Privacy policy

1. Who we are

Strathly is a sales and support assistant for Shopify stores, run by HEAVENLYTRADE S.R.L. SEMPLIFICATA, Via Roma 114, 81100 Caserta (CE), Italy, VAT IT04635090618 (“Strathly”, “we”, “us”). You can reach us at support@strathly.com. The service has four parts: this website (strathly.com), the app at app.strathly.com where merchants and their teams work, the chat on the merchant's storefront where shoppers talk with Ivy, our assistant, and the Strathly iOS app for teams.

This policy explains what personal data we process, why, on what legal basis, for how long, who receives it, and the rights you have under the EU General Data Protection Regulation (“GDPR”) and Italian data protection law.

We have not appointed a data protection officer, as the law does not require one for a company like ours. For anything about your data, write to support@strathly.com: a person answers.

2. Our two roles

Data protection law gives us a different role depending on whose data it is.

• We are the controller of the account data of merchants and their teams (their accounts, how they use the app and the iOS app, billing, support), of visitors of this website, and of anyone who emails us. We decide why and how that data is processed, and this policy is the notice for it.
• We are a processor for the data of shoppers who chat on a store and of the store's customers, and for the content of the store's conversations, including the names and messages of team members as they appear in them. The store (the merchant) decides to offer the chat and what it is for, so the merchant is the controller. We process shoppers' data only on the merchant's instructions, as set out in our data processing agreement. If you are a shopper, the store's own privacy policy applies, and the store is the first place to ask about your data. Section 6 describes what the chat processes, so stores can tell their shoppers.

3. Data about merchants and teams

What you give us

• Account: your name, email address and password. We store the password only as a one-way hash, never in readable form.
• Your acceptance of our terms: when you sign up, which version of the terms you accepted and when, with a keyed fingerprint (hash) of your IP address and your browser's name and version, as evidence of the agreement.
• Team: the people you invite (name and email), their role (owner, admin or agent), the name shoppers see, a profile photo if you add one, availability, business hours and notification preferences.
• Your store's content: the files and web pages you add to Ivy's knowledge, the answers you teach her, her settings, your widget's look, and the replies and internal notes your team writes in the inbox.
• Messages to us: what you write when you email support or sales.

What we receive from Shopify

When you connect your store we read, with the permissions you approve in Shopify: your store's name, domain, contact email, currency, languages and time zone; your products, variants, stock, collections, pages, policies and shipping rates; and, when a shopper asks about an order, that order and its customer. Shopify also sends us every order placed or cancelled in your store, so we can count the sales that follow a conversation (section 6 says what we keep of them). We keep Shopify's access tokens encrypted.

We also ask Shopify for permission to change orders and draft orders (write_orders, write_draft_orders). We use it only for the order actions: a refund, a cancellation, a new shipping address, or a replacement created as a draft order. Ivy prepares them and a teammate confirms, or Ivy takes them herself only where you switched that on, within the limits you set.

What we collect as you use the service

• Sign-in sessions: the browser or device of each session, so you can see them in Settings and sign out the ones you don't recognize, and its IP address, which we erase about 1 hour after you sign in.
• Activity: who did what in your store's account (for example who changed a setting or resolved a conversation), the in-app notifications, and how many conversations and AI requests your store used, which we need for billing and for the numbers in Analytics.

The app uses no third-party analytics, advertising or tracking tools.

The app (app.strathly.com) reaches you through the network of Cloudflare, Inc. (a proxy, which also shields the app from attacks), acting as our processor: your requests, from the dashboard or the iOS app, go to a nearby Cloudflare data center, which passes them on to our servers in Germany. On the way, Cloudflare processes your IP address, browser details and what each request carries, under its data processing agreement and the EU's Standard Contractual Clauses.

4. The iOS app

The Strathly iOS app is for merchants' teams: it signs in to an existing account (accounts are created on the web, not in the app) and shows the store's conversations. It processes:

• Sign-in: your email and password, sent over HTTPS to sign you in. The app keeps the session in the iPhone's Keychain, encrypted by iOS, until you log out. The last email you signed in with stays in the Keychain after you log out, to fill in the next log in, until you delete the app.
• Notifications: if you allow them, the push token Apple gives your iPhone, the iPhone's name and model (so you can tell your devices apart in Settings), and whether the token is for Apple's test or production service. Notifications reach you through Apple and show a shopper's name and a preview of the conversation, or, when a teammate @mentions you, the text of their note. Logging out removes the token from our servers.
• What you do in the app: your replies, notes, order actions, assignments and availability, the same as in the dashboard.
• On the iPhone: while you are signed in, the app keeps a copy of your inbox on the device so it opens quickly. Logging out erases it.
• The demo store: without an account you can explore a demo store in the app. Its conversations are sample data on the iPhone: what you do in the demo stays on the device and reaches no one. If you ask us to email you the setup link, we receive the email address you type and whether you ticked the box for product tips and news, and we send you that one email through Resend. We store no name, device ID or IP address with it.

The app has no analytics, crash reporting or advertising tools, does not track you across other apps or websites, and does not access your location, contacts, photos or camera.

5. Billing and payments

We keep your store's plan, the state of its subscription and trial, its extra conversations and its usage. Every store pays through Shopify, whether you installed Strathly from the Shopify App Store or signed up on our website: Shopify bills you, and your payment details stay with Shopify, under its own privacy policy. We read your subscription's state from Shopify and tell Shopify which extra conversations you buy, so they appear on your Shopify bill. We never see your payment details.

6. Data about shoppers on a store

When a shopper uses the chat on a store that runs Strathly, we process the following on the merchant's behalf.

• The conversation: the messages the shopper writes, the replies from Ivy and the team, the team's internal notes, a short summary and topic we generate for the team, and the shopper's thumbs up or down on a reply.
• Context from the browser: the address of the pages where the shopper uses the chat, the browser's language, the time zone, and a random ID the chat keeps in the browser, created when the shopper opens the chat or writes, so they find their conversations again (see the cookie policy). A shopper signed in to the store also sees the conversations they had on that store from their other devices.
• Identity, when the shopper gives it: a name and email address (for example to get the team's reply by email when no one is available), the Shopify customer ID and email when the shopper is signed in to the store, which Shopify confirms to us, and an email address the shopper proves with a one-time code. We store only a fingerprint (hash) of the code, which expires after 10 minutes.
• Orders: when a shopper asks about an order, Ivy looks it up in the store's Shopify account. She shares an order's status only when its number and the email on the order both match; she changes an order only after the shopper proves who they are. To give the team context we keep a short summary of that customer from Shopify (number of orders, amount spent, tags, city and country, customer since). If the merchant allows it, Ivy or the team can change the shipping address, refund, replace or cancel an order; those changes happen in Shopify, and the conversation keeps a record of each one, with the address used.
• Addresses: when a shopper corrects a shipping address in the chat's address form, the address goes to the store's Shopify and stays with the conversation. While they type, our server asks Google for address suggestions with the partial address, the country and the language only.
• Sales from conversations: where the store's cookie banner allows it, the chat adds the conversation's ID to the shopper's Shopify cart (a cart attribute named _strathly_conversation), which Shopify copies onto the order. Shopify sends us every order placed or cancelled in the store, including by customers who never used the chat: each one is added to the store's daily totals (number of orders and revenue), and nothing else of it is kept. When an order is placed within 3 days of a conversation and we can tie it to that conversation (by the cart attribute, the Shopify customer ID, or the email the shopper gave in the chat), we keep its number, total, date and items and how it was matched.
• Technical data: the IP address of each request, which we use only against abuse: to limit how many requests and new conversations one address can make. The raw addresses kept for these limits are deleted within 24 hours. With every conversation we keep a keyed fingerprint (hash) of the address, never the address itself, so the store's team can block an address it marked as spam (for 30 days).
• Delivery: the chat's requests to app.strathly.com, messages included, pass through Cloudflare's network on their way to our servers in Germany, so Cloudflare processes the shopper's IP address, browser details and what each request carries, in transit, as our subprocessor.
• Bot protection: when a conversation starts, the chat runs Cloudflare Turnstile, an invisible check that a person, not a bot, is writing. It runs in a hidden frame served by app.strathly.com, so Cloudflare receives the shopper's IP address and technical signals from their browser and device, and tells us whether the check passed. Cloudflare says it does not use this data to target ads (see Cloudflare's Turnstile Privacy Addendum). A shopper the check does not pass still gets an answer, from the store's team.

The store's team sees the conversations according to their role. Strathly staff look at a store's data only to provide support the merchant asks for, to keep the service secure, or when the law requires it. If the team answers after the shopper has left, we email the reply to the address the shopper gave, with the store's email as the reply-to address.

7. How Ivy uses AI

Ivy's replies, the conversation summaries, the replies she drafts for the team and the search index of a store's catalog and knowledge are made with AI models from OpenAI, through OpenAI's API. To answer, we send OpenAI the conversation, the parts of the store's content that matter to the question, the order details Ivy looked up, the shopper's name and email when they gave them, the address of the page the shopper is on, the browser's language, and a random ID for the shopper that OpenAI uses only to detect abuse. OpenAI processes this data as our subprocessor (our contract is with OpenAI Ireland Ltd). Under its terms for API customers it does not use API data to train its models unless the customer opts in, and we have not opted in. We ask OpenAI not to store what we send for later use, so it keeps it only in its abuse-monitoring logs, for up to 30 days, then deletes it.

• We do not train AI models on your data or your shoppers' data, and what Ivy learns from one store is never used for another.
• As the provider of the chat, we designed it so shoppers know they are talking with an AI, as the EU AI Act requires: a line under the message box says “Ivy is an AI assistant.” (with the name the store gives her), in English, Italian, Spanish, French or German following the shopper's browser, and in English otherwise. Stores may not hide or change it. When the store has handoff switched on, a shopper can ask for a person at any time.
• Ivy can be wrong. Order changes she makes on her own follow rules the merchant switched on and limits the merchant set, and the team can undo them for a few seconds before they run.
• For the data we control, we make no decisions based solely on automated processing that have legal or similarly significant effects on you.

8. This website

strathly.com is a set of static pages. It sets no cookies, stores nothing in your browser, runs no analytics or advertising tags, and has no forms. Your browser loads nothing from third parties: the fonts and images come from strathly.com itself.

• The pages reach you through the network of Cloudflare, Inc. (a content delivery network and proxy, which also shields the site from attacks), acting as our processor: your request goes to a nearby Cloudflare data center, which passes it on to our server in Germany. To deliver the page, Cloudflare processes your IP address, browser details and the page you asked for, under its data processing agreement and the EU's Standard Contractual Clauses. It sets no cookies, unless it asks a visitor to pass a security check (see the cookie policy).
• Our server receives the same details, as any website does, to send you the page. It keeps them in its access logs for 14 days, to keep the site secure and find errors, then deletes them.
• Signing in and signing up happen on app.strathly.com, which sets its own cookies: one to keep you signed in, and a few technical ones listed in the cookie policy.
• If you email us, we receive your address and your message and keep them to answer you.

9. Purposes and legal bases

For the data we control (sections 3, 4, 5 and 8, and your emails to us), we rely on these legal bases under Article 6 of the GDPR:

