Privacy policy

Catchly is an AI sales chat for Shopify stores, made by Canuckt Synergy Solutions Inc., Bedford, Nova Scotia, Canada ("we"). This policy explains what Catchly collects, why, how long we keep it, and who helps us run it. The store that uses Catchly decides how its shoppers' data is used. We process that data for the store, to run the chat.

What we collect from the store

• Products, prices, stock, pages, store policies and basic store details such as the store name, currency and contact email, so the AI can answer from them.
• Chat settings the store chooses, and the email addresses the store gives us for chat alerts.
• If the store connects its email marketing service, the API key it gives us for that service. We store it encrypted and use it only to add the store's chat leads to the list the store chose.
• If the store connects its helpdesk (Growth and Pro plans): the account address, the sign in email and the API key it gives us for that helpdesk. We store the key encrypted and use it only to create tickets for chats handed to the store's team, to add the shopper's later messages to them, and to read the team's replies.
• The star rating and review count the store's reviews app shows on each product.
• If the store connects its reviews app (Growth and Pro plans): the API key it gives us, stored encrypted, and the text of the reviews the store has published, with each review's star rating, date and whether it came from a verified buyer. These reviews are already public on the store. We never keep the reviewer's name, email address or any other detail about the reviewer, and we remove names, email addresses, phone numbers and links from the review text before we store it. The AI shares reviews only as shopper opinions, never as facts or promises from the store.
• If the store connects a team messaging workspace for chat alerts: the workspace and channel names and the access the workspace gives us to post alerts in that channel, stored encrypted. Disconnecting deletes them.
• If someone on the store's team turns on chat alerts on a phone or computer: for each device, the notification address its browser gives us, stored encrypted, a short device name such as "iPhone, Safari", and the Shopify staff account that turned it on.
• If the store connects its email marketing service, the API key it gives us for that service. We store it encrypted and use it only to add the store's chat leads to the list or audience the store chose. A store connects one email marketing service at a time.
• The star rating and review count the store's reviews app shows on each product.
• If the store connects its reviews app (Growth and Pro plans, one reviews app at a time): the API key or account ID it gives us, stored encrypted, and the text of the reviews the store has published, with each review's star rating, date and whether it came from a verified buyer. These reviews are already public on the store. We never keep the reviewer's name, email address or any other detail about the reviewer, and we remove names, email addresses, phone numbers and links from the review text before we store it. The AI shares reviews only as shopper opinions, never as facts or promises from the store.
• The access Shopify gives the app to read this information, kept so the app keeps working.

What we collect from shoppers

• The messages a shopper sends in the chat and the replies they receive.
• A random visitor number stored in the shopper's browser, so a conversation can continue on the next page. It is not used for advertising or tracking across sites.
• If the store shows a short welcome message next to the chat button, the shopper's browser remembers when it last showed it, so it appears at most once a day, and counts visits to the store, so a message can greet returning visitors. The browser also keeps the open chat so it can resume. Page activity a store can use to time that message, such as scrolling, time on the page or leaving the page, is checked in the browser only. None of this is sent to us.
• An email address and name, only if the shopper chooses to give them, and whether they agreed to marketing. The marketing box is never ticked in advance.
• An order number and email when a shopper asks about an order. We use them to check the order with Shopify and show its status. Both must match before anything is shown.
• When an order comes from a cart the chat helped build, the order total linked to that chat, so the store can see sales after a chat.
• When a shopper asks the store to cancel or change an order in the chat, the order number, the kind of change and what the shopper wrote. The order number and email must match first. Catchly never changes the order itself; the store's team does.
• The answers a shopper sends in a form the store adds to the chat, such as a contact or product question form.
• A thumbs up or down a shopper gives an AI reply, and an optional comment.
• If the store turned on photos from shoppers (Growth and Pro plans): a photo a shopper chooses to add to a message. Before it is stored, the shopper's browser and then our server save it again without its location, camera and other hidden details, at most 1,600 pixels wide. A photo that looks like a payment card or an identity document is deleted at once and never stored.
• The store page the chat started on, without the query string, and the products added to the cart from the chat, so the store can see what a chat led to and email a shopper a link back to that cart.
• If the store turned on back in stock emails and a shopper asks the chat to email them when an item that is sold out is back: their email address, the item, the chat language and when they asked. Nothing else is asked for, and there is no marketing box: it is a request for one email, not a subscription.
• If a shopper uses the unsubscribe link in an email sent for a store, that they unsubscribed and when.
• If the store turns on chat events for its own web analytics: the chat tells the analytics tag already on the store's page that the chat was opened, a question was asked, a product was added to the cart from the chat (with the product, price and currency), the chat was handed to the store's team, or an email was left. These events never include what the shopper wrote, their email, their name or any other personal detail. They are sent only when the shopper allowed analytics in the store's cookie banner, and they go to the store's own analytics, not to us. Catchly never adds a tracking script to the store.
• On our own website, catchlychat.com/demo, anyone can chat with Catchly on our demo store. We keep only the messages of that demo chat, the AI's replies, any rating given to a reply, and a random visitor number stored in the browser so the chat can continue after a reload. The demo does not ask for an email address or a name, and the chat is not sent on to any other service. The messages go to our AI service provider to write the replies, as for every chat. Please do not type personal details into the demo.

Catchly does not ask for payment details. Card and bank numbers, and identity numbers such as a social insurance number, are masked before a message is stored. A store's chat form can ask for other details, such as a phone number or an address, when the store chooses. Anything a shopper types into a message, a form or an order change request is kept with it.

Why we use it

• To answer shoppers from the store's own information and show where each answer came from.
• To use a photo a shopper added only to suggest similar products from the store's catalog or to help with a size, and to show the store's team photos of items that arrived damaged. The AI is not used to identify people in a photo or to judge the shopper's own item, such as its brand or whether it is genuine.
• To let the store's team read and reply to chats, and to alert them when a shopper needs a person.
• If the store chose to hand chats to its helpdesk: when a shopper asks for a person or the AI hands the chat to the team, to create a ticket in the store's helpdesk with the conversation so far, the shopper's email and name if they gave them, and the shopper's later messages in that chat, with card, bank and identity numbers masked, and to show the replies the store's team writes there in the chat.
• To send a shopper the reply by email when they asked for one.
• If the store turned on cart reminders: to send one reminder email, from the store, to a shopper who added an item from the chat, ticked the marketing box, and placed no order from that chat. Every reminder has a one click unsubscribe link.
• If the store turned on back in stock emails: to send one email, from the store, when the item the shopper asked about is back in stock, with a link to it and a one click unsubscribe link. That address is used for that one email only. It is not added to the store's leads, its Shopify customer list or its email marketing, and the request is not consent to marketing.
• To send the store a weekly summary of its chat numbers, which the store can turn off.
• To add shoppers who left their email to the store's Shopify customer list, as Shopify requires. A shopper who is new to the store is added as subscribed to its email marketing only if they ticked the marketing box. For someone who is already a customer of the store, the chat never changes their marketing choice; it only marks them as a chat lead.
• If the store connected its email marketing service: to subscribe shoppers who ticked the marketing box to the store's chosen list, with the chat recorded as the source of their consent. If that list asks new subscribers to confirm, the service sends its own confirmation email first. Shoppers who did not tick it are never subscribed. The store can also choose to add them to that service as contacts without a subscription.
• An unticked box never removes consent; an explicit unsubscribe always does. When a shopper uses the unsubscribe link in an email sent for a store, we stop that store's marketing email through Catchly at once, and we also unsubscribe them from the store's email marketing in Shopify and in the store's connected email marketing service, if it has one.
• To count AI conversations for the store's plan, and to keep the service secure.

We never sell personal data and never share it between stores. Store and shopper data is never used to train, fine tune or improve any AI model. Each store's AI answers only from that store's data. Catchly makes no automated decisions with legal or similar effects on anyone.

Analytics on this website

This section is about our own website, catchlychat.com. It does not apply to the Catchly app or to the chat on any store.

• Only if you accept. When you first visit, a small banner asks whether we may use analytics cookies. Nothing is loaded from the analytics service and no analytics cookie is set unless you press Accept. If you press Decline, or make no choice, the site works the same and the live demo works the same.
• What it collects. With your consent, a web analytics service records which pages are visited, an approximate location such as the country or city, the site that linked here, the type of device and browser, and a few clicks on this site: Install Catchly, Try the live demo, and starting a demo chat. It does not record what you type, and we do not use it for advertising, remarketing or ad personalisation.
• Cookies. After you accept, the analytics service sets its own cookies to tell repeat visits apart. Your choice itself is saved in your browser's local storage, not in a cookie.
• Changing your mind. Use Cookie settings at the bottom of any page. If you decline after accepting, analytics stops and its cookies are removed from this site.
• Where it goes. The analytics service may process this data outside Canada, including in the United States, and keeps it under its own retention settings.

Who helps us run Catchly

• Cloud hosting in Canada, where the app and its database run.
• An AI model provider, which receives the shopper's message and the store information needed to write a reply, and a photo the shopper added, to check it before it is stored and, for a product or size question, to choose products. It may process data outside Canada, including in the United States. It does not use this data to train its models.
• An email delivery provider, which delivers chat alerts, email replies, weekly summaries, cart reminders and back in stock emails.
• A web analytics service, for this website only and only after a visitor accepts analytics cookies, as described above. It never receives data from the Catchly app or from any store's chat.

Each provider only processes data to provide its service to us.

An email marketing service that a store connects is chosen by the store and works for the store, under the store's own agreement with it. We send it only the shopper details described above.

A team messaging workspace that a store connects for chat alerts is also chosen by the store. An alert posted there says what happened and links to the conversation. It can quote a short part of the shopper's message, with email addresses, phone numbers, card and bank numbers removed, and never adds the email address or name a shopper left in the chat.

Chat alerts on a phone or computer are delivered by the notification service of the browser on that device. They are encrypted so only that device can read them, and they contain only what happened, the store name and a link to the conversation, never anything the shopper wrote.

A helpdesk that a store connects is the store's own tool, chosen by the store and working for the store under the store's own agreement with it. It receives only the chats handed to the store's team, as described above, and what the store's team writes there.

A reviews app that a store connects is also chosen by the store. From it we only read the reviews the store has published, and we never send it anything about shoppers.

A store can also send chat events to its own tools: to its Shopify Flow workflows, and on the Pro plan to web addresses it adds as signed webhooks. When the store turns these on, they receive a lead's email, name and marketing choice, order change requests and form answers, as the store set up. These tools are chosen by the store and work for the store.

How long we keep it

• Conversations and leads: while the store has Catchly installed, unless the store deletes them sooner.
• When a store uninstalls Catchly: all of its data is deleted 48 hours later.
• When Shopify asks us to erase a store's data: it is deleted right away.
• When Shopify asks us to erase a shopper's data: their conversations, messages, photos, lead details, form answers, order change requests, back in stock requests, ratings, order lookup records and the request itself are deleted, and their questions are removed from replay test results.
• Back in stock requests: deleted 90 days after the shopper asked, whether the email was sent or not. Using the unsubscribe link deletes every request that address made in that store at once. They are also deleted in every case above.
• Shopper photos: deleted after 7, 30 or 90 days, as the store chooses (30 unless it changes it), or 24 hours after they were added if the shopper never sent them. They are also deleted with their conversation and in every case above.
• Product reviews: refreshed once a day, keeping at most the 50 newest published reviews of each product. A review the store hides or deletes is removed at the next refresh. When the store disconnects its reviews app, the key and every stored review are deleted right away, and they are also deleted with the rest of the store's data.
• Chat alert connections and devices: kept until the store disconnects its workspace or removes a device, the device turns alerts off or stops accepting them, or the store's data is deleted.
• Helpdesk tickets: kept in the store's own helpdesk, under the store's control. Catchly keeps only the ticket number with the conversation and deletes it with the conversation. When the store disconnects its helpdesk, the key is deleted right away.
• Background tasks, which can contain store update details: deleted 7 days after they finish, or 30 days after they fail.
• Replay test results, which re-run recent shopper questions for the store: deleted after 14 days.
• Webhook delivery records, which hold the delivery status and no shopper data: deleted after 30 days.
• Demo chats on catchlychat.com/demo: deleted 7 days after they start, with their messages and ratings.
• Encrypted backups: kept for 7 days, then replaced. Deleted data leaves the backups within that time.

How we protect it

• The database is encrypted at rest and is not reachable from the internet.
• All connections use encryption in transit.
• Backups are encrypted.
• Shopper photos are also encrypted one by one before they are stored, and the store's team sees them only through links that stop working within 10 minutes.
• When a store's team views leads, exports them, or opens a conversation or a shopper's photo, it is recorded in an access log that cannot be edited.
• Only our own staff can reach the servers, and only to keep the service running or to resolve a support request the store opened.

Your rights

Shoppers can ask the store for a copy of their data or for it to be deleted. Stores can send these requests through Shopify, which passes them to us, or write to support@catchlychat.com. When Shopify passes on a request for a copy, we email the store owner a file with the shopper's chat conversations, lead details, form answers, order change requests, back in stock requests, ratings and a list of the photos they sent with their dates, so the store can send it to the shopper. People in the European Union, the United Kingdom, California and Canada have rights to access, correct and delete their personal data, and we will help with any such request. A data processing addendum is available to stores on request.

Contact

Canuckt Synergy Solutions Inc., Bedford, Nova Scotia, Canada. Email support@catchlychat.com. If we change this policy, we will update the date at the top of this page.