Privacy policy

Information the App accesses

• Shop domain, Shopify shop ID, authentication session, and granted access scopes.
• Order data, read only when the merchant’s bot asks about a customer’s orders: order number, date, payment and fulfillment status, item names and quantities, and shipments with their status, estimated delivery, tracking number, carrier, and tracking link.
• When the merchant connects the App to ping.ai: the shop’s name, its myshopify domain and the phone number in the shop’s store details in Shopify, so the merchant’s ping.ai account is set up and ping.ai’s team knows which store joined and how to reach it.
• Protected customer data used to confirm that the person writing owns the order: the customer’s first name, the phone numbers and email address on the order and the customer record, and the country of the shipping and billing address.
• From the merchant’s ping.ai bot: the WhatsApp number of the customer who is writing and, if the customer provides them, an order number and email address.
• Optional site chat widget: if the merchant enables the App’s theme embed, their storefront loads a script from pingai.org that sends the shop’s myshopify domain to ping.ai to identify the store, and messages that visitors type into the widget are sent to ping.ai to be answered. The App’s server sends nothing for this feature.
• Visitor activity on the storefront, through the same theme embed: a random identifier the script keeps in the shop’s own local storage (not a cookie), and what that browser did in the store — product pages viewed, adding to the cart, going to checkout, and how many visits. Ordinary page navigation is counted only. Nothing is recorded where the shop’s consent banner says analytics are not allowed, and nothing identifies a person until that visitor chooses to leave their details in the store or signs in to their customer account in the store; then their browsing is linked to the details they gave, or to that Shopify customer (the script sends the signed-in customer’s Shopify customer ID, which the storefront already exposes, so ping.ai can match it to the customer it read). The App’s server sends nothing for this feature.
• For the merchant’s own sales reports in ping.ai (for example, “how many orders last month?”): the orders created in the period asked about, with order number, dates, payment and fulfillment status, total and refunded amount, and item names and quantities, without customer names, contact details, or addresses.
• For the merchant’s order board in ping.ai (the store’s orders, including past ones, with their delivery status): the same order details as sales reports plus the customer’s name and phone number, without email addresses or addresses, and each shipment’s tracking number and carrier.
• For the merchant’s customer segments in ping.ai (for example, “bought once”, “spent over 1,000”, “hasn’t ordered in 90 days”), when the merchant turns them on: the store’s order history (read the first time as one file Shopify prepares, a bulk export), each order with its number, dates, payment and fulfillment status, total, subtotal, discount and refunded amounts, the discount codes used, the sales channel, the order’s tags, item names, variants, SKUs, quantities and prices, the city, region and country it ships to (never the street address), and the customer’s Shopify customer id, first and last name, email address, phone number, and marketing consent state.
• For the merchant’s profiles and customer segments in ping.ai, so they include every customer in the store, also those who never ordered: the store’s customers (read the first time as one file Shopify prepares, a bulk export), each with their Shopify customer id, first and last name, email address, phone number (their own or their default address’s), marketing consent state, tags, number of orders and amount spent, language, the city and country of their default address (never the street address), when they were created and last updated, the app or sales channel that created them, as Shopify’s customer timeline records it, and the date of their latest abandoned checkout.
• For the merchant’s own assistant in ping.ai, when the merchant asks about specific orders by number (up to ten at a time): those orders with the same details as the order board plus the shipping address (name, street, city, postal code, region, country, and phone), used only to answer the merchant and not stored. Addresses are never sent for sales reports, the order board, or date ranges.
• For the merchant’s automations: abandoned checkouts (checkout name and dates, items, prices, total, recovery link, and discount codes) and paid orders (order number, items, prices, variants, total, order status link, the discount codes used, and each item’s line-item properties, such as the bundle recorded by ping.ai’s storefront script when the item was added), each with the customer’s first and last name, phone number, email address, marketing consent state, city, and country.
• For the merchant’s coupons in ping.ai: the discount codes the App created for them, read back with their title, status, start and end dates, usage limit, how many times they were used, and how many codes they have. The App changes only discounts it created (each carries the tag “ping.ai”), never the merchant’s other discounts, and no customer data is involved.
• For the merchant’s coupons page in ping.ai, which lists every coupon of the store: the store’s existing discount codes, read only, each with its title, its code (for a discount with many codes, how many it has and the first one), type and value, minimum order, start and end dates, status, how many times it was used, usage limit, and once-per-customer rule. No customer data is read, and the App never changes or deletes these discounts.
• The merchant’s own subscription to this App, read from Shopify: which plan the store is on, its price and currency, the billing period and its end date, and any trial end date. No payment details or card data are accessed — Shopify handles payment.

