Security and privacy

Built to be trusted with your store.

Here is what Chablyy accesses in your Shopify store, why it needs it, and how it’s protected.

What Chablyy accesses, and why

Chablyy asks Shopify for the access below and nothing more. Order access is optional and only requested if you turn on order lookup.

read_productsread_inventory: Sync your catalog and show stock labels in the chat.
read_contentread_legal_policies: Import your store pages and policies, such as shipping and returns.
read_localesread_markets: Know your store’s languages, currency and markets so answers match.
read_themes: Check that the Chablyy Chat app embed is switched on. This is read-only: Chablyy never writes to your theme.
write_pixelsread_customer_events: Install the web pixel that measures assisted revenue, within each visitor’s consent settings.
read_publications: Skip products that aren’t published to a sales channel.
write_customers: Link a logged-in shopper’s chat to their customer record in Shopify.
unauthenticated_write_checkouts: Create a single-item checkout when a shopper taps Buy now.

Requested only if you turn on order lookup.

read_ordersread_checkouts: Show order status and tracking in the chat, and order history and abandoned checkouts in the Inbox. You approve this in Shopify when you turn on order lookup.

Encrypted tokens
Shopify access tokens are stored encrypted (AES-256-GCM). Chablyy uses expiring tokens that are rotated, rather than long-lived ones.
Verified webhooks
Webhooks from Shopify are checked against their signature before Chablyy acts on them.
Read-only on your theme
Chablyy never writes to your theme. It only reads it to check that the app embed is switched on.
A clean uninstall
Uninstalling Chablyy revokes its access to your store and ends your subscription.

Order lookup is for logged-in shoppers
A short-lived signed claim from your store confirms who is asking, so shoppers can only see their own orders. Guests are asked to log in.
The pixel respects consent
The web pixel is for analytics only. It follows Shopify’s customer privacy settings and doesn’t do marketing or preference tracking.
No sale of personal data
Chablyy doesn’t sell personal data.

AI replies can be imperfect, so Chablyy is built to stay close to your store’s facts, and to make it easy to review what it says.

Prices, variants and stock come from your synced Shopify catalog. The assistant is instructed never to invent them.
By default it doesn’t offer discounts you haven’t approved, and it avoids promises such as guaranteed delivery or “arrives tomorrow”.
When a shopper asks for a person, the chat is handed off to your inbox.
Every AI reply in the inbox shows its sources and a confidence label, with feedback buttons for your team.

Questions about security or privacy? Email us and a person will reply.

Add Chablyy from the Shopify App Store. Setup takes a few minutes.