• Running the service you signed up for (your account, your store, Ivy, the inbox, the iOS app, notifications, support): performance of our contract with you, Article 6(1)(b).
• Billing, invoices, tax and accounting records: performance of the contract, Article 6(1)(b), and our legal obligations under tax and accounting law, Article 6(1)(c).
• Security and abuse prevention (sign-in protection, rate limits, the activity log, the web servers' access logs, the logs of access to personal data, delivering this website and the app through Cloudflare, keeping one free trial per store): our legitimate interest in keeping the service, this website and their users safe and our offer fair, Article 6(1)(f).
• Improving the service from how it is used as a whole (for example which features are used and where errors happen): our legitimate interest in a product that works, Article 6(1)(f).
• Answering your emails and handling requests before you sign up: steps you ask for before a contract, Article 6(1)(b), or our legitimate interest in answering, Article 6(1)(f).
• Sending the setup link you ask for in the iOS app's demo: steps you ask for before a contract, Article 6(1)(b). Product tips and news, only if you tick that separate box: your consent, Article 6(1)(a), which you can withdraw at any time with the unsubscribe link in the email or by writing to us.
• Keeping evidence that you accepted our terms (the version, the date, a fingerprint of your IP address, your browser): our legal obligations, Article 6(1)(c), and our legitimate interest in proving the contract, Article 6(1)(f).
• Legal claims and requests from authorities: our legal obligations, Article 6(1)(c), and our legitimate interest in defending our rights, Article 6(1)(f).
• Service emails (security, billing, changes to our terms): performance of the contract. We don't send marketing email today. If we ever do, we will send it only to people who agreed to it, with a one-click unsubscribe in every email, as the law requires.

Where we rely on legitimate interests, you can object (section 14). For shoppers' data (section 6) the merchant chooses the legal basis, and we process it only to provide the chat and the inbox to that merchant.

What you have to give us. Your name, email address and a password are needed to create an account, and a connected Shopify store is needed for Ivy to answer on it: without them we can't provide the service. A paid plan is billed through your Shopify account, so Shopify holds the billing details it needs. Everything else (a profile photo, your availability, the iPhone's notifications) is up to you, and leaving it out only turns off what it is for.

10. Who receives data

We never sell personal data or share it for advertising. Personal data reaches only:

• Our subprocessors, who process it on our behalf, under contract, only for the job we give them: Hetzner, OpenAI, Resend, Apple, Cloudflare.
• Independent companies that receive data because of what you ask the service to do, and use it under their own terms and privacy policies: Shopify, Google (Google Maps Platform, for address suggestions).
• Providers for our own operations: Cloudflare, Google (our domains, the delivery of this website, and the mailbox where your emails to us arrive).
• Our accountants and legal advisers, bound by confidentiality, when needed for our tax and legal obligations.
• Authorities and courts, when the law requires it (for example a valid order), or to protect the rights and safety of our users or the public; and a buyer of the business, in a merger or sale, in which case this policy keeps applying to your data.

The subprocessors page lists each company with what it does, the data it receives and where.

11. International transfers

Our servers, database and file storage are in the European Union (Germany (European Union)). Some providers process data outside the European Economic Area: OpenAI, Resend, Apple, Google and Cloudflare in the United States. We cover these transfers with the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework (our contract with OpenAI is with OpenAI Ireland Ltd, which passes data to OpenAI's U.S. companies under those Clauses). Shopify processes data in Canada, which the European Commission recognizes as giving adequate protection. You can ask us for a copy of the safeguards at support@strathly.com.

