Last updated: 13 October 2026
SellCraft ("the App") adds an AI shopping assistant to a Shopify store. Shoppers can ask it about products, store policies and the status of their orders, and ask it to add products to their cart. This policy explains what data the App accesses, why, and how it is protected. The merchant is the controller of their shoppers' data; SellCraft processes it on the merchant's behalf.
Product information (titles, descriptions, prices, variants, availability and images) and the store's published legal policies (refund, shipping, privacy, terms).
Order status, only if the merchant's plan includes order tracking and the merchant has granted the App access to orders. When a shopper asks about an order, the App looks up orders from the last 60 days: a logged-in shopper's own orders (matched by their Shopify customer ID), or, for a guest, the single order matching both the order number and the email address they used at checkout. The App reads the order number, date, payment and fulfillment status, item names and quantities, carrier and tracking details, and the order status page link. The order's email address is read only to compare it with the one the shopper gave; it is never shown to the AI model or anyone else. The App does not read customers' names, addresses or phone numbers, does not access payment details, and cannot change, cancel or refund orders.
The messages a shopper types into the assistant, the page they were on, and a random identifier stored in their browser so a conversation can continue across pages. If the merchant turns on the optional contact form, the shopper is also asked for the details the merchant chose (name, email address and/or phone number) before the chat starts. An email address a shopper types only to verify an order lookup is removed from the stored conversation right after the lookup. Shoppers should not share payment details in the chat.
To provide the assistant, and for no other purpose. Messages are sent to our AI provider to generate replies, together with relevant product, policy and order status information. Conversations are stored so the merchant can review them in the App and see aggregate statistics such as popular searches. Contact details from the contact form are shown to the merchant with the conversation and can be exported by the merchant. We never sell or share personal data for advertising, and we don't use it for profiling or automated decisions with legal or similar effects.
Anthropic (AI model provider; does not use the App's data to train its models) and Fly.io (application hosting and database). Both process data under data processing agreements.
Data is encrypted in transit (HTTPS/TLS) and at rest, including backups. Access to production data is limited to the developer's own accounts, protected by strong passwords and two-factor authentication. Each order lookup is recorded in an access log that contains no personal data. Development and testing use separate development stores, never production data.
Conversations, search statistics and order access logs are deleted automatically 12 months after they were created. Order data is not stored by the App beyond the conversation in which it was shown. When a merchant uninstalls the App, all data stored for that store is deleted within 48 hours of Shopify's shop deletion request. When a customer asks the merchant to erase their data, every conversation containing their email address or phone number is deleted.
For questions about this policy or your data, contact the developer through the App's Shopify App Store listing.