Privacy Policy

1. Overview & Scope

This Privacy Policy explains how MentorCart ("we", "our", or "us"), available at https://mentorcart.app, collects, uses, stores, and protects personal information when merchants install and use our Shopify application, and when store visitors interact with the MentorCart storefront widget.

In the context of the European Union General Data Protection Regulation (GDPR) and similar data protection laws:

• The Merchant is the Data Controller regarding their store customer data and customer communications.
• MentorCart acts as the Data Processor, processing store visitor messages and catalog data solely on behalf of the Merchant and in accordance with their instructions.

2. Information We Collect

We adhere to the principle of data minimization and only collect data essential for the operation of the AI sales assistant:

A. Information Collected from Merchants

• Shopify Store Details: Store myshopify domain (e.g. example.myshopify.com), primary email address, store name, default currency, and timezone.
• App Configuration: Chat widget preferences, custom greeting messages, AI tone/persona settings, business hours, and Telegram notification bot tokens/chat IDs for human handoff.
• OAuth Access Tokens: Scoped Shopify API access tokens required to sync store catalog (write_products, read_inventory).

B. Information Collected from Store Customers & Visitors

• Chat Conversations: Messages, product inquiries, and questions submitted by the visitor within the MentorCart storefront chat widget.
• Session Identifiers: Ephemeral browser session IDs used strictly to maintain continuity of the live chat session.
• Technical Context: Masked IP address, browser user-agent, device type, and referring page URL to optimize widget rendering and prevent spam abuse.

C. Storefront Catalog & Product Information

• Product titles, descriptions, categories, variant options (sizes, colors), pricing, and real-time inventory availability levels fetched via Shopify REST and GraphQL APIs.

3. How We Use Information

We process the information collected strictly for the following purposes:

• Providing AI Conversational Assistance: Answering product questions, advising on sizing or specifications, and recommending items matching the visitor's request.
• Inventory Verification: Checking real-time stock levels so the assistant never recommends sold-out items.
• Human Support Handoff: Forwarding conversation context to the merchant via Telegram or Shopify Admin when requested by the customer or triggered by handoff rules.
• Merchant Analytics & Quality Control: Enabling merchants to review chat transcripts, discover common shopper queries, and optimize store catalog descriptions.
• Security & Abuse Prevention: Detecting anomalous automated traffic and preventing denial-of-service attempts.

4. AI Processing & Third-Party Sub-processors

MentorCart utilizes state-of-the-art Large Language Model (LLM) APIs to generate contextual answers:

5. Shopify Mandatory GDPR Webhooks

In strict compliance with Shopify App Store requirements, MentorCart has implemented and continuously verifies the following three mandatory compliance webhooks at /webhooks/compliance:

1. customers/data_request

When a customer requests their stored data via Shopify, Shopify sends a webhook to MentorCart. Within the required SLA, our automated compliance engine queries all chat interactions associated with the customer, packages them in a secure AES-256-GCM encrypted archive, and delivers the data to the designated destination.

2. customers/redact

When a customer requests deletion of their personal data, Shopify notifies MentorCart via this webhook. Upon receipt, all chat transcripts, personal identifiers, and session logs linked to that customer are permanently redacted or irreversibly anonymized within 48 hours.

3. shop/redact

When a merchant uninstalls MentorCart, or after 48 hours following app deletion, Shopify triggers the shop/redact webhook. MentorCart executes an automated purging routine that permanently deletes all stored shop tokens, configuration records, product cache entries, and historic conversation logs from our production database.

6. Data Retention & Deletion Policy

• Active Merchant Stores: Chat transcripts and app configurations are retained as long as the merchant maintains an active installation of MentorCart, enabling historical review and quality analytics.
• Uninstalled Stores: Upon receipt of the app/uninstalled webhook and shop/redact compliance webhook, merchant data is queued for automatic deletion and permanently expunged within 48 hours.
• Customer Redaction Requests: Executed automatically within 48 hours of webhook arrival.
• Temporary Session Cookies / LocalStorage: Automatically expire upon browser closure or within 24 hours of inactivity.

7. Data Security & Technical Safeguards

We implement robust technical and organizational security controls:

• Encryption in Transit: All data transmitted between browsers, Shopify APIs, and our servers is encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
• Encryption at Rest: All sensitive database records, access tokens, and webhook logs are encrypted with AES-256 standards.
• Shopify HMAC Verification: Every incoming webhook and request from Shopify is validated with cryptographic HMAC-SHA256 signature verification to prevent spoofing.
• Access Controls: Production databases are protected by multi-factor authentication, network firewalls, and least-privilege administrative access.

8. Merchant & Customer Rights (GDPR & CCPA)

Under applicable privacy frameworks, merchants and store visitors possess the following rights:

• Right to Access: Request a copy of the personal data held about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request permanent deletion of personal data.
• Right to Restrict Processing: Request suspension of specific processing activities.
• Right to Data Portability: Receive personal data in a structured, machine-readable format.
• Right to Non-Discrimination: We do not discriminate against users who exercise their privacy rights under CCPA/CPRA.

Store visitors who wish to exercise these rights should primarily contact the merchant (Data Controller) through whom they made purchases or chatted. Merchants may contact us directly at support@mentorcart.app.

9. International Data Transfers

MentorCart processes data using global cloud infrastructure located primarily in the United States and the European Union. Where data is transferred internationally, we ensure adequate protections are in place in compliance with Chapter V of the GDPR, including Standard Contractual Clauses (SCCs).

10. Contact Information & Data Protection Officer

If you have questions, feedback, or requests regarding this Privacy Policy or our compliance practices, please reach out to our privacy and support team: