Privacy Policy

This policy explains what personal data KameleonAI handles, why, who else touches it, and how long we keep it. It is written to be read, not to be survived. If something here is unclear, email privacy@kameleonai.com and we will answer.

1. Who we are and what role we play

We are Joseph Abdo, Angelo Ayranji and Ramy Sobhieh, trading together as KameleonAI, an unincorporated business based in Beirut, Lebanon. KameleonAI provides an AI sales assistant that merchants install on their Shopify store. It talks to shoppers on the storefront and gives the merchant analytics drawn from those conversations.

Our role depends on whose data it is:

• Store visitors' data: we are a processor. The merchant is the controller. We handle shopper data on the merchant's documented instructions, for the purposes set out below and nothing else. If you are a shopper and want to exercise your rights, the merchant is your first point of contact; we will assist them, and we will also act on a request you send us directly.
• Merchant account data: we are a controller. This covers the merchant's own account, billing status, support correspondence, and how they use our app.

2. What we collect from store visitors

a. Conversations

What a shopper types into the assistant, and what the assistant replies. Shoppers should not enter payment details, passwords, or sensitive personal information into the chat. It is a shopping assistant, not a support ticket, and we will tell them so in the widget.

Before a message is stored or sent to an AI provider, an automated filter masks email addresses, telephone numbers and card-shaped numbers in it, unless the shopper gives them as their own (for example, "email me at…" or "my number is…"). A shopper's own details are kept because the store needs them to act on the request, such as calling the shopper back. The records we keep for debugging and the analytics reports written about a conversation mask these details in every case. The filter is best-effort; it is a safety net, not a guarantee, which is why we ask shoppers not to share payment details in the chat.

b. Browsing and interaction signals

• Pages, products and collections viewed, and how long the shopper spent on them
• Search terms entered in the store's search
• Items added to or removed from the cart, and the cart's contents and applied discount codes
• The store's country/market and the shopper's browser language
• Technical data sent by the browser: user agent, screen dimensions, referring page, and IP address

We use the IP address only to rate-limit abusive traffic and to protect the service. It is not stored in a form that identifies a device beyond that short window.

c. Derived profile

From those signals we derive a working read on each visitor. This is profiling, and because a shopper is more entitled to understand this than anything else in this policy, here is what it actually consists of:

• A purchase-intent indication: a score from 0 to 100, calculated from how many products the visitor has viewed, whether they have returned to the same product, how many searches they have run, and whether they have added or removed items from the cart.
• An engagement level: low, medium or high, derived from the same signals.
• A shopping-style category: one of five: someone browsing casually, someone researching in depth, someone comparing options, someone buying on impulse, or someone looking for a discount.
• Behavioural signals: for example repeated views of the same item, hesitation at the cart, or refining a search several times.

We use this to decide what the assistant says, how it frames a recommendation, and whether and when to start a conversation unprompted.

What we never use it for: the profile does not affect the price a shopper sees, whether they are offered a discount, or which products are available to them. Everyone sees the same prices and the same offers. We enforce this in the product and prohibit merchants from configuring it otherwise.

A shopper can switch profiling off entirely (see §6).

d. Order records

When a shopper places an order, we receive the order record from Shopify: order ID and name, line items, quantities, prices, totals, currency, discounts, fulfilment and delivery status, and the Shopify customer ID. Customer name, email address, telephone number, and street-level address elements are redacted by Shopify and do not reach us. We use order records to measure what the assistant contributed and to answer a shopper's own questions about their order. The assistant can look up only orders placed in the last 60 days; for an older order, the shopper needs to contact the store.

We link a shopper's conversation to their resulting order using Shopify's cart token. This means an otherwise pseudonymous conversation can be connected to a specific order. We are telling you this because it is the point at which pseudonymous data becomes more identifiable, and a policy that skipped it would be misleading.

e. Product page content

To answer questions accurately, the assistant reads the content of the product page the shopper is viewing: text, labels and images. It does not capture anything the shopper has typed into a form on that page.

