Draft for review. This text is not final and is not yet in effect.
Privacy policy
Last updated: 21 October 2026
Velix Chat is a Shopify app that adds an AI chat assistant to a merchant's online store. This policy explains what information the app handles, why, where it is kept and for how long. Velix Chat is operated by Israr Ul Haq, trading as Velix Apps, Mardan, Pakistan ("Velix Chat", "we", "us").
Who is responsible for what
- Shoppers' information (people who chat on a merchant's store): the merchant decides to use Velix Chat and is responsible for it. We process it on the merchant's behalf and only to run the app.
- Merchants' information (store and account details): we are responsible for it.
Information from shoppers
What the chat collects
- The messages a shopper sends and the replies they receive (from the assistant or the store's team), and any image they attach.
- Details the shopper chooses to give: name, email, phone number or another answer the store asks for in the chat form.
- An order number and email when the shopper asks to check an order.
- Approximate location (city, region, country, time zone) worked out from the IP address with a local database. The IP address itself is not stored with the conversation. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
- If a signed-in Shopify customer uses the chat, their customer ID, and a customer-account access token (stored encrypted) when they connect their account for order questions.
- Feedback (thumbs up or down) on replies, and whether the chat led to a cart or checkout.
Card numbers typed into the chat are masked (only the last four digits are kept) before the message is saved or sent to the assistant. Shoppers should not share passwords or payment details in the chat.
Cookies and browser storage on the store
| Name | Purpose | Kept for |
|---|---|---|
| shopAiVisitorId (cookie) | A random ID so a returning shopper sees their own conversation on the same browser. | Up to 400 days |
| shopAiGreetingDismissedAt (cookie) | Remembers that the shopper closed the greeting, so it isn't shown again right away. | 7 days |
| Session and local storage | The open conversation, whether the chat was open, the chat language and temporary limits. | Until the tab is closed, or until the stored time passes |
Abuse protection
To stop spam and abuse we count chat activity per visitor and per IP address (for example, how many AI replies or new chats in a period). These counters include the IP address and are deleted after 32 days.
Information from merchants
- Store details from Shopify: store name, domains, contact email, and the staff member's name and email when they use the app.
- Shopify access tokens for the store (stored encrypted), used only to run the app.
- Store content the assistant answers from: products, collections, pages, blog posts, policies, shipping settings, discount names and files you add as knowledge.
- Orders, when a shopper asks about their order or when we attribute a sale to a chat.
- Settings you choose in the app, notification email addresses, browser push subscriptions for your staff, and API keys for tools you connect (stored encrypted).
- Usage records: number of AI replies and AI token usage per store (kept 90 days), for billing and limits.
How information is used
- To answer shoppers in the chat and show products, carts and order status.
- To let the store's team read and reply to conversations in the app, and to notify them.
- To apply plan limits, prevent abuse and keep the service secure.
- To provide support and fix problems.
We do not sell personal information and we do not use it for advertising.
AI processing
Chat replies are written by an AI model from Anthropic. To generate a reply, Anthropic processes the conversation, details the shopper gave in the chat, and the store content needed to answer, under its commercial API terms. Anthropic does not train its models on this data and keeps API logs only for a short period.
Service providers
| Provider | What it does | Location |
|---|---|---|
| Fly.io | Hosting, the app database and its daily snapshots. | Singapore |
| Anthropic | The AI model that writes the assistant's replies (see "AI processing"). | United States |
| Resend | Sends emails from the app to the store's team (new chats, requests for a person, reports). These can include the shopper's name, email and latest message. | United States |
| Shopify | The platform the app runs on: store data, orders, uploaded files and billing. | Shopify's own locations |
| Browser push services | Deliver browser notifications that the store's staff turned on (run by the staff member's browser vendor). | Browser vendor's locations |
| Klaviyo, Gorgias, Zendesk | Only when the merchant connects them: chat events (Klaviyo) or a support ticket when a shopper asks for a person (Gorgias, Zendesk), with the shopper's name, email, phone and, for tickets, the conversation. | The provider's locations |
Where information is kept, and backups
The app and its database run on Fly.io in Singapore. The database volume is encrypted, and Fly.io takes a daily snapshot of it that is kept for 14 days. Data deleted from the app can remain in these backups until they expire, and is not restored from them except to recover from a failure.
International transfers
Information is stored in Singapore and processed by Anthropic and Resend in the United States, and by the other providers above in their own locations. We share only what each provider needs for its task.
How long information is kept
- Conversations: on the Free plan, 90 days after the last message; on paid plans, while the app is installed. [Daily deletion job is built; it deletes once switched on after the dry-run check.]
- Abuse-protection counters: 32 days. AI usage records: 90 days. Backups: 14 days.
- After a merchant uninstalls the app, Shopify asks us to delete the store's data 48 hours later, and we delete all of the store's conversations, settings and records.
- When a shopper asks a store to delete their data through Shopify, Shopify tells us and we delete that shopper's conversations.
Security
Data is sent over HTTPS. Access tokens, customer-account tokens and connected-tool API keys are stored encrypted, and the database volume is encrypted. Each store can only see its own data.
Your rights
You keep the privacy rights given to you by the law where you live, for example under the GDPR in the EU and UK or the CCPA in California. These can include the right to access, correct or delete your information, and to object to or limit its use. We do not sell or share personal information for advertising.
- Shoppers: you can ask the store you chatted with, or email us at support@velixchat.ai with the store's name and the email or details you used in the chat. We will act on your request with the store and reply within 30 days.
- Merchants: email support@velixchat.ai. You can also export your conversations from the app, and uninstalling the app deletes your store's data as described above.
You can also complain to your local data protection authority.
Children
Velix Chat is a business tool and is not directed at children.
Changes
We will update this page when the app's data handling changes and change the date at the top.
Contact
Israr Ul Haq, trading as Velix Apps, Mardan, Pakistan. Email support@velixchat.ai.