Skip to content
Menu

Popular

Compliance & Data Protection

This page summarizes the technical and operational controls that protect the data Simple Chat processes, and how they support merchants' obligations under data protection laws such as the GDPR, PIPEDA, and the CCPA. For our full legal disclosures, see our Privacy Policy. For the data processing terms between merchants and us, see section 5 of our Terms and Conditions.

1 - Infrastructure

  • Shopify APIs and webhooks for app operations and Shopify's privacy request workflows.
  • Amazon Web Services (United States, region us-east-1) for the database, file storage, queues, and email.
  • Heroku for the application servers.
  • OpenAI, Anthropic, and TypeSafe for AI models, Tinify for image compression, and Mezmo for logs.
  • Slack, Notion, and ShipHero, only when a merchant connects them.

Our Privacy Policy lists every subprocessor and what it receives.

2 - Encryption

Encryption in Transit

Traffic to and from Simple Chat services uses TLS 1.2 or later.

Encryption at Rest

Our database (Amazon RDS), file storage (Amazon S3), and queues (Amazon SQS) are encrypted with keys managed by AWS. Our backups are encrypted as well.

3 - Access Controls

Only authorized personnel can access production data, through an internal admin dashboard and a database tool that both require AWS Cognito sign-in with a strong password policy. We log every admin dashboard request and every database query made through that tool, with the identity of the person who made it. Access ends when a person leaves the company. Production and test data are kept in separate database clusters with separate credentials.

4 - AI Assistant Connections

Connections to ChatGPT or Claude use OAuth. We store authorization codes and refresh tokens only in hashed form, and we do not store access tokens, which are short-lived. A connection acts only as the staff member who authorized it, and staff can revoke it at any time.

5 - Data Minimization

We process the data required for support conversations, app features, and security and compliance operations. Simple Chat reads order details from Shopify when it answers and does not keep copies of orders. On merchant stores, the chat keeps and sends attribution data only with the customer's marketing consent.

6 - GDPR and Shopify Privacy Requests

  • customers/data_request: we email the merchant the customer's stored data as JSON files.
  • customers/redact: we erase the customer's conversations, contact details, notes, back-in-stock subscriptions, inbox filters, and attachments, matching the customer by Shopify customer ID and by email address.
  • shop/redact (48 hours after an uninstall): we erase the same data for every customer of the store and delete the store's integration credentials.

Merchants remain the primary point of contact for their customers' privacy requests.

7 - Retention and Backups

  • Automated database snapshots: 7 days.
  • Database backups and application logs in our storage: deleted automatically after 730 days.
  • Application logs at Mezmo: 14 days. Our internal log database: 6 months.
  • Store settings, merchant account information, and staff profiles: kept after a shop redaction request, so that a reinstall works as before; no automatic expiry yet.
  • Copies of inbound support emails as received: redaction requests do not reach them; deleted automatically 30 days after they arrive.
  • Original files of attached images: normally deleted shortly after their compressed copy replaces them. If the compression fails, the conversation keeps the original file, and redaction requests delete it with the conversation.
  • Original image files that no conversation uses (files received up to October 16, 2026, files whose deletion failed, and uploads that were never sent): redaction requests do not reach them, and no automatic expiry applies to them yet.
  • GitHub copies of staff issue reports and Simple Chat's follow-up comments on GitHub issues: customer and shop redaction requests replace their staff text and staff name. Comments and summaries that our engineers and their AI coding tools write on an issue stay. GitHub keeps the earlier versions in the edit history and the timeline of the issue, and the GitHub API has no method that deletes them.

8 - Incident Response

We maintain internal incident response procedures to detect, assess, contain, and remediate security events, and to review them afterwards. When a breach affects a merchant's data, we notify the merchant without undue delay.

9 - Contact

For compliance or security questions, contact support@simple-chat.com. If needed, include your store domain and relevant request context so we can route the inquiry quickly.

Last updated: October 17, 2026