How information is used

• Authenticate the merchant and keep the App connected to their Shopify store.
• Confirm that the customer writing to the merchant’s bot is the customer on the order: their WhatsApp number matches a phone on the order, or they give the order number together with the email used on the order. When a customer types an email address or phone number to find their orders, ping.ai first sends a one-time verification code to it and returns orders only after the code is entered.
• Return the verified orders’ number, date, payment and fulfillment status, item names and quantities, shipment status, tracking number, carrier, and tracking link, plus the customer’s first name, to the merchant’s bot. At most the three most recent orders are returned. For these lookups, addresses, email addresses, phone numbers, prices, and payment details are never returned.
• Send abandoned checkouts, and each order once it is paid, to the merchant’s ping.ai account so the automations the merchant turns on can message those customers on WhatsApp, and let ping.ai check right before each message whether a checkout was completed or an order was cancelled or refunded.
• Attribute bundle sales in the merchant’s ping.ai account, from the line-item properties ping.ai’s storefront script set and the discount codes used on each paid order.
• Tag the paid orders ping.ai brought in, so the merchant can filter them in the Shopify admin, with a tag for where each came from: “ping-cart” (an abandoned-checkout message), “ping-automation” (another automation message), “ping-banner” (details left on a site banner), “ping-bot” (a chat the bot answered) or “ping-bundle” (an item added from a ping.ai bundle on the product page). ping.ai decides this from its own records of the customer’s phone or email, within its attribution window, and for “ping-bundle” from the order’s own line-item properties; the App only adds the tags and keeps the order’s other tags.
• Apply the bundles the merchant sets up in ping.ai (quantity and bundle discounts, a free gift, free shipping) through one automatic discount in the merchant’s store, “ping.ai bundles”. ping.ai sends the bundle settings (products, quantities, and percentages, no customer data), and the App stores them on that discount; the discount is removed when the merchant removes all bundles.
• Create the coupons the merchant sets up in ping.ai as discount codes in the merchant’s store, tagged “ping.ai”: a percentage or fixed amount off, or free shipping, with the minimum order, once-per-customer rule, usage limit, dates, and products or collections the merchant chose. A coupon is one shared code, or a code per customer: ping.ai makes the random codes and sends them, without any customer data, and the App adds them to that one discount. ping.ai alone records which customer received which code. The App also reports a coupon’s status and usage to ping.ai, and turns it off or deletes it when the merchant does so in ping.ai.
• Show the merchant’s existing discount codes in ping.ai’s coupons page next to the coupons made in ping.ai, so the merchant can copy a code, open it in the Shopify admin, or pick one with a single code to send in a ping.ai automation. The App only reads these discounts.
• Answer the merchant’s own questions about their sales in ping.ai from the orders of the period they ask about (no customer details).
• Build the merchant’s customer segments in ping.ai from the order history, so the merchant can send their own email campaigns and WhatsApp broadcasts to a segment. Messages go only to customers whose marketing consent allows it. ping.ai keeps the orders and customers while the app is connected, updates them as orders change, and deletes them on uninstall, on Shopify’s shop-redaction request, or (for one customer) on a customer-redaction request.
• Show the merchant every customer of their store in ping.ai’s profiles, and let them build segments by a customer’s tags or by the app that created the customer (for example, everyone a sign-up form brought in). ping.ai keeps the customers while the app is connected, updates them as they change, and deletes them on uninstall, on Shopify’s shop-redaction request, or (for one customer) on a customer-redaction request.
• Show the merchant their orders with delivery status on the ping.ai order board, with the customer’s name and phone so the merchant can contact them about a delayed parcel. ping.ai looks up each tracking number with its parcel-tracking service, which checks the carriers; only the tracking number is sent there. ping.ai keeps the name and phone for up to 90 days after the order, and keeps the orders while the app is connected; they are deleted on uninstall or on Shopify’s shop-redaction request.
• Tell the merchant’s ping.ai account which plan their store is on, so the features they paid for are unlocked there and stop when the subscription ends.
• Report the merchant’s usage charges to Shopify, so they appear on the merchant’s Shopify invoice: ping.ai sends the App a count only (how many blocks of 500 active profiles the merchant chose above those their plan includes, and how many SMS the store sent over its plan’s monthly allowance), and the App passes that count to Shopify with the store’s Shopify ID. No customer data is part of it. If the merchant uninstalls the App, ping.ai sends the usage of the period that is not yet billed once more, with the store’s Shopify ID, within the 24 hours Shopify allows.
• Verify request signatures, prevent replayed requests, apply rate limits, keep an access log, and troubleshoot failures.

