• English

      • Privacy Policy Privacy Policy

      Last updated: 2026-08-17 Effective date: 2025-12-29

      Introduction

      HeiChat is provided by GenCybers INC, registered at 1942 Broadway St. STE 314C, Boulder, Colorado, United States ("HeiChat", "we", "us").

      HeiChat may also appear under the name Heicarbook in customer-facing or historical product materials. Heicarbook is a customer-facing name associated with GenCybers INC and does not identify a separate data controller or processor.

      This Privacy Policy explains how HeiChat collects, uses, stores, shares, and protects personal data when Shopify merchants install or use HeiChat and when store visitors or customers interact with HeiChat-powered support features.

      Where HeiChat processes personal data on behalf of a Shopify merchant, the merchant is generally the controller and HeiChat acts as processor as described in our Data Processing Addendum. For limited business account, billing, support, security, and service administration data, HeiChat may act as an independent controller.

      Privacy and GDPR contact: heicarbook@gmail.com.

      1. Information We Collect

      Depending on merchant configuration and customer interaction, HeiChat may collect and process the following categories of information.

      Merchant and account data

      • merchant account and contact information;
      • Shopify shop domain, shop identifiers, app installation status, billing/subscription status, and authorised Shopify API scopes;
      • HeiChat app settings, AI settings, widget configuration, automations, integrations, and support preferences;
      • merchant support communications and privacy/security request records.

      Customer support and Shopify context

      • customer chat messages and conversation metadata;
      • customer name, email address, phone number, Shopify customer ID, or other identifiers if provided in chat or returned by authorised Shopify APIs;
      • order identifiers, order status, fulfilment/shipping information, return information, product information, and other order-related support context where authorised by the merchant and needed to answer customer questions;
      • merchant-provided shop content, product content, instructions, uploaded knowledge base files, FAQs, and support materials.

      Technical, analytics, and security data

      • IP address, browser/device information, URL/page context, approximate location derived from network metadata, session identifiers, and attribution data where collected by the service or infrastructure;
      • HeiChat pixel and interaction events used for merchant-facing analytics, order attribution, and sales performance measurement;
      • AI request/response metadata, token counts, latency, provider routing metadata, and related operational metadata;
      • system logs, error logs, audit logs, security events, and abuse-prevention data.

      2. How We Use Information

      HeiChat uses information to:

      • provide and operate the HeiChat customer support assistant;
      • respond to customer questions using merchant-authorised context;
      • generate AI-assisted support responses;
      • maintain chat sessions, conversation history, merchant configuration, and knowledge base features;
      • retrieve relevant Shopify product, order, shipping, return, and customer context where authorised by the merchant;
      • measure order attribution and sales performance attributable to HeiChat interactions, subject to applicable consent requirements;
      • provide merchant-facing analytics and usage metrics;
      • maintain service reliability, debug issues, prevent abuse, and protect service security;
      • provide merchant support, account administration, billing support, and service notices;
      • comply with Shopify mandatory privacy webhooks and applicable legal obligations.

      HeiChat does not process merchant customer personal data for unrelated advertising, third-party retargeting, sale of data, or third-party marketing profiling unless this is expressly described in applicable documentation and lawful under applicable data protection law.

      HeiChat may use a storefront pixel or similar event collection technology. HeiChat's storefront pixel operates within Shopify's Customer Privacy framework. Shopify determines the applicable customer privacy status based on the merchant's Shopify privacy configuration, the visitor's region, and the visitor's consent choices where consent is required.

      HeiChat uses the pixel to support chat availability, basic session continuity, merchant-facing performance analytics, and order attribution.

      Depending on the applicable Shopify customer privacy status and merchant configuration, pixel and interaction data may include page context, product and cart events, browser/device information, IP-derived metadata, client or session identifiers, chat interaction events, attribution events, and order attribution signals where available.

      HeiChat uses this data to help merchants understand chat availability, support performance, and sales performance attributable to HeiChat interactions. HeiChat does not use pixel data for third-party advertising, third-party retargeting, sale of personal data, or cross-site advertising profiling.

      Merchants are responsible for configuring their Shopify privacy settings, cookie banner, customer privacy notices, and any required consent mechanisms according to the laws that apply to their storefront and customers.

      4. AI Data Use and Model Training

      HeiChat uses AI service providers to generate customer support responses for Shopify merchants.

      To generate a response, HeiChat may send the customer's message, relevant prior chat context, merchant instructions, knowledge base material, and relevant product, order, shipping, return, or customer context to OpenRouter and the selected model provider where authorised by the merchant and needed to answer the question.

      HeiChat does not use merchant customer chat messages, order information, customer data, shop content, uploaded knowledge base material, or other merchant data to train or fine-tune general-purpose AI models.

      HeiChat does not sell merchant or customer data to AI model providers. HeiChat configures available AI routing and privacy controls so that model providers are not permitted to use inputs or outputs for model training where such controls are available.

      Additional details are provided in the AI Data Use and Model Training Statement.

      5. Information Sharing and Subprocessors

      HeiChat uses subprocessors and service providers to provide, secure, monitor, support, and improve the service. These may include hosting and infrastructure providers, CDN/DNS providers, AI routing and model providers, Shopify platform and billing services, communication providers, monitoring providers, and support tools.

