Privacy Policy

Who this covers

This policy describes the Sonic Prospect Shopify app. App charges go through Shopify App Pricing as a share of attributed sales the agent drives.

Cookies

Cookie name: sonic_prospect_session. Purpose: keep the shopper's chat session so the conversation can continue on later visits. Lifetime: 30 days. Sales attribution uses that cookie only when the shopper has consented under Shopify's Customer Privacy API (analytics or marketing allowed, or no consent required in their region). Without that consent the cookie is used for chat continuity only.

Data flow

Storefront chat → this app (sonic.pivony.com on Google Cloud, us-central1) → Pivony commerce API → Google Gemini on Vertex AI (us-central1).

Personal data in chat

Shoppers may type personal information into the chat, such as their name, email or phone number. We store it with the conversation so the merchant can follow up, and we automatically mask payment card numbers. Shoppers can request deletion through the merchant.

If you use “Talk to the store”, we ask for your email and a short message, email them to the store (Reply-To: you), and keep them only in the chat transcript (13 months / 390 days).

Ratings and chat analytics

After a conversation, the chat may ask the shopper to rate it from 1 to 5 stars and add an optional comment (up to 500 characters). We store the rating and comment with the conversation, mask payment card numbers in the comment as in chat messages, and use them to measure and improve answer quality. The comment is deleted with the chat transcript after 13 months (390 days); the star rating stays, without the comment, in the conversation's statistics.

When the shopper has allowed analytics under Shopify's Customer Privacy API, or no consent is required in their region, the app also records that the chat was opened (at most once per chat session every 30 minutes, without any message content) as a pixel event kept for 90 days.

What we keep

From paid-order, refund, and cancellation notices we keep only order id, line items used to match a chat, currency, financial status, timestamps, refund line items, shipping country, and a salted hash of the Shopify customer id. We do not store customer name, email, phone, or full address from orders.

Retention: chat transcripts 13 months (390 days); pixel events 90 days; conversation summaries 36 months. Our search index (Qdrant) runs on our own Google Cloud servers. Exchange-rate services receive no personal data.

Processing location and transfers

Data is processed in the United States (Google Cloud, us-central1). Transfers from the EU/EEA rely on the EU Standard Contractual Clauses; UK transfers on the UK Addendum.

Sub-processors

• Google Cloud — hosting and database (us-central1).
• Google Gemini via the Pivony commerce API, on Vertex AI in us-central1.
• Resend — merchant notices and shopper-requested “Talk to the store” emails.

Governing law and disputes

For merchants, governing law and disputes are as set out in Sections 19 and 20 of the Terms of Service. Nothing in this policy limits any right you have under applicable data protection law, including the right to lodge a complaint with a supervisory authority.