We do not sell personal information, use it for advertising, build profiles outside the merchant’s store, or share it with anyone other than the service providers below and the merchant’s ping.ai WhatsApp bot.

Information retained

Customer names, contact details, and addresses are not written to the App database: bot lookups read them from Shopify for each request, and checkouts and paid orders are passed to the merchant’s ping.ai account without a copy kept here. We retain: Shopify authentication sessions; the ping.ai connection’s status, an encrypted credential, and the time it was last used; the store’s current plan with its price and billing dates; an access log for 90 days recording the time of each lookup or delivery and the number of records involved; request identifiers for 15 minutes; and rate-limit counters for one hour.

When the merchant connects, ping.ai also reads the abandoned checkouts the store still has (Shopify keeps them for about three months), for the merchant’s profiles and segments; older abandoned checkouts brought in this way never start an automation. In the merchant’s ping.ai account, abandoned checkouts with their contact details are kept while the App is connected, and paid orders’ contact details are anonymized after 90 days. Everything is deleted on uninstall or on Shopify’s shop-redaction request, and a customer’s data on a customer-redaction request.

Disclosure and service providers

Information is processed by our hosting provider (Vercel), our database provider (Neon, encrypted PostgreSQL), and Shopify. Providers act under contract and access controls and only to operate and secure the App. The order-status answers, abandoned checkouts, and paid orders described above are sent to the merchant’s ping.ai account (pingai.org), which stores checkouts and paid orders to schedule the merchant’s messages, sends WhatsApp messages through Meta, and processes customer messages to the bot through Google (Gemini) to reply. The merchant can disconnect the bot at any time in the App, and uninstalling the App revokes its access immediately. We may disclose information when required by law or to protect the security and integrity of the service.

Security and international processing

Data is encrypted in transit using TLS. The production database and its backups are encrypted at rest, connection credentials are additionally encrypted at the application layer, staff access is limited to the App owner and protected by strong passwords and two-factor authentication, and development data is kept separate from production data. Our security and incident response policy is published at /security. Infrastructure providers may process data in countries other than the merchant’s country, subject to applicable contractual and legal safeguards.

Deletion and privacy requests

The App verifies Shopify’s mandatory customer data-request, customer-redaction, and shop-redaction webhooks and forwards each one to ping.ai; Shopify retries until ping.ai confirms it has processed the request. A customer-redaction request deletes that customer’s checkouts, orders, and contact details from the merchant’s ping.ai account. For a customer data request, ping.ai sends the merchant the data it holds about that customer so the merchant can respond. Customer-level data is not retained in the App itself, so there is no other customer record to export or erase.

When the App is uninstalled, we revoke the ping.ai connection immediately, so ping.ai stops using the store’s data at once, and we delete sessions, connection records, and access logs. When Shopify’s shop-redaction request arrives 48 hours after uninstall, ping.ai deletes the customer data that came from the merchant’s Shopify store, in any case within 30 days of uninstall. The same 30 days apply when the merchant disconnects the store from their ping.ai account, or connects it to a different ping.ai account: the data that came from the store is deleted from the account it left, unless the store is connected to that account again. Repeated shop-redaction requests are handled idempotently.

Buyers should direct privacy requests to the Shopify merchant from whom they purchased. Merchants can contact us for help responding to a request.

Changes

We may update this policy when the App or legal requirements change. The effective date above will be updated, and material changes will be communicated through the App or merchant contact information when appropriate.