Privacy Policy

Who we are

KartWise ("we," "us") provides an AI chat assistant that Shopify merchants ("merchants," "you") install on their storefronts to answer product, shipping, and policy questions for their customers ("shoppers"). This policy covers the KartWise app, this website, and any data either one processes.

If you're a shopper chatting with a KartWise-powered assistant on a merchant's store, that merchant is the business you're shopping with — this policy explains how KartWise, as their service provider, handles the data involved in that conversation.

Information we collect

From merchants

When you install KartWise, Shopify shares the store information needed to run the assistant: your shop domain, product catalog (titles, descriptions, prices, images, inventory, tags, and metafields), store pages and policies (returns, shipping, About Us, etc.), and basic shop details. We also store the settings you configure — FAQ entries, chat personality, branding, quick actions, handoff preferences, and similar preferences.

From shoppers

When someone chats with the assistant on a merchant's store, we process the messages they send so the assistant can respond, along with any product images they upload to search for similar items. If they give a thumbs up or thumbs down on a response, we store that rating. We also log basic technical data, like IP address, to prevent abuse and keep the chat responsive.

If a shopper chooses to log in with their Shopify customer account to track an order, we receive their account and order information for the length of that conversation, as described below under Customer account login.

How we use it

• To generate accurate, store-specific answers using your catalog, policies, and FAQ entries.
• To find and display matching products, including live stock and pricing.
• To hand a conversation off to your connected live-chat app when a shopper asks for a human.
• To show you analytics about chat volume, common questions, and customer satisfaction in your dashboard.
• To operate, maintain, secure, and improve the service.

Chat data from your store is used to serve your store — we don't share one merchant's conversations, products, or settings with another merchant.

Third-party services

KartWise relies on a small number of service providers to operate. Each processes data only as needed to provide their part of the service, under their own security and privacy terms:

• Shopify — the platform KartWise is built on; provides store, product, and customer-account data through Shopify's APIs.
• OpenAI and Anthropic — language-model providers used to understand shopper questions and generate responses.
• MongoDB Atlas — hosts the product and knowledge-base search index.
• Upstash (Redis) — short-lived caching for settings and session data.
• Fly.io — hosts the application itself.

Customer account login

Order tracking requires the shopper to log in through Shopify's own secure customer-account sign-in (OAuth) — KartWise never sees or stores their password. Once signed in, we use the resulting access token to look up their orders for that conversation. We don't use this access for anything beyond answering their question.

Data retention and deletion

Conversations are capped in length and older conversations are cleared on a regular schedule. When a merchant uninstalls KartWise, we automatically delete that store's data, including settings, FAQ entries, and stored conversations. We also honor Shopify's standard data-request and data-erasure webhooks, so a specific customer's data can be deleted or exported on request.

Security

All traffic to and from KartWise is encrypted (HTTPS). Requests between the storefront widget and our backend are verified with a signed request check so they can't be spoofed, and standard security headers are applied to every response. Access tokens are never exposed to the browser.

Your rights

Depending on where you're located, you may have the right to access, correct, delete, or receive a copy of your personal data. Shoppers should start by contacting the merchant whose store they chatted with, since they control the store relationship — merchants and shoppers can also reach us directly using the contact details below, and we'll help fulfill the request.

Children's privacy

KartWise is not directed at children, and we don't knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we'll remove it.

Changes to this policy

We may update this policy as KartWise changes. We'll post updates on this page and revise the "Last updated" date above.

Contact us

Questions about this policy or a data request? Email us at hello@kartai.io.