GDPR
Privacy policy
Data controller
ShopilotAI (trade name: ShopilotAI), reachable at contact@shopilotai.com, is the data controller for personal data collected through this website.
Data collected
- Setup request form: store name, website, platform, email, phone number, message volume, and a free-text message.
- Chatbot demo: the content of messages sent in the demo, used only to generate a response.
- Minimal technical data necessary for the website to function.
Purposes and legal basis
Form data is used to respond to your request and prepare a business proposal (legitimate interests and steps taken prior to entering into a contract). Demo messages are used to display a live response.
Customer data from the stores we serve (processing on their behalf)
When the ShopilotAI chatbot is installed on a store's website, the store remains data controller and ShopilotAI acts as data processor within the meaning of Article 28 of the GDPR. In this context:
- Data processed: chatbot conversation content (visitors' questions, products viewed, and any contact details they voluntarily provide), as well as the catalog and store information supplied to configure the assistant.
- Purpose: to respond to visitors on behalf of the store and forward requests the assistant cannot answer to the store's team. No other use, no resale, and no advertising profiling.
- Location: store configurations are hosted by our infrastructure provider (Lovable Cloud). The exact hosting region can be provided upon request.
- Retention period: 12 months by default for conversation histories, adjustable at the store's request; deletion at the end of the contract unless otherwise required by law.
- Instructions: ShopilotAI processes this data only on documented instructions from the store and assists the store in responding to data subject requests (access, rectification, erasure).
- A data processing agreement (DPA) can be entered into with each store upon request at contact@shopilotai.com.
Data processors
Website and database hosting (Lovable Cloud), payment processing by Stripe (which handles payments, subscription management, and, for eligible orders, tax compliance and invoicing), and a language model provider for chatbot responses. Conversations may pass through this model provider solely to generate a response. ShopilotAI does not use your data to train models; each provider's own terms apply.
Retention period
Sales inquiries: 3 years after the last contact. Contract data and invoices: 10 years, in accordance with accounting obligations. Conversation histories at our customers' stores: retention period agreed with the store, 12 months by default.
Your rights
You have the right to access, rectify, and erase your personal data, restrict or object to its processing, and request data portability. Email contact@shopilotai.com; you will receive a response within 30 days. You may also lodge a complaint with the CNIL.
Security
Data is encrypted in transit, database access is restricted by row-level security policies, and the admin area is protected by authentication and a dedicated role.