3. What we collect from merchants

• Store domain, store settings, and the Shopify session that authorises our app
• Catalog and commercial data: products, variants, prices, inventory, discounts, subscription plans, locations, markets and delivery profiles
• Store content the merchant provides to guide the assistant: brand story, shipping and returns policies, FAQs, sales guidance
• Contact channels the merchant wants the assistant to hand shoppers (phone, email, messaging accounts)
• App usage and diagnostic logs
• Whether the merchant has an active subscription

We do not receive or store payment card or bank details. Billing runs entirely through Shopify Managed Pricing; Shopify tells us only whether a subscription is active.

4. Why we process it, and on what legal basis

We do not use conversation content, browsing data, order data, or anything derived from them (including aggregated or anonymised forms) to train, fine-tune or improve any machine learning or AI model. This is both our own commitment and a requirement Shopify places on us. We contractually prohibit our AI providers from doing so as well.

We do test our assistant against real conversations before we change it. When we revise how the assistant works, we replay real past conversations through the new version and compare it against the current one, so that a change is measured against what shoppers actually say rather than examples we invented. No AI model is trained or altered by this. The model is the same one either way; what we are testing is our own instructions to it. A small number of past replays remain in our source repository and are being removed.

We do not pool one merchant's data with another's, and we do not use one store's data to benefit a competing store. Each store's data stays scoped to that store.

5. Cookies and browser storage

Nothing in this section other than the strictly necessary items is set before the shopper has consented, where consent is required in their region. We read the shopper's consent choice from Shopify's Customer Privacy API and re-check it whenever it changes. Where the store's Shopify settings do not require a consent banner in the shopper's region, Shopify reports consent as given, and our widget follows it.

We do not read Shopify's own cookies. Earlier versions of our widget read Shopify's _shopify_y, _shopify_s and cart cookies and preferred those identifiers over our own. They no longer do, and we set and read only the cookies named above.

The two cookies above are deliberately separate and are never combined. The first is written only once you open the chat and lasts only as long as the conversation, which is what makes it strictly necessary for a service you asked for. The second is written only if you have consented. Both are marked Secure and SameSite=Lax.

If you have not consented, the chat still works in full. In that case the conversation is held against the short-lived session identifier only, so the assistant remembers what you said earlier in the same conversation and remembers nothing about you afterwards.

When you ask the assistant to change your cart. If you ask the assistant to add something to your cart, or remove it, we read your store's cart reference for that cart so we can record the action you asked us to take and, if you go on to order, recognise that the assistant helped. We do this only for cart changes you make through the assistant. Cart changes you make elsewhere on the store are only observed if you have consented to analytics.

Our analytics pixel runs inside Shopify's sandboxed pixel environment and declares the consent categories it requires; Shopify will not run it at all for a shopper who has not consented, and it automatically honours the Global Privacy Control signal.

6. Shopper choices

You are talking to an AI

The assistant is an AI system, not a person. We say so at the start of every new conversation, in the chat header throughout, and in any message the assistant sends unprompted. If a shopper asks whether they are talking to a bot, they get a straight answer. That response comes from our code, not from the AI, so it cannot be talked around.

Turning off personalisation

A shopper can switch off behavioural profiling and proactive outreach from within the chat widget at any time. The assistant will still answer questions and help find products; it will stop building a profile, stop tailoring its approach, and stop opening conversations unprompted. No account or email is needed.

Consent

Where the merchant's store presents a consent banner, our processing follows the shopper's choice. Changing that choice takes effect immediately, including withdrawing it. Where consent is required and we cannot determine whether it has been given, we do not track.

Global Privacy Control

If a shopper's browser sends a Global Privacy Control signal, we treat it as an opt-out: we stop profiling and stop proactive outreach for that visitor, and we remember the choice. No account or configuration is needed; the signal is enough.

Objecting to marketing

A shopper can object at any time to processing for direct marketing purposes, including profiling connected to it. This is an absolute right: we act on it, we do not weigh it. The in-widget control below is the fastest route.

Do Not Sell or Share My Personal Information

We do not sell or share personal information as those terms are defined under California and similar US state laws.

We can say this plainly because of how the AI providers are engaged. Every provider that receives conversation content is contracted as a purpose-limited service provider: it may use the data only to return an answer to us, it may not use it for its own purposes, and it may not train or improve any model on it. We removed a model-routing intermediary from the production path specifically because its terms allowed the model providers behind it to retain and use inputs independently, which would have made this sentence untrue.

We honour Global Privacy Control signals regardless, and a shopper can opt out through the store's privacy controls at any time.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict or object to the processing of your personal data, and to withdraw consent. For shopper data, the merchant is the controller; contact them first. You can also write to privacy@kameleonai.com and we will act on it and tell the merchant. We respond within 30 days. You may also complain to your local data protection authority.

7. Who else handles the data

We use the following sub-processors. All but two are bound by a written agreement limiting them to providing services to us, requiring confidentiality and security, and (for AI providers) prohibiting any use of the data to train or improve their models. We are still completing the agreements with the other two, Hetzner and Coolify Cloud.

This list is kept current here and in our Data Processing Addendum, and we will give merchants at least 30 days’ notice before adding or replacing a sub-processor, during which a merchant may object. We also disclose data where we are legally required to, and to professional advisers under confidentiality.

Internal access

A small number of our staff can access merchant dashboards and conversation data to provide support and investigate faults. Access is limited to those who need it. When a member of our staff opens a merchant’s data through our application, we record who they are, whose data they opened, when, and what they requested. Engineers who work directly on the databases and hosting consoles that hold the data are a smaller group again, restricted and subject to the same confidentiality obligations, but that direct access is not covered by the same record.

8. International transfers

Our infrastructure is hosted in the European Union (Stockholm and Helsinki), in Switzerland (Zurich), which the European Commission recognises as providing adequate protection, and in the United States. Data leaves the EU and Switzerland in two ways, and we name both:

• Our analytics database, our merchant app, and our AI, monitoring and network providers in the United States. We rely on the EU-US Data Privacy Framework where the recipient entity is certified, and on the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data) as the primary or fallback mechanism.
• Our own team in Lebanon. Our engineering and support staff are located in Lebanon and access production systems from there for support, maintenance and incident response. Lebanon is not covered by an EU adequacy decision, so this access is an international transfer even though the data itself is not stored in Lebanon. It is covered by Standard Contractual Clauses.

A copy of the relevant transfer terms is available to merchants on request.

9. How long we keep it

Why conversations have two periods. A conversation lasts exactly as long as the identifier that can reach it. Once that identifier expires, nothing can find the conversation any more, so we delete it. The conversation and the only way of finding it expire together.

If you consented, that identifier lasts six months, and the assistant remembers you between visits for that long. If you did not consent, we never set a lasting identifier: your conversation is held against a session reference that expires after 30 minutes of inactivity, and once it does, nobody can retrieve it: not us, and not you. We delete those conversations after 7 days. Seven rather than one because a few legitimate things still need to read a conversation shortly after your visit (matching an order you place later that day, reconciling a cart, producing the store's summary), and all of them finish within a week.

Analytics reports. Before we store a report, we run it through automated masking designed to remove names, email addresses, postal addresses, phone numbers and card numbers. This is automated and it is not perfect, so we treat every report as personal information: access is restricted to staff who need it, and reports are deleted on the schedule in the table above.

When we say we delete something, here is exactly what happens. At the end of a retention period, or when you ask us to erase your data, the record is removed from every system that can serve it. Nobody can retrieve it after that: not you, not the store, not us. Because our storage keeps short-lived versions so that a mistake can be undone, a residual copy lingers in that versioned layer and is then permanently removed. That last step finishes within 7 days. We would rather tell you this than claim deletion is instant, because it is not, and you are entitled to the accurate version.

Reports do keep an internal reference to the conversation they summarise, because that reference is what lets us find and delete a report when someone asks us to erase their data. Removing it would make the report impossible to erase, which we think is worse.

