The short version. Chablyy is an AI-powered customer messaging and business automation platform. Merchants connect their channels (such as WhatsApp, Instagram, Facebook Messenger, a website chat widget, and voice) and their Shopify store so an AI assistant can answer customers. To do that we process merchant data and, on the merchant's behalf, the messages and contact details of the merchant's customers. We do not sell personal data. We share it only with the service providers needed to run Chablyy, and you can ask us to access, correct or delete it at any time at support@chablyy.com.
1. Who we are and scope
This Privacy Policy explains how Chablyy ("Chablyy", "we", "us", "our") collects, uses, discloses and protects personal data when you use the Chablyy Shopify app, our websites (including ecommerce.chablyy.com and chablyy.com), our dashboard, our chat widget and our voice and messaging services (together, the "Services").
Chablyy is operated by Miocache Technology Private Limited, a company registered in Nepal (company registration no. 364301).
Two different roles matter under privacy law:
- Merchants (businesses that install or sign up for Chablyy). For merchant account and billing data, Chablyy is the data controller.
- Merchants' customers (people who message a merchant through a channel Chablyy powers). For this data, the merchant is the controller and Chablyy acts as a processor / service provider, processing it only on the merchant's instructions. If you are a merchant's customer, please contact the merchant first for requests about your data; we will assist them.
2. Information we collect
2.1 Merchant and account information
- Name, email address, phone number, business name, role and team member details.
- Shopify store information such as shop domain, shop name, owner contact email, currency, locale, plan, and the access token issued when you install the app.
- Subscription, credit and billing records. Card and payment details are handled by our payment processors (Dodo Payments, or Shopify Billing for Shopify-billed merchants); we do not store full card numbers.
- Content you give us to train your AI assistant: documents, website URLs, FAQs, policies, persona and rule settings, and files you upload.
2.2 Merchants' customer information
- Messages, attachments and voice audio or transcripts exchanged with the merchant's AI assistant or team across WhatsApp, Instagram, Facebook Messenger, the website widget or phone/voice.
- Contact details a customer chooses to share or that the channel provides: name, email, phone number, social profile identifier or username.
- Lead, booking and order-enquiry details (for example requested time slots, product interest, order numbers and status).
- Storefront events from the Chablyy Shopify web pixel (such as pages or products viewed, cart activity), used only where the customer's cookie consent settings allow it.
2.3 Technical and usage information
- IP address, browser and device type, timestamps, pages and features used, error logs and security events.
- Authentication tokens and similar identifiers stored in your browser (see Cookies).
3. Shopify data we access
When you install Chablyy, you approve access scopes. We request only what the product needs and use each for the purpose below. Order-related scopes are optional and requested only if you enable the related features.
| Data | Why we use it |
|---|---|
| Products, inventory, collections, publications | Answer product, price and availability questions with live store data; keep the synced catalog current. |
| Store content, legal policies, locales, markets | Learn your store's pages and policies (shipping, returns, privacy) and answer in the right language and currency. |
| Theme configuration (read only) | Detect and guide set-up of the Chablyy storefront chat embed. |
| Customers (read and write) | Link conversations to customer records and keep contact details in sync. |
| Orders, checkouts, returns, order edits (optional) | Look up order status and help with returns or order changes when you turn those features on. |
| Customer events and pixel | Understand shopper intent on the storefront to make assistant replies more relevant. |
We never use LLM output as a source of prices, SKUs or inventory; those values are always read from your live Shopify data. We do not use Shopify data for any purpose other than providing the Services to you.
4. How we use information
- Provide, operate and maintain the Services, including generating AI replies, running your unified inbox, managing leads, customers and bookings, and sending messages through your connected channels.
- Authenticate users, enforce plan limits and credits, and process payments.
- Provide support, send service and security notices, and respond to your requests.
- Detect, prevent and investigate fraud, abuse, security incidents and violations of our terms.
- Monitor and improve reliability, performance and product quality, using aggregated or de-identified data where possible.
- Comply with legal obligations and enforce our rights.
Legal bases (where GDPR or similar laws apply): performance of a contract with you; our legitimate interests in running and securing the Services; compliance with legal obligations; and consent where we ask for it (for example certain cookies or marketing).
We do not sell personal data and we do not share it for cross-context behavioral advertising.
5. AI processing
Chablyy uses large language models and speech services to read incoming messages, retrieve relevant passages from your knowledge base and store data, and draft replies. Message content, relevant knowledge-base excerpts and necessary store context are sent to our AI providers (see section 6) solely to produce the response. We configure our providers so that your content is not used to train their general-purpose models. AI replies can be imperfect; merchants are responsible for reviewing their assistant's configuration and for their customers' use of it. Customers are told when they are chatting with an automated assistant where required by law or by the channel.
6. Sharing and service providers
We share personal data only as follows:
| Recipient | Purpose |
|---|---|
| Cloud hosting and storage (e.g. Amazon Web Services) | Hosting, database, file storage, backups. |
| AI model providers (e.g. OpenAI, OpenRouter, Groq) | Generate replies and process text. |
| Voice providers (e.g. LiveKit, OpenAI, ElevenLabs) | Realtime voice sessions, speech-to-text and text-to-speech. |
| Messaging platforms (Meta: WhatsApp, Instagram, Messenger) | Receive and deliver messages on the merchant's channels. |
| Shopify | App installation, store data access, and Shopify billing. |
| Dodo Payments | Subscription payments and invoicing. |
| Email and notification providers | Service emails and alerts. |
| Professional advisers, authorities | Where required by law, legal process, or to protect rights, safety and security. |
| Successors | In a merger, acquisition, financing or sale of assets, subject to this policy's protections. |
Providers are bound by contracts requiring them to protect the data and use it only to provide services to us. Our list of providers may change as the Services evolve; we will keep this section current.
7. Shopify privacy requests and uninstall
Chablyy honors Shopify's mandatory privacy webhooks:
- customers/data_request — we locate the data we hold about the customer for that store and provide it to the merchant.
- customers/redact — we delete or irreversibly anonymize that customer's personal data from the store's Chablyy account.
- shop/redact — after a store has uninstalled the app, we delete the store's data from our systems.
When you uninstall the app we immediately revoke access to your Shopify data and stop syncing. Data is then retained only as described in section 8 unless you ask for earlier deletion.
8. Retention
- Account and workspace data is kept while your account is active.
- After uninstall or account closure, store and customer data is deleted or anonymized within 30 days of the relevant Shopify redact request or your deletion request, except for backups, which roll off within a further 90 days.
- Billing, tax and audit records are kept for as long as the law requires.
- Security and access logs are kept for a limited period, typically up to 12 months.
Merchants can delete individual conversations, customers and training materials from the dashboard at any time.
9. Security
We use measures designed to protect personal data, including encryption in transit (TLS), encrypted storage of secrets and access tokens, role-based access control, logical separation of each business's data, signed and verified webhooks, least-privilege access for staff, and monitoring. No system is perfectly secure; if a breach affects your data, we will notify you and the relevant authorities as required by law.
10. International transfers
We and our providers may process data in countries other than where you live, including Nepal, India, the United States, and the European Union. Where required, we rely on appropriate safeguards such as standard contractual clauses or equivalent contractual protections.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to withdraw consent, to receive a portable copy, and to lodge a complaint with a regulator. To exercise any right, email support@chablyy.com. We may need to verify your identity, and we will respond within the time required by law (generally within 30 days).
Nepal
We handle personal information in line with Nepal's Privacy Act, 2075 (2018) and related regulations. You may request access to, correction of, or deletion of your personal information, and you may complain to the competent authority in Nepal.
European Economic Area, United Kingdom and Switzerland
You have rights under the GDPR / UK GDPR, including access, rectification, erasure, restriction, portability and objection, and the right to complain to your local supervisory authority.
California and other US states
You may request to know, access, correct and delete your personal information and to opt out of any sale or sharing of it. We do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising your rights.
Merchants' customers
Because the merchant controls their customers' data, we will redirect or assist with requests as directed by that merchant.
12. Cookies and similar technologies
We use essential cookies and browser storage (for example to keep you signed in and to remember widget conversations) and limited analytics to understand product usage. The Chablyy web pixel on a merchant's storefront respects the shopper's consent choices configured through Shopify's Customer Privacy API. You can control cookies through your browser settings; blocking essential storage may stop parts of the Services from working.
13. Children
The Services are for businesses and are not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time. We will post the new version here with a new "last updated" date and, for material changes, notify merchants by email or in the dashboard before the change takes effect.
15. Contact us
Questions, requests or complaints about privacy:
Miocache Technology Private Limited (operating Chablyy)
Company registration no. 364301, Nepal
Email: support@chablyy.com
Website: chablyy.com