Privacy Policy

1. Introduction

Zellio AI ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered customer support platform.

2. Information We Collect

2.1 Merchant Information

When you connect our app to your Shopify store, we collect:

• Store domain and basic store information
• Email address and account credentials
• Workspace and user management data

2.2 Protected Customer Data

To provide customer support services, we process "Protected Customer Data" as defined by Shopify's API Terms. This includes:

• Contact Information: Email addresses, phone numbers, and names used to identify customers and send support responses.
• Order Information: Order history, billing/shipping addresses, and order status details required to provide context-aware support.
• Customer IDs: Unique identifiers to link conversations across multiple channels.

We only request the minimum data necessary to provide our services and do not access data unrelated to customer support functions.

2.3 Conversation Data

• Messages exchanged between customers and AI agents
• Conversation metadata (timestamps, channel, status)
• AI-generated responses and suggestions

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Customer Service

• Respond to customer inquiries via multiple channels (email, WhatsApp, SMS, live chat)
• Provide context-aware support based on order history
• Handle returns, refunds, and product questions
• Process warranty claims and follow-up requests

3.2 App Functionality

• Authenticate and identify customers across support channels
• Route messages to appropriate AI agents
• Maintain unified conversation history
• Generate AI-powered responses

3.3 Marketing and Communication

• Send order updates and automated support messages
• Deliver cart abandonment recovery messages (with merchant configuration)
• Send notifications about support ticket status

3.4 Personalization

• Address customers by name in AI-generated responses
• Provide personalized product recommendations based on order history
• Tailor support responses to customer preferences

4. Data Protection and Security

4.1 Encryption

• Data at rest: All sensitive data including access tokens and customer information is encrypted using AES-256-GCM encryption
• Data in transit: All data transmission uses HTTPS/TLS 1.3
• Database backups: Encrypted with the same security standards

4.2 Access Controls

• Role-based access control (Owner, Admin, Agent) limits data access
• Workspace-scoped data isolation ensures data segregation
• Strong password requirements (minimum 8 characters)
• Multi-factor authentication available for user accounts

4.3 Infrastructure Security

• Hosted on secure cloud infrastructure (Railway/AWS)
• Separate test and production environments
• Regular security updates and patches
• Database hosted on managed PostgreSQL with automated backups

4.4 Sensitive Data Prohibition

We strictly prohibit the collection or sharing of sensitive personal data with Meta Platforms, Inc. or other third parties. This includes:

• Health, medical, or genetic data
• Financial account numbers (credit cards, bank accounts)
• Government-issued identification numbers (SSN, passport numbers)
• Biometric data
• Data known to be from children under 13

5. Data Retention

We retain personal data only for as long as necessary to provide our services:

• Active workspaces Data retained while workspace is active
• Deleted workspaces All customer data permanently deleted within 30 days of workspace deletion
• Shopify Data Deletion Notwithstanding the above, we strictly adhere to Shopify's data deletion requirements. If a merchant uninstalls our app or requests data erasure, all associated Protected Customer Data is permanently deleted within 48 hours of receiving the webhook request.
• Conversation history Retained for support quality and merchant reference unless deletion is requested
• Legal obligations Some data may be retained longer to comply with legal requirements

6. Data Sharing and Disclosure

We do not sell your personal information. We may share data in the following limited circumstances:

6.1 Service Providers

• Cloud hosting providers (Railway, AWS)
• AI model providers (OpenAI) for generating support responses
• Meta Platforms, Inc. We share data with Meta solely for the purpose of enabling messaging functionality (WhatsApp Business API) and do not share data for their own advertising purposes.
• Communication platforms (Twilio)

6.2 Legal Requirements

We may disclose information when required by law, court order, or to protect our rights.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, customer data may be transferred to the acquiring entity.

Google API Services and Limited Use

Zellio integrates with Google APIs (Gmail) to send email on behalf of merchants who connect their Gmail or Google Workspace account. This section describes our compliance with Google's developer policies for that integration.

Limited Use compliance

Zellio AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

OAuth scopes we request

We request only the minimum scopes needed for outbound email functionality. Restricted Gmail scopes (gmail.readonly, gmail.modify, gmail.metadata, https://mail.google.com/) are deliberately NOT requested.

• https://www.googleapis.com/auth/gmail.send — Send email on the merchant's behalf. We never read, modify, label, or trash messages in the mailbox.
• https://www.googleapis.com/auth/userinfo.email — Resolve the connected Google account's primary email address so the merchant can confirm they connected the right mailbox. We do not access profile, name, picture, or any other field.

How we use this data

• Send outbound email campaigns and conversation replies authored by the merchant or their AI agents within Zellio.
• Display the connected mailbox address in the merchant's settings page so they can identify which account is connected.
• Refresh OAuth tokens to keep the connection alive without re-prompting the merchant.

What we never do

• We never read, list, search, or download messages from the merchant's mailbox.
• We never transfer Google API data to third parties except as needed to provide or improve the Send Email feature, to comply with applicable law, or as part of a merger or acquisition.
• We never use Google API data for advertising or to serve ads.
• We never use Google API data to develop, improve, or train generalized AI/ML models.
• We do not allow humans to read Google API data, except (a) with the merchant's explicit consent, (b) for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data is aggregated and anonymized for internal operations such as billing or capacity planning.

Revoking access

Merchants can revoke Zellio's access to their Google account at any time via the Disconnect button in Zellio's email channel settings (Settings → Channels → Email), or via Google Account → Security → Third-party apps with account access at https://myaccount.google.com/permissions. Revocation is immediate; we automatically mark the channel as inactive on the next token refresh attempt and stop using any cached credentials.

7. Customer Rights

End customers have the following rights regarding their personal data:

• Access Request a copy of their personal data
• Correction Request correction of inaccurate data
• Deletion Request deletion of their personal data
• Opt-out Opt-out of marketing communications
• Data portability Receive their data in a portable format

To exercise these rights, customers should contact the merchant directly, or email us at

8. Cookies and Tracking

We use essential cookies for authentication and session management. We do not use tracking cookies or third-party analytics that collect personal information.

9. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers, including encryption and contractual protections.

10. Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify merchants of material changes via email or through the app dashboard. Continued use of our service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

13. GDPR Compliance (EU Users)

For users in the European Union, we comply with GDPR requirements:

• Legal basis Legitimate interest (customer support) and contractual necessity
• Data Controller vs. Processor The Merchant is the Data Controller of their customers' data. Zellio AI acts strictly as a Data Processor, processing data only on documented instructions from the Merchant.
• Data Protection Officer Contact privacy@zellio.ai
• EU representative Available upon request

14. CCPA Compliance (California Users)

For California residents:

• We do not sell personal information
• You have the right to opt-out of data sales (not applicable)
• You have the right to know what data we collect and how it's used
• You have the right to request deletion of your data