Privacy Policy

What this policy covers

ZeroDesk is a Shopify post-purchase operations application. This policy explains how we process merchant account information, Shopify order and fulfillment data, customer contact and shipping details, support messages, audit records, and service usage data.

Why we process data

• Authenticate merchants and operate the embedded Shopify application.
• Match support requests to orders and report verifiable fulfillment facts.
• Verify identity and execute authorized pre-fulfillment address changes.
• Provide human handoff, audit trails, security controls, and support.
• Measure verified resolutions and maintain subscription entitlements.

AI processing

Customer free-text messages may be sent to the OpenAI Responses API solely for language detection, intent classification, field extraction, and faithful translation of deterministic customer messages. Requests use store: false. OpenAI does not decide eligibility, approve actions, or create operational facts. If the service is unavailable, ZeroDesk hands the conversation to a person.

Retention and deletion

By default, cases and protected-data access logs are retained for 365 days, widget conversations and CSAT for 180 days, Observe runs for 90 days, and privacy-request exports for 30 days. Merchants can configure shorter periods. Uninstall and Shopify deletion webhooks remove the relevant shop or customer data.

Security

ZeroDesk uses encrypted transport, encrypted backups, tenant-scoped database access, Shopify session-token authentication, role-based permissions, access logging, hashed session tokens, and peppered OTP hashes. No customer data is included in Shopify usage billing events.

Your rights and Shopify privacy requests

ZeroDesk supports Shopify's mandatory customer data request, customer redaction, and shop redaction webhooks. Merchants and customers may contact us to request access, correction, deletion, or further information, subject to applicable law and the merchant's instructions.