Privacy Policy

This Privacy Policy explains how SA Inc. ("Simple Chat", "we", "us", "our") collects, uses, and discloses personal information when you use the Simple Chat app, the storefront chat on stores that use it, simple-chat.com, and our support services (together, the "Services").

If you have questions about this Privacy Policy, email support@simple-chat.com or write to SA Inc., 511 Lacolle Way, 5-1073, Ottawa ON K4A 5B6, Canada.

1 - Scope and Roles

We act as a controller for the account and business information of merchants, for the merchant staff who use Simple Chat, and for visitors to simple-chat.com.

We act as a processor (service provider) for the personal information of a merchant's customers that we process when the merchant uses Simple Chat. The merchant decides why and how that information is processed, and section 5 of our Terms and Conditions sets out the data processing terms that apply to it.

If you are a customer of a store that uses Simple Chat, the store is responsible for your personal information and for responding to your privacy requests. Please contact the store first.

2 - Personal Information We Process

Merchant account information: the store's domain, name, and Shopify ID, the shop owner's name and email address, the plan and billing details that Shopify provides, the store's Simple Chat settings, and the campaign values and ad click identifiers of the visit that led to the install.
Merchant staff: the Shopify user ID, name, profile image, and email signature of each staff member who uses Simple Chat, when they were last active, and their Slack user when the merchant connects Slack.
Customer conversations: the chat messages and emails that a customer sends and receives, the images and files they attach, and the contact details they give us or that Shopify returns for a logged-in customer (Shopify customer ID, name, email address, and phone number). To answer, Simple Chat reads order details from Shopify, such as order contents, status, shipping address, and tracking. We do not keep copies of orders.
Customer notes: short notes about a customer that the merchant's staff or the assistant keep for later conversations.
Back-in-stock notifications: the email address of each customer who subscribes, the emails we send them, their delivery results, and the orders that followed them.
Storefront chat: a random chat ID stored in the customer's browser and added to the cart. Only with the customer's marketing consent on the store, also the ID of a tracked link from the store's emails or chat messages, and the pages where links from chats land. See our Cookie Policy.
Inbox settings and reports: email addresses the merchant filters from the inbox, and the misshipment notes and issue reports that staff file, which can quote a conversation.
AI assistant connections: records of the connections that a merchant's staff member authorizes: the store, the staff member, the assistant, and when it was connected or revoked.
Technical data: IP address, browser and device details, request logs, and service diagnostics.
Website visitors: the pages you view on simple-chat.com, the ad that brought you there, and whether you clicked to install Simple Chat, as described in our Cookie Policy.

3 - How We Use Personal Information

We use personal information to:

Provide the Services: show conversations to the merchant's staff, write and send replies, and send emails on the merchant's behalf, such as replies, chat transcripts, and back-in-stock notifications.
Generate the assistant's replies and drafts, classify customer messages (for example, by topic or as spam), and check the quality of replies, using AI models.
Show merchants reports on their support and on the sales that followed their emails and chats, including in the store's Shopify marketing reports.
Operate billing, accounts, support, and compliance processes, and investigate the problems that merchants report.
Measure the use of the Simple Chat app and the results of our own advertising.
Investigate abuse, prevent fraud, keep the Services secure, and meet legal obligations.
Improve the reliability and quality of the Services.

We do not sell personal information, and we do not use the conversations of a merchant's customers to train AI models.

4 - Legal Bases

Where applicable law requires a legal basis, we rely on one or more of:

Performance of a contract (for example, delivering the Services to merchants).
Legitimate interests (for example, security, abuse prevention, service improvement, and measuring our advertising).
Legal obligations (for example, tax, accounting, and regulatory compliance).
Consent, where required by law (for example, for cookies that are not essential).

For the personal information of a merchant's customers, the merchant determines the legal basis.

5 - Service Providers and Subprocessors

We share personal information with these service providers, only as needed for the purposes above:

Shopify, for platform APIs, authentication, billing, privacy request webhooks, and the store's analytics.
Amazon Web Services, for our database, file storage, queues, and sending and receiving email.
Heroku (Salesforce), which runs our application servers.
Anthropic (Claude models) and OpenAI (GPT models), whose AI models write the assistant's replies and drafts and run other AI tasks, such as spam checks of inbound email.
TypeSafe, whose AI models classify customer requests, select the store information for a reply, and check the quality of replies.
Tinify, which compresses the images attached to conversations.
Mezmo, which stores our application logs for 14 days.
GitHub, where we keep the issue reports that merchant staff file. Our engineers, and the AI coding tools they use (from Anthropic, OpenAI, and Cursor), read these reports to fix the problem.
Shipping carriers, such as DHL eCommerce, which receive a tracking number and return its delivery status.
Google Analytics, which measures how merchant staff use the Simple Chat app, with the store's ID and domain, and visits to simple-chat.com.
Google Ads and OpenAI Ads, which measure our advertising. When a store installs Simple Chat, we send them the store's ID, a hashed (SHA-256) copy of the store's email address, and, when the install came from one of their ads, its ad click identifier. OpenAI Ads also measures visits to simple-chat.com.

