This Privacy Policy describes how Ario ("we," "us," or "our") collects, uses, stores, and shares information in connection with the Ario Shopify app and related services (collectively, the "Service"). Ario is an AI shopping assistant that merchants install on their Shopify storefronts to help shoppers find products through conversational search.
We take privacy seriously. We collect the minimum data needed to operate the Service, we don't sell personal information, and we give merchants and shoppers clear rights to access and delete their data.
Ario is a Shopify app operated independently. The data controller for this Service is the operator of Ario, reachable at privacy@ariochat.com. If you need a postal address for formal legal notice, request it at that email and we will provide it.
"Merchant" means a Shopify store owner who installs Ario. "Shopper" means a visitor to a merchant's storefront who interacts with the Ario widget. This policy covers both groups.
We do not collect shopper names, emails, addresses, phone numbers, payment info, or any personally identifying information unless a shopper voluntarily types it into a chat message. We actively design against needing this data.
We use the information above to:
We do not use shopper conversations to train AI models. Your data is not used to improve any general-purpose AI system.
Where GDPR applies, we rely