withly.
Back to home

Withly Inbox Privacy Policy

Last updated: October 16, 2026

1. Overview

Withly (“we”, “us”, or “our”) provides Withly Inbox – AI Chat Bot, a Shopify app that helps merchants answer customer questions using content from their Shopify stores. This policy explains how the app handles information.

2. Information We Process

Merchant and store information

We process the shop domain, Shopify account information supplied during authentication, merchant contact email, app plan and usage information, and the access credentials required to operate the app.

Store content

With your authorization, we read products, collections, pages, blog articles, store policies, and theme information. We use this content to configure the chat widget and provide relevant answers. We also create embeddings, which are numerical representations used to search that content.

Customer chat data

We process anonymous chat session identifiers, chat messages, and conversation history submitted through the widget. We do not request or access Shopify customer records. A shopper may voluntarily include personal information in a message; merchants should avoid asking shoppers to send sensitive information through the chat.

Contact requests

When the assistant cannot answer, or the store is outside the business hours the merchant set, the widget may offer a contact form. If a shopper chooses to use it, we store the email address and question they enter with that conversation and send them to the merchant’s store email so the merchant can reply. Merchants can turn this form off in the app settings, and should mention it in their own store privacy policy.

Chat analytics

To show merchants which questions the assistant could not answer, we keep those questions with email addresses, phone numbers, and card numbers removed. We also record anonymous “add to cart” clicks on product cards shown in the chat (product, variant, and the anonymous chat session identifier). We do not access orders or customer accounts for analytics.

Imported knowledge

Merchants can import knowledge from a public web page or an uploaded text, Markdown, CSV, or PDF file. We fetch or read that content only on the merchant’s request and store the extracted text and its embeddings like other store content.

3. How We Use Information

  • Provide, secure, and improve Withly Inbox.
  • Sync store content and generate context-aware chat responses.
  • Manage app usage, subscriptions, and service notifications.
  • Respond to support requests and investigate reliability or security issues.
  • Meet Shopify’s required privacy and data-deletion webhook obligations.

We do not sell personal information or use it for third-party advertising.

4. Service Providers

  • Shopify provides authentication, store APIs, and app billing.
  • Google Gemini processes store content and chat messages to create embeddings and generate AI responses.
  • SendGrid sends transactional emails when email notifications are enabled, including contact requests forwarded to the merchant.
  • Crisp provides the merchant-facing support chat used in the app administration experience.
  • Telegram may receive limited operational notifications, such as installation, billing, or error alerts.

5. Retention and Deletion

  • Conversation records, including any email address left through the contact form, are configured for deletion after 30 days.
  • When Shopify sends a customer-redaction request, we delete conversations that contain that customer’s email address from the contact form.
  • Unanswered-question summaries and anonymous add-to-cart click records are deleted after 90 days.
  • When a merchant uninstalls the app or Shopify sends a shop-redaction request, we delete the shop’s app data and access sessions.
  • We retain compliance-request logs for up to two years to document how those requests were handled.

6. Your Privacy Choices

Merchants can request access to, correction of, or deletion of app data by contacting us. We also process Shopify’s mandatory data-request and redaction webhooks. For a customer request concerning a merchant’s store, please contact that merchant first.

7. Security

We use access controls and encryption in transit to protect information. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

8. Changes and Contact

We may update this policy as the app changes. The current version is published at this URL. For privacy questions or requests, email support@withly.org.