When a merchant connects Slack or Notion, we send conversation details to the merchant's own Slack workspace or Notion database. When a merchant connects ShipHero, Simple Chat sends an order number or the customer's email address to the merchant's ShipHero account to find the customer's orders. It reads their email address, shipping address, phone number, items, shipments, tracking numbers, and status, and it can change the recipient name, shipping address, and phone number of an order there.

When a merchant's staff member connects an AI assistant, we also share personal information with that assistant's provider, as described under AI Assistant Connectors below: OpenAI, when a staff member connects ChatGPT, and Anthropic, when a staff member connects Claude.

We update this list before a new subprocessor processes the personal information of a merchant's customers.

AI Assistant Connectors (ChatGPT and Claude)

A merchant's staff member can connect their Simple Chat account to an AI assistant, such as ChatGPT or Claude. They approve the connection in their Shopify admin, signed in as themselves, for one store. The connection then acts only as that staff member, for that store.

When the staff member asks the assistant, the connector returns data that staff member can already see in Simple Chat, only to answer that request. It can return support conversation message text and the customer's name, email address, phone number, shipping address, and order contents and status.

Data a connector returns goes to the staff member's account with the assistant's provider and is handled under that provider's terms and privacy policy. We do not control how OpenAI or Anthropic retain or use it.

Connections are authorized with OAuth. We store authorization codes and refresh tokens only in hashed form. A merchant's staff can revoke a connection at any time in Simple Chat's settings. Uninstalling Simple Chat, or a Shopify request to delete a store's data, revokes all of that store's connections. After revocation the assistant can no longer access Simple Chat data; data it already received stays with its provider.

We may also disclose personal information when required by law, to protect rights and safety, or as part of a merger, acquisition, or sale of assets.

6 - International Transfers

We are based in Canada. We and our service providers process personal information mainly in the United States and Canada, and in other countries where our service providers operate. When we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland, we rely on an adequacy decision (such as the one for Canada) or on the safeguards in our service providers' data processing terms, such as Standard Contractual Clauses.

7 - Retention

We keep personal information while the merchant uses Simple Chat. In particular:

When Shopify sends a customer redaction request for a store, we erase that customer's conversations, contact details, notes, back-in-stock subscriptions, inbox filters, the parts of misshipment notes and issue reports that come from their conversations, and their attachments.
Shopify sends a shop redaction request 48 hours after a merchant uninstalls Simple Chat. We then erase the same data for every customer of the store and delete the store's integration credentials.
After a shop redaction request, we keep the store's settings, the merchant account information, and the profiles of its staff (Shopify user ID, name, profile image, email signature, and when they were last active), so that a reinstall works as before. No automatic expiry applies to them yet.
We keep billing records, with customer details removed from the conversations they refer to.
Automated database snapshots are deleted after 7 days, database backups and application logs in our storage after 730 days, logs at Mezmo after 14 days, and entries in our internal log database after 6 months.
A redaction request does not reach our copy of each inbound support email as we received it, which is not linked to a customer in our database. We delete that copy 30 days after it arrives.
When we compress an attached image, we normally delete the original file shortly after the compressed copy replaces it in the conversation. If the compression fails, the conversation keeps the original file, and a redaction request deletes it with the conversation.
A redaction request does not reach original image files that no conversation uses, which are not linked to a customer in our database. No automatic expiry applies to them yet. These include files that we received up to October 16, 2026, files whose deletion failed, and uploads that were never sent.
A customer redaction request replaces the staff text and the staff name in the GitHub copy of each issue report that staff filed from that customer's conversations, and in the follow-up comments that Simple Chat added to GitHub issues for those conversations. A shop redaction request does this for all issue reports and follow-up comments of the store. Comments and summaries that our engineers and their AI coding tools write on an issue stay. GitHub keeps the earlier versions of the title, the description, and the comments of an issue in its edit history and its timeline, and the GitHub API has no method that deletes them.

8 - Security

We protect personal information with administrative, technical, and organizational measures, including encryption in transit and at rest, logged access controls, and security monitoring. Our Compliance & Data Protection page describes them.

9 - Your Rights and Requests

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to restrict or object to its processing, and to withdraw consent you gave. Merchants and their staff can send a request to support@simple-chat.com. We respond within the time the law sets, and we may ask you to confirm your identity.

If you are a customer of a store that uses Simple Chat, send your request to the store. Simple Chat handles the data and redaction requests that the store makes through Shopify.

You may also complain to a data protection authority, such as the Office of the Privacy Commissioner of Canada or the authority where you live.

10 - Children

The Services are not directed to children under 16, and we do not knowingly collect their personal information as a controller. If you believe we have such information, contact support@simple-chat.com.

11 - Cookies and Similar Technologies

We use cookies and browser storage as described in our Cookie Policy.

12 - Changes to This Policy

We may update this Privacy Policy from time to time. The updated version becomes effective when posted on this page, and the date below shows the last change.

Last updated: October 17, 2026