12. How long we keep data

• Your account: until you delete it in Settings › Account (see how to delete your account). Deleting your account also deletes any store you own alone, with everything in it. Deleted data leaves our database at once and our encrypted backups within 30 days, as they are replaced. The record of your acceptance of our terms is kept while your account exists.
• Sign-in sessions: 30 days after you last used them, or until you sign out; expired sessions are deleted every day. In-app notifications: 24 months. Push tokens: until you log out of the iOS app, delete your account, or Apple tells us the token is no longer valid.
• Your store's data (catalog, knowledge, settings, team): for as long as the store has an account with us; conversations as the next point says. When you uninstall Strathly in Shopify (disconnecting Shopify inside Strathly uninstalls it too), Shopify asks us 48 hours later to erase the store's Shopify data, and we then delete the store and all of its data. Reconnecting within those 48 hours brings your store back as it was.
• A store installed from Shopify but never set up: if no one creates a Strathly account for it after installing Strathly in Shopify, so the store has no team, we delete it with its data (the Shopify access token and the catalog and content we imported) 30 days after the installation.
• Conversations and a shopper's data: each conversation, with its messages, its events, the shopper's contact details, the orders tied to it and the shopper's words quoted in unanswered questions, is deleted automatically 24 months after its last message, or earlier when the store is deleted. A shopper with no conversation is deleted 24 months after we last saw them, and orders tied to conversations and unanswered questions 24 months after they were placed or last asked. A merchant can ask us to delete a shopper's data sooner, and when Shopify sends us a customer's erasure request for a store, we delete that shopper's conversations, details, orders and quoted words from it. The store's daily sales totals hold no personal data and are kept.
• IP addresses: the raw addresses used for rate limits, within 24 hours (most within two); the one on a sign-in session, about 1 hour after sign-in. Keyed fingerprints: with their conversation, on a block (an address-only block ends and is deleted after 30 days), and with your acceptance of our terms. The website's access logs, and the logs of who opened a conversation, an order or a data export (your team's user IDs and the times, never the content): 14 days.
• The trial record: when a store is deleted we keep its Shopify domain, when its free trial started, how many trial conversations it used and the balance of its unused extra conversations, so the same shop gets one free trial and finds them if it comes back. No names, emails or conversations are kept in it.
• Billing and tax records: Shopify, which bills every store, keeps the payment, bill and tax records, for as long as the law requires it to, under its own policies. Our database keeps your store's billing history only while the store exists.
• A setup link asked for in the iOS app's demo: the email address is deleted 30 days after your last request. If you ticked the box for product tips and news, 24 months after your last request, or 30 days after you unsubscribe.
• Emails to us: 24 months after our last exchange. An email that concerns a contract or a claim is kept as long as the law requires for it (in Italy, up to 10 years).

13. Security

Every connection to Strathly is encrypted (HTTPS). Passwords are stored as one-way hashes, Shopify access tokens are encrypted, sign-in is rate limited, backups are encrypted, and each teammate sees only what their role allows. Every access to shoppers' personal data, by your team in the app and by our staff on the database, is logged, and these logs are deleted after 14 days. Ivy shares an order's status only when its number and the email on the order both match; she changes an order only after the shopper proves who they are. More on the security page. If a breach affects your data and puts you at risk, we tell you without undue delay, and the authority when the law requires.

14. Your rights

Under Articles 15 to 22 of the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it (Article 15);
• have it corrected if it is wrong, or completed if it is incomplete (Article 16);
• have it erased (Article 17);
• restrict how we use it while a question about it is settled (Article 18);
• receive it in a structured, machine-readable format and have it sent to another company (portability, Article 20);
• object to a use based on our legitimate interests (Article 21);
• not be subject to a decision based solely on automated processing with legal or similarly significant effects (Article 22);
• withdraw a consent you gave, at any time, without affecting what was done before.

Merchants and teammates: you can change most of your data yourself in Settings, and delete your account there. For anything else, write to support@strathly.com. We may ask you to confirm your identity before we act.

Shoppers: the store you chatted with is responsible for your data, so please contact the store first. If you write to us, we pass your request to the store and help it answer.

We answer within one month, as the law requires. If you think we have not handled your data properly, you can complain to the data protection authority where you live or work, or to ours: the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy (garanteprivacy.it).

If you live in California or another U.S. state with a privacy law: we don't sell personal information or share it for cross-context behavioral advertising, and you can exercise the rights above with the same email.

15. Children

Strathly is a service for businesses and is not meant for anyone under 16. We don't knowingly collect children's data for our own purposes. Stores decide who their chat is for; if you believe a child's data reached us, write to us and we will help the store remove it.

16. Changes to this policy

When we change this policy we update the date at the top of the page. If a change matters for how we use your data, we tell account owners by email before it takes effect.

17. Contact

For any question about your data or this policy, write to support@strathly.com, or by post to HEAVENLYTRADE S.R.L. SEMPLIFICATA, Via Roma 114, 81100 Caserta (CE), Italy. Company details are in the legal notice.