      These providers process information only as needed to provide their services to HeiChat or to the merchant, subject to appropriate contractual, security, and data protection obligations where applicable.

      HeiChat may share information:

      • with Shopify where required to operate the app, use authorised APIs, process app billing, or comply with Shopify platform requirements;
      • with AI routing and model providers where needed to generate support responses;
      • with infrastructure, monitoring, communication, and support providers used to operate HeiChat;
      • with a successor entity in connection with a merger, acquisition, financing, reorganisation, or sale of assets, subject to continued protection of personal data;
      • where required by law, legal process, court order, regulatory request, or to protect rights, safety, security, and service integrity.

      HeiChat does not sell merchant or customer personal data.

      6. Data Retention and Deletion

      HeiChat retains personal data only for as long as reasonably needed to provide the service, comply with legal obligations, resolve disputes, maintain security, and support applicable deletion processes.

      For data retained during an active subscription, HeiChat generally retains the data for the duration of the merchant's active subscription unless it is deleted earlier through a Shopify privacy webhook, direct merchant deletion request, or other applicable deletion process.

      Data categoryStandard retention
      Customer chat historiesFor the duration of the active subscription
      AI prompts/responses stored by HeiChatFor the duration of the active subscription
      Customer identifiersFor the duration of the active subscription
      Order-related information accessed or cached by HeiChatFor the duration of the active subscription
      IP address and device/browser attribution dataFor the duration of the active subscription
      Merchant configuration and app settingsUntil deletion/uninstall plus applicable post-uninstall retention
      Uploaded knowledge base materialFor the duration of the active subscription
      System logs, error logs, and audit logs7 days
      Analytics and usage metricsFor the duration of the active subscription
      BackupsDaily snapshots retained for 30 days

      To support reinstallation and service continuity, HeiChat may retain the merchant's basic configuration and customer chat records for up to 12 months after the merchant uninstalls the app.

      After uninstall, data other than the merchant's basic configuration and customer chat records is deleted or anonymised in accordance with Shopify privacy webhook requirements and applicable Shopify requirements. This includes order data/cache, customer identifiers, IP/device/browser attribution data, analytics metrics, AI request/response records, product data, and knowledge base data, unless retention is legally required.

      Deleted data may remain in AWS backup snapshots until the applicable 30-day snapshot retention cycle expires.

      Additional details are provided in the Data Retention and Deletion Policy.

      7. Shopify Privacy Webhooks and Deletion Requests

      HeiChat processes Shopify mandatory privacy webhook requests, including:

      • customers/data_request
      • customers/redact
      • shop/redact

      HeiChat verifies Shopify webhook signatures, identifies applicable records, and deletes, anonymises, exports, or reports applicable data according to the webhook topic.

      HeiChat's operational target is to complete valid Shopify privacy webhook requests within 48 hours after receipt. If a request requires backup expiry, complex manual review, or legal retention assessment, HeiChat aims to complete the request within 30 days unless a longer period is permitted or required by applicable law.

      Merchants may also request deletion by contacting heicarbook@gmail.com. HeiChat will verify the request and delete or anonymise applicable merchant and customer data within a reasonable period, unless retention is required by law.

      8. International Data Transfers

      Personal data may be processed and stored in the United States and other countries where HeiChat or its subprocessors operate.

      HeiChat's main application infrastructure, database, and data management are hosted on Amazon Web Services (AWS) in the United States, primarily in the AWS us-east-2 region. HeiChat also uses Cloudflare and AWS CDN/DNS services, which may process request metadata through global edge locations. AI requests may be routed through OpenRouter and selected model providers.

      For transfers from the EEA, UK, Switzerland, or other regions to countries without an applicable adequacy decision, HeiChat relies on appropriate safeguards such as Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework for certified U.S. recipients.

      Additional details are provided in the International Data Transfers section.

      9. Information Security

      HeiChat implements technical and organisational measures designed to protect personal data processed through the HeiChat Shopify app.

      These measures include HTTPS/TLS for production traffic, database encryption at rest, encrypted backups where supported by AWS, access controls, least-privilege administrative access, multi-factor authentication for administrative access, production access logging, backup and recovery practices, incident response processes, vulnerability remediation, and data minimisation.

      No internet-based service can guarantee absolute security. Merchants and users should also maintain appropriate security controls for their own accounts, devices, Shopify stores, and access credentials.

      Additional details are provided in the Technical and Organisational Measures section.

      10. Your Rights

      Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data about you.

      If you are a customer or visitor of a Shopify merchant using HeiChat, please contact the merchant first because the merchant is generally the controller of your customer data. HeiChat will reasonably assist merchants in responding to data subject requests.

      If your request concerns HeiChat account, support, billing, or service administration data controlled by HeiChat, you may contact heicarbook@gmail.com.

      11. Children's Privacy

      HeiChat is intended for use by Shopify merchants and their storefronts. HeiChat is not directed to children under 13, and we do not knowingly collect personal data directly from children under 13. If you believe a child has provided personal data to HeiChat, contact heicarbook@gmail.com.

      12. Changes to This Policy

      We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and may provide notice through reasonable channels such as documentation updates, app notices, or merchant account contact information.

      Continued use of HeiChat after an updated Privacy Policy becomes effective means the service will be handled according to the updated Privacy Policy.

      13. Contact

      Privacy and GDPR contact: heicarbook@gmail.com.