Your Shopify store's data, handled carefully
You're connecting Vosaire's apps to real products, orders and customers, and for the AI Chatbot, if you choose, a Gmail inbox. Here's exactly how that data is protected, in plain language, with the full legal detail linked below.
Encrypted everywhere
TLS 1.3 in transit, AES-256 at rest. Shopify access tokens and Gmail OAuth credentials are stored encrypted.
Known data residency
Every app's primary data lives on servers in the EU (Hetzner, Germany). Files and encrypted backups on Cloudflare R2. No undisclosed regions.
You approve every change
AI Visibility installs read-only and changes nothing on your store until you approve it. The AI Chatbot only offers the discounts your rules allow.
Role-based access
Internal access to merchant data is scoped by role — nobody on our team has blanket access by default.
GDPR webhooks, actually implemented
Every app handles all three Shopify-required compliance webhooks: data requests, customer redaction, and full shop redaction after uninstall.
No training on your data
Your store data, conversations, Gmail content and AI Visibility results are never used to train or fine-tune any AI model, ours or a provider's.
AI Chatbot & Sales: your data
Live on ShopifyWho else handles your data, and for how long we keep it.
Sub-processors
| Sub-processor | Purpose | Country |
|---|---|---|
| OpenAI | AI response generation, including replies to Gmail messages | US |
| Amazon Web Services (SES) | Transactional email delivery | US |
| Cloudflare R2 | File and knowledge-base storage | US |
| Hetzner | Server infrastructure | Germany |
| Google (Analytics) | vosaire.com website traffic analytics — only after you accept in the cookie banner | US |
How long we keep it
| Data category | Retention | Basis |
|---|---|---|
| Store & conversation data (including Gmail-derived replies) | Duration of install + 30 days after uninstall | Contract |
| Knowledge base content | Until re-synced or 30 days after uninstall | Contract |
| Gmail OAuth connection | Until the merchant disconnects the channel, removes the connection in Integrations, or revokes access via their Google Account, or the app is uninstalled | Contract |
| Cookie-consent decisions (vosaire.com) | 24 months from the decision, or until you change your choice | Legal compliance |
| Security / audit logs | 12 months | Legitimate interest |
| Support communications | 3 years | Legitimate interest |
AI Visibility & AEO: your data
Coming soonInstalls read-only and keeps no shopper names, emails or addresses. Who else handles your data, and for how long we keep it.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Shopify | The platform the app runs on; app billing | Canada / global |
| Hetzner Online | Hosting of the app's servers and database | Germany (Falkenstein) |
| Cloudflare (R2) | Encrypted nightly database backups | Global |
| Amazon Web Services (SES) | Sending emails to the merchant | United States |
| Anthropic | The app's own AI work; Claude answers (Pro) | United States |
| OpenAI | ChatGPT answers (all plans); may also run the app's own AI work | United States |
| Google (Gemini API) | Gemini answers (Growth and Pro) | United States |
| Perplexity | Perplexity answers (Growth and Pro) | United States |
| xAI | Grok answers (Pro) | United States |
| IndexNow (api.indexnow.org) | Telling search engines a store page changed | Global |
How long we keep it
| Data | Retention |
|---|---|
| Catalog, questions, AI answers, drafts and results | While the app is installed, so it can show trends |
| Access tokens for your store | Deleted the moment you uninstall |
| Everything the app holds about your store | Deleted 48 hours after uninstall (Shopify's shop/redact request) |
| Copies of Shopify webhook payloads | Emptied after 30 days; log rows deleted after 90 days |
| Encrypted database backups | Most expire within 4 months; one yearly copy kept up to 2 years |
Every sub-processor is bound by a data processing agreement or its own API terms. Full detail in our Privacy Policy.
Security & data FAQ
Does Vosaire sell or share my store's data?+
No, never, in any app. We do not sell or share personal information — see our Privacy Policy's California/CCPA section for the specific legal commitment.
Is my data used to train AI models?+
No. We don't use your store data, conversations, Gmail content or AI Visibility results to train or fine-tune any AI model, Vosaire's own systems included. AI providers receive requests through their business APIs and handle them under their API terms, which don't allow training on API data by default.
What do AI assistants see when AI Visibility checks my store?+
Only the buyer question, in the language it's asked in, and the shopper's country. The app's own AI work (writing questions, drafting pages and product details) sends your store and product data to our AI provider. Prompts never contain your shoppers' personal data.
What happens to my data if I connect Gmail to the AI Chatbot?+
The AI Chatbot only reads the connected inbox to detect and draft replies to customer emails — never Sent mail, Trash, contacts, or calendar. It adheres to Google's API Services User Data Policy, including the Limited Use requirements: no ads, no selling, no training a generalized AI model on that data.
What happens to my data if I uninstall an app?+
Each app deletes only its own data. The AI Chatbot permanently deletes everything tied to your store — conversations, knowledge sources, revenue records, Gmail-derived data — within 30 days. AI Visibility deletes everything it holds 48 hours after uninstall, when Shopify sends the shop/redact request.
What if there's a data breach?+
If a breach affects your personal data, we notify you and, where required, supervisory authorities within 72 hours of becoming aware of it.
Where can I see the full legal detail?+
This page is a plain-language summary. The binding terms — including sub-processor DPAs, retention periods, and your rights under GDPR, CCPA, and India's DPDP Act — are in our Privacy Policy, with one detailed part for each app.
Found a security issue?
Email privacy@vosaire.comwith details — we read every report and aim to respond within 5 business days. Please don't test against merchant stores you don't own or have permission to test.