These periods are enforced automatically, and every deletion run is recorded so a failure is visible to us rather than silent. We also honour Shopify's data-request, customer-redaction and shop-redaction requests, completing each within 30 days.

10. Security

We describe only controls we actually operate.

• All external connections use TLS. Data is encrypted in transit between our services and our data stores, and connections to our cache verify the server's certificate.
• Our databases, cache and file storage are encrypted at rest by the cloud providers that host them. One exception we would rather state than gloss over: the system that records our AI requests for debugging runs on a single virtual machine whose disk is not encrypted at rest. Those records are masked, access-restricted and deleted within 60 days, as described above.
• Shopify access tokens are encrypted at the application layer using AES-256-GCM, with the encryption key held in our hosting providers' encrypted secret stores and never in source code or the database.
• Each merchant's data is isolated: every request is scoped to a verified store identity and cannot reach another store's data.
• Access to production data is restricted to staff who need it, and staff access to a merchant’s data through our application is recorded.
• Webhook authenticity is cryptographically verified before processing.
• Test and production environments are separate, and production data is not used to build or populate test environments. Real conversations are replayed to evaluate a change before it is released, as described in §4, and never to train a model. A small number of past replays remain in our source repository and are being removed.

No system is perfectly secure. If a breach affects a merchant's data we will notify the merchant without undue delay, and Shopify within 24 hours of becoming aware.

11. Automated decision-making and profiling

The assistant uses the profile described in §2(c) to decide what to recommend, how to frame a pitch, and when to start a conversation. In our assessment these are commercial recommendations, not decisions producing legal or similarly significant effects, so the rules on solely automated decision-making do not apply. We are stating a reasoned position rather than a settled fact, and because it is a position, we give shoppers an unconditional opt-out anyway (§6).

What the assistant does not do: it does not set or vary prices, does not decide who is offered a discount, does not control which products a shopper can buy, does not assess creditworthiness or eligibility for anything, and cannot negotiate. No commercial outcome depends on the profile.

A shopper who wants to understand a specific interaction, or wants a human to review it, can write to privacy@kameleonai.com and we will explain the factors involved and route it to a person.

12. Regional information

United States

Where state privacy laws apply, shoppers have the right to know what personal information is collected and how it is used, to access and delete it, to correct it, and to opt out of targeted advertising. We honour the Global Privacy Control signal automatically (§6). We do not collect sensitive personal information intentionally, and we do not use or disclose it for purposes beyond providing the service. See §6 for our position on "sale" and "sharing".

The assistant discloses that it is an AI at the start of every conversation, as California law requires of automated accounts used in commercial contexts.

Quebec, Canada

Where personal information is used to render a decision based exclusively on automated processing, we inform the person at or before the time of the decision, and on request we will tell them what information was used, the principal factors involved, and their right to have it corrected, and give them the opportunity to submit observations to a person who can review it. Shoppers can deactivate the profiling technology described in §2(c) using the in-widget control in §6.

Brazil

Shoppers may request a review of decisions taken solely on the basis of automated processing that affect their interests, including those that define a consumer profile. Write to privacy@kameleonai.com and we will explain the criteria and procedures used, to the extent that does not disclose trade secrets, and arrange a human review.

Australia

The profiling described in §2(c) is computer-assisted decision-making used to personalise the shopping experience. It does not determine price, offer eligibility, or product availability, and in our assessment does not significantly affect an individual's rights or interests.

European Union and United Kingdom

The legal bases for each purpose are in §4. Shoppers may lodge a complaint with their national supervisory authority.

13. Children

The service is not directed at children under 16 and we do not knowingly collect their personal data. If a merchant or parent tells us we have, we will delete it.

14. Changes

We will post any change here with a new "Last Updated" date. For changes that materially affect how we handle personal data, we will notify merchants by email and in-app before they take effect.

15. Contact

Privacy: privacy@kameleonai.com
Legal: legal@kameleonai.com
Security: security@kameleonai.com
Joseph Abdo, Angelo Ayranji and Ramy Sobhieh, trading together as KameleonAI, Beirut, Lebanon