Your store's data, protected and never used to train AI
A plain summary of how Catchly handles your data and your shoppers' data. Catchly is made by Canuckt Synergy Solutions Inc., a Canadian company based in Bedford, Nova Scotia.
Summary
Encrypted at rest and in transit
The database is stored on an encrypted volume. Every connection to Catchly uses TLS. Nightly backups are encrypted with AES 256, and the backup key is kept off the server.
Never used to train AI
Your data is used only to run Catchly for your store. It is never sold, never shared with other stores, and never used to train, fine tune or improve any AI model.
Deleted when you uninstall
Your store data is deleted within 48 hours of uninstalling, and straight away when Shopify sends a store deletion request. Shopper data is deleted when a shopper deletion request arrives.
Only the data it needs
Catchly keeps what the chat needs: messages, the email and optional name a shopper chooses to give, and order lookups. It never asks for payment details, and card numbers are masked before a message is stored. A chat form asks for more, such as a phone number, only if your store adds one.
How we protect data
- Each store is separate. Every query is limited to one store, and each store's AI answers only from that store's data.
- The database is private. It is not reachable from the internet.
- Access is limited and logged. Production access uses key based login only. Every view of protected customer data through the app, such as an order lookup, a lead list view or a CSV export, is written to an append only log.
- Two step verification is required on every account that can reach production systems or customer data.
- No customer data in logs. Application logs record ids, not personal details.
- Test data stays test data. Development uses a separate store with made up data. Production data is never copied to development.
- We only look when you ask. Your store's data is viewed only to resolve a support request you opened.
Shopper consent
Marketing consent is an unticked checkbox. A shopper is subscribed to your email marketing only when they tick it. Catchly makes no automated decisions with legal or similarly significant effects.
Retention
- Conversations are kept while Catchly is installed, unless you delete them.
- Store data is deleted within 48 hours of uninstalling.
- Background job records are deleted 7 days after they finish, or 30 days after they fail.
If something goes wrong
We have a written incident response plan. If we suspect a breach involving Shopify data, we notify Shopify within 24 hours and affected merchants without undue delay. Where there is a real risk of significant harm, we also notify the Office of the Privacy Commissioner of Canada and the people affected, as Canadian privacy law requires. Every incident is reviewed within 7 days and the root cause is fixed.
Agreements and questions
Data processing is covered by our Terms of Service and Privacy Policy. A data processing addendum is available on request. For any security question, or to report a vulnerability, email support@catchlychat.com.
Be one of the first stores on Catchly
Catchly is live on the Shopify App Store. Start on the Free plan, or try any paid plan free for 14 days. Billing goes through your Shopify invoice.