Last Updated: 10 July 2026

1. Introduction

This Privacy Policy explains how Envolve Technology Ltd (“Envolve”, “we”, “our”, or “us”) collects, uses, stores and processes information when merchants install and use the Envolve Shopify App (the App) and when customers interact with chatbots deployed by merchants using the App.
This Privacy Policy is intended to satisfy the requirements of the Shopify Partner Program and applicable privacy legislation, including the UK General Data Protection Regulation (“UK GDPR”), the EU General Data Protection Regulation (“EU GDPR”), and other applicable privacy laws.

2. About Us

Envolve Technology Ltd provides AI-powered conversational software for ecommerce businesses.
For privacy enquiries, contact:

Email: privacy@envolvetech.com

3. Information We Collect

Merchant Information

When a merchant installs or uses the App, we collect information including:

• Shopify Shop ID
• Shopify shop domain
• Shop name
• Merchant email address
• Website URL
• Affiliate information (where provided)
• App installation status
• Theme App Embed status
• Merchant onboarding responses
• Operational event logs
• Browser and device information, including device type and user agent
• Diagnostic information

This information is required to provide and support the App.

Customer Information

The chatbot does not require customers to provide personal information.

However, customers may voluntarily submit personal information during conversations, including but not limited to:

• Names
• Email addresses
• Telephone numbers
• Addresses
• Order numbers
• Free-form text containing personal information

We process only the information provided by customers in order to generate chatbot responses and provide requested assistance.

Automatically Collected Information

When customers interact with the chatbot, we automatically collect technical information including:

• IP address
• Approximate geographic location derived from IP address
• Browser information
• Operating system
• Device type
• Session identifiers
• Timestamps
• Diagnostic information
• Application performance metrics
• Security and audit logs

4. How We Use Information

We use information to:

• Provide chatbot functionality
• Authenticate merchants
• Configure chatbot deployments
• Activate and deactivate services
• Monitor service health
• Investigate technical issues
• Improve system performance
• Detect abuse
• Maintain security
• Comply with legal obligations

We do not sell personal information.

5. AI Processing

Customer messages are processed using Google’s Gemini large language models to generate chatbot responses.

Personal information voluntarily included in customer conversations may therefore be processed by Google as part of providing AI services.

Merchants should ensure they have appropriate legal grounds for processing customer information through AI services.

Google’s handling of data submitted to Gemini is governed by Google’s applicable terms and privacy commitments.

6. Data Storage

Merchant configuration data, chatbot event data, chat conversations, and application databases are primarily stored within Google Cloud Platform in the Europe West 2 (London) region.

Certain operational and application logs are processed and stored using Google Cloud Logging, which operates using globally managed logging infrastructure.

Operational backups, disaster recovery copies, and certain cloud platform services may also store or process information in additional locations where required to provide resilience, availability, security, and service continuity.

7. International Transfers

Some information may be processed or stored outside the United Kingdom or European Economic Area, including through globally managed cloud infrastructure and service providers.

Where international transfers occur, we rely on appropriate safeguards required by applicable law, including contractual safeguards where applicable.

8. Subprocessors

We use trusted third-party service providers to operate the App, including:

• Shopify
• Google Cloud Platform
• Google Gemini AI services
• Infrastructure monitoring providers
• Professional advisers where required

These providers process information only as necessary to provide their respective services.

9. Cookies and Local Storage

The chatbot and App may use cookies, browser storage or similar technologies for purposes including:

• Maintaining sessions
• Security
• Abuse prevention
• Application functionality
• Analytics
• Performance monitoring

Merchants remain responsible for obtaining any consent required under applicable laws for technologies deployed on their storefront.

10. Data Retention

We retain personal information only for as long as necessary to:

• Provide and operate the App
• Maintain the security and integrity of our services
• Investigate incidents and prevent abuse
• Comply with legal and regulatory obligations
• Resolve disputes
• Enforce our agreements
• Support legitimate business and operational purposes

Our typical retention periods are:

Merchant account information
Up to 8 years after account deletion, subject to applicable legal obligations

Chat conversations
Up to 8 years, unless deleted or redacted earlier in accordance with applicable law

Chatbot event data
Up to 8 years

Application backup data
Up to 8 years

Operational and security logs
In accordance with our operational logging retention policies

Operational and security logs are retained for shorter periods than application data and are used to maintain the security, reliability, performance, and integrity of our services.

Some operational logs are processed using globally managed cloud logging infrastructure and are retained in accordance with our operational logging retention policies.

In some circumstances, information may be retained for longer where required or permitted by applicable law, regulatory requirements, ongoing legal proceedings, legal holds, or other legitimate business purposes.

We periodically review our data retention practices and may reduce these retention periods where appropriate.

11. Security

We implement technical and organisational measures designed to protect personal information, including:

• Encrypted communications (HTTPS/TLS)
• Authentication and access controls
• Audit logging
• Cloud security controls
• Least privilege access
• Monitoring and alerting
• Regular software updates

No internet-connected service can guarantee absolute security.

12. Security Incidents

If we become aware of a security incident affecting personal information, we will investigate the incident and notify affected parties where required by applicable law.

13. Merchant Responsibilities

Merchants are responsible for:

• Ensuring they have lawful authority to use the App
• Providing appropriate privacy notices to customers
• Obtaining any legally required consents
  ensuring customer data submitted through the chatbot complies with applicable laws
• Responding to customer privacy requests relating to their own customers

14. Data Processing Roles

For merchant account information, Envolve generally acts as an independent controller.

For customer information submitted through the chatbot, merchants generally act as the data controller and Envolve generally acts as a data processor providing chatbot services on the merchant’s behalf.

Where required, Envolve will make an appropriate Data Processing Agreement (“DPA”) available to merchants.

15. Your Rights

Where applicable, individuals may have rights to:

• Access their information
• Request correction
• Request deletion
• Object to processing
• Restrict processing
• Request data portability
• Lodge complaints with an appropriate supervisory authority

Privacy requests should be sent to:

privacy@envolvetech.com

16. Uninstalling the App

Merchants may uninstall the App at any time using Shopify.

Following uninstallation:

• chatbot functionality will be disabled;
  merchant configuration will no longer be actively used;
• certain operational and audit records may be retained where required for legal, security or compliance purposes.
• Merchants may separately request deletion of retained information where applicable.

17. Shopify

The App receives information from Shopify necessary to provide its functionality.
Shopify independently processes personal information in accordance with its own Privacy Policy.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Material changes will be communicated through the App where appropriate.

The “Last Updated” date at the top of this document indicates when this Privacy Policy was most recently revised.