Privacy Policy

1. Who we are

PlainSaid is a Shopify app operated by Chris Fry (the legal entity is being formalized; this notice will be updated when the operating company is incorporated). You can reach us any time at cfry@kizik.com. This Privacy Policy explains what data PlainSaid collects, how we use it, who we share it with, and the choices you have.

2. Data we collect from merchants

When you install PlainSaid on your Shopify store we receive:

• Shop information via Shopify OAuth — your shop domain, shop ID, and the plan you are on.
• Knowledge base content you author inside PlainSaid — FAQs, product comparisons, references, pairings, brand voice settings, restricted phrases, approved framings, and support escalation details.
• Product metadata — titles, handles, descriptions, and related fields we read via the Shopify Admin API so PlainSaid can power auto-fill and gap analysis.

3. Data we collect from shoppers (storefront usage)

When a shopper interacts with the PlainSaid drawer on a merchant's storefront we record:

• The question the shopper asked.
• The answer PlainSaid returned.
• A timestamp, the product context the question was asked from, and the request IP address — used only for rate limiting and abuse prevention, not associated with any personal profile.

We do not collect shopper names, email addresses, account identifiers, payment information, or any persistent cross-site identifiers.

4. Who we share data with

• Anthropic (Claude API) — receives the shopper's question along with knowledge-base and product context in order to generate an answer. Anthropic does not train its models on Claude API data.
• Neon — managed Postgres provider that hosts the merchant knowledge base and question logs.
• Vercel — hosts the application and processes incoming requests.
• Shopify — provides your installation context, billing, and webhook delivery.

We do not sell merchant or shopper data, and we do not share it with advertisers.

5. How long we keep data

We retain merchant knowledge base content and question logs for as long as your store has PlainSaid installed. When you uninstall, all of your shop's data is cascade-deleted from our systems. We also honor Shopify's GDPR webhooks — customers/data_request, customers/redact, and shop/redact — within 30 days of receipt.

6. Cookies

The embedded admin uses Shopify session tokens rather than cookies. The storefront drawer does not set any cookies of its own.

7. Your rights (GDPR / CCPA)

You may request access to, correction of, or deletion of data we hold about you or your shop. Email cfry@kizik.com. For shop-level data requests, you can also use Shopify's built-in data request flow, which will route to PlainSaid automatically.

8. Children's privacy

PlainSaid is a business-to-business tool and is not directed at children under 13. We do not knowingly collect data from children.

9. International transfers

Data is processed in the United States by our hosting and AI providers (Vercel, Neon, Anthropic). Where required, transfers are covered by Standard Contractual Clauses.

10. Changes to this policy

If we make material changes to this Privacy Policy we will notify installed merchants by email and via an in-app banner at least 30 days before the change takes effect.