Privacy Policy

Nellie (“Nellie”, “we”, “us”, or “our”) provides an application that helps Shopify merchants recover abandoned shopping carts through automated, AI-assisted conversations and discount codes. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices and rights available to merchants and their customers.

This policy applies to the Nellie application, its dashboard, and related services (collectively, the “Service”). By installing or using the Service, you agree to the practices described here.

1. Information We Collect

When a merchant installs Nellie from the Shopify App Store, we request access to specific data through the Shopify API using the minimum scopes needed to operate the Service (read_orders and write_discounts). We collect and process:

• Store information: your store domain, shop identifier, store settings, and the offline access token issued by Shopify during installation.
• Checkout and order data: abandoned checkouts and orders, including line items, totals, currency, checkout tokens, and timestamps, used to detect abandoned carts and attribute recoveries.
• Customer personal data: where present on orders and checkouts, a customer’s name, email address, and phone number. This is Protected Customer Data under Shopify’s policies and is used solely to contact the customer about their abandoned cart and to attribute recoveries.
• Conversation data: messages exchanged during recovery outreach and the AI-generated responses used to help complete a purchase.
• Discount data: recovery discount codes we create on the merchant’s behalf.

2. How We Use Information

• Detect abandoned carts and identify recovery opportunities.
• Generate and send recovery messages to customers via supported channels (such as messaging or email).
• Create discount codes and attribute recovered orders back to outreach.
• Provide analytics and reporting to the merchant.
• Operate, maintain, secure, and improve the Service.
• Comply with legal obligations and Shopify requirements.

We do not sell personal information, and we do not use customer personal data for advertising.

3. AI Processing

Nellie uses third-party artificial intelligence service providers to generate conversational recovery messages. Relevant cart and conversation context may be sent to these providers to produce responses. We only share the data necessary for this purpose, and we rely on providers that do not use the submitted data to train their models where such controls are available.

4. Sharing and Sub-processors

We share information only with service providers that help us operate the Service, including:

• Shopify — the platform through which the Service operates.
• AI service providers — to generate conversational responses.
• Messaging and email providers — to deliver recovery messages to customers.
• Hosting and infrastructure providers — to run and store the Service’s data.

These providers are permitted to use the information only to provide services to us. We may also disclose information where required by law or to protect our rights.

5. Data Retention

We retain merchant and customer data for as long as the app is installed and as needed to provide the Service. When a merchant uninstalls Nellie, or when we receive a Shopify data-deletion request, we delete or anonymize the associated data as described below.

6. Your Rights and Data Deletion (GDPR/CCPA)

We honor Shopify’s mandatory compliance webhooks and applicable privacy laws, including the GDPR and CCPA:

• customers/data_request — when a customer requests their data, we compile the personal data we hold for that customer and make it available to the merchant.
• customers/redact — we erase or anonymize a customer’s personal data upon request.
• shop/redact — 48 hours after a merchant uninstalls the app, we delete the shop’s data, including the stored session and all associated records.

Customers should direct data-access or deletion requests to the merchant they shopped with. Merchants and customers may also contact us directly at kostuip@gmail.com.

7. Security

We use administrative, technical, and organizational safeguards to protect data, including encryption in transit, verification of webhook authenticity (HMAC), and restricted access to stored access tokens. No method of transmission or storage is completely secure, but we work to protect data using industry-standard practices.

8. International Transfers

Your information may be processed and stored in countries other than where you reside. Where required, we take steps to ensure appropriate safeguards are in place for such transfers.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be communicated through the Service where appropriate.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at kostuip@gmail.com.