Privacy Policy

• Store information (store name, domain, opening date, currency, etc.)
• Data about orders, products, customers and checkouts (this may include order IDs, product information, purchase dates and times, amounts, shipping regions, email addresses, etc. Information that directly identifies customers is processed temporarily, only to the minimum extent needed to provide the Service, and as a rule is not stored on an ongoing basis)
• Statistical data aggregated and analysed from the above
• Access tokens for connected external services (Shopify, Google Search Console, Instagram, etc.), stored encrypted
• Notification settings (email address, LINE connection information, delivery frequency)
• The content of enquiries you send us

To the extent necessary to provide the Service, we may process data about orders, products, customers, checkouts and other store operations through the Shopify API or webhooks. Customers’ names, addresses, phone numbers, email addresses and other information that directly identifies individuals are processed temporarily, only to the minimum extent needed for analysis and notifications, and as a rule are not stored on an ongoing basis. Where data is stored, it is limited to aggregated or statistical values, or data from which identifiers have been removed or pseudonymised.

With respect to personal data about a merchant’s customers, we act, as a rule, as a party processing that data on the merchant’s behalf. The merchant is responsible for providing any notices to its customers, obtaining consent, handling opt-outs and taking any other measures required under applicable law. We do not process such data beyond the purposes set out in this policy and our Terms of Service.

• Providing and improving the Service (analysis, improvement suggestions and notifications)
• Responding to enquiries and sending important notices
• Preventing misuse and operating the Service securely

To improve quality, our staff may review and verify the analyses, improvement suggestions and generated text the Service has provided to users, along with records of how they were generated (including inputs to and outputs from generative AI). This review is limited to an access-restricted operating environment and is used only to improve the quality of suggestions and investigate faults.

We may use generative AI services (APIs) from Google (Gemini), OpenAI (GPT) and Anthropic (Claude) to summarise analysis results and generate improvement suggestions, notification messages and the like. In every case, we use them under terms (via API) where input data is not used to train AI models. We do not use information that directly identifies individuals, such as customers’ names, addresses, phone numbers or email addresses, as input to generative AI. Even where unavoidable for fault investigation or otherwise to provide the Service, we limit such input to information protected by masking, aggregation, minimisation or other appropriate safeguards.

To improve the quality of suggestions, we record inputs to generative AI (aggregated store data and instructions) and outputs (suggestion text, etc.), which our staff may review and verify. These records are automatically deleted within 30 days of collection.

(1) Disclosure to third parties: We do not provide the data we collect to third parties except as required by law or with the individual’s consent. The outsourcing and external service integrations described in (2) below do not constitute “disclosure to third parties” under this section.

(2) Outsourcing and external service integrations: To provide the Service, we may entrust data processing to, or send data as an integration partner to, the following providers. We supervise them to ensure personal data is kept secure, through contracts with these providers, access controls, encryption and other necessary and appropriate measures.

• Vercel (app hosting)
• Supabase (database)
• Cloudflare (DNS and email forwarding)
• Resend (email delivery)
• LY Corporation (sending daily and weekly reports via LINE)
• Google (Search Console integration and generative AI)
• OpenAI / Anthropic (generative AI)
• Shopify (platform and billing) / Meta (Instagram integration)

(3) International transfers: The providers and integration partners above may have processing locations outside Japan, and personal data is transferred abroad to that extent. The main destination countries are the United States and Canada, depending on where each provider or partner processes data. Through contracts and data processing agreements with these providers, access controls, encryption, limits on retention periods and other measures, we check and supervise them to ensure that security measures at the level required under Japan’s Act on the Protection of Personal Information are continuously in place. On request from an individual or a merchant, we will promptly provide, in accordance with the law, information about the personal information protection systems in the relevant foreign countries, the measures taken by recipients, how and how often we check them, and any other information required by law.

We protect personal data through encryption in transit and at rest, encrypted storage of access tokens, least-privilege access, operation logging, separation of development and production environments, protected backups, careful selection and supervision of providers, deletion of unneeded data and other security measures.

To aggregate page views, clicks, traffic sources, conversions and the like on stores, the Service may use cookies, similar technologies or Shopify Web Pixels. We use them for statistical purposes that do not identify individuals, and where required by law or by Shopify’s systems, we respect the consent status, opt-outs and other privacy choices of merchants and customers.

We keep the data we collect for as long as needed to fulfil the purposes of use, and delete it promptly once it is no longer needed. Temporary (hashed) identifiers used to measure visits, and order IDs used to avoid counting purchases twice, are automatically deleted 13 months after collection. If a user uninstalls the app, we delete the data and encrypted tokens related to that store. We also respond to data access and deletion requests from merchants and customers in accordance with Shopify’s mandatory compliance webhooks (customers/data_request, customers/redact and shop/redact) and other procedures set by Shopify. For deletion requests, except where retention is required by law, we aim to delete or anonymise the relevant data, or take other necessary measures, within 30 days of receiving the request. Instagram integration data (the encrypted access token, your Instagram user ID and the AI-generated breakdown of your post themes) is deleted as soon as you revoke permission or request data deletion from Instagram’s settings. For instructions, see Data deletion.

If personal data is leaked, lost, damaged or otherwise compromised, we will, in accordance with the law, report to Japan’s Personal Information Protection Commission, notify affected individuals and merchants, and take any other necessary measures.

If you would like us to notify you of the purposes for which your data is used, disclose it (including records of disclosure to third parties), correct, add to or delete it, or stop using, erase or stop disclosing it to third parties, please contact hello@shopstaff.app. After verifying your identity, we will respond promptly in accordance with the law.

We may change this policy as needed. Changes take effect from the time they are displayed on the Service.

bunny inc. / Operations manager: Ayumi Higuchi / 1-1319-5 Makuharicho, Hanamigawa-ku, Chiba-shi, Chiba, Japan / hello@shopstaff.app