uninstall the Ustam app from your Shopify store, Shopify sends us a compliance webhook (shop/redact) 48 hours after uninstallation. Upon receiving this webhook, we permanently delete your shop record and all associated data. This includes: store information and settings, all conversations and messages, AI assistants and their configurations, product and recommendation data we cached, subscriptions and service connections, and related files (e.g. assistant logos). We also remove any external resources linked to your shop (e.g. search indexes). We do not retain your data after uninstall except as needed for backups (see below).
Backup copies are retained for up to 30 days and are automatically purged after this period.
Your Rights
Regardless of where you live, you may exercise the following rights regarding personal information we process about you, subject only to limits required by applicable law:
- Know — the categories of personal information we collect, the sources, the purposes for collection and use, and the categories of third parties to whom we disclose it (described in this Privacy Policy)
- Access — access and receive a copy of the specific pieces of personal information we hold about you
- Correct — request correction of inaccurate personal information
- Delete — request deletion of your personal information
- Portability — receive a copy of your personal information in a portable, readily usable format (for example, structured JSON from an access request)
- Non-discrimination — not receive discriminatory treatment for exercising your privacy rights
- Restrict or object to certain processing, where applicable by law
- Withdraw consent where processing is based on consent
Practices we do not engage in
We do not sell personal information. We do not share personal information for cross-context behavioral advertising (targeted advertising across websites or apps). We do not use merchant or end-customer data for Ustam's own marketing campaigns. If you have questions about these practices, contact us at info@ustam.ai.
We use personal information only as needed to provide the Service. We do not use sensitive personal information for purposes beyond what is necessary to operate the App. If you believe we hold sensitive personal information about you and have questions, contact us at info@ustam.ai.
How to exercise your rights
Contact us at info@ustam.ai to exercise any of the rights above. We will respond within 30 days. You may use an authorized agent to submit a request on your behalf; we may require proof of the agent's authority and verification of your identity.
If you are a customer chatting on a store's site, that store decides what is kept about your conversation (it is the data controller, and Ustam acts as its processor), so asking the store directly is usually the fastest route. You can also email us at info@ustam.ai and we will work with the store to make sure your request is handled.
Shopify merchants can also use Shopify's mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact) for automated export and deletion of customer and shop data stored by the App. Merchants may correct contact records in the admin dashboard; end-customer chat data export and deletion are handled through those webhooks or via the merchant's request to us.
We process personal information to provide the Service (performance of a contract), to operate, secure, and improve the Service (legitimate interests), and where required by law (legal obligations). Your information may be processed in the United States and other countries where we or our service providers operate; we use appropriate safeguards for international transfers as required by applicable law. If you believe we have not addressed your request, you may contact us again or raise a concern with a data protection regulator in your jurisdiction.
Cookies and Tracking Technologies
See the Tracking Technologies section above for details on cookies and analytics we use. You can instruct your browser to refuse cookies or to indicate when a cookie is being sent. Note that refusing authentication cookies will prevent you from staying signed in to the admin dashboard.
Changes
We may update this privacy policy from time to time in order to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will notify you of material changes by posting the updated policy on this page and updating the "Last Updated" date.
Contact Us
Ustam is operated by Ertechin Teknoloji Yazılım Ticaret Limited Şirketi, a company registered in Türkiye. For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us using the details below:
Company: ERTECHİN TEKNOLOJİ YAZILIM TİCARET LİMİTED ŞİRKETİ
Registered address: Göztepe Mah. Cavitpaşa Sk. No: 22 İç Kapı No: 15, Kadıköy / İstanbul, Türkiye
Email: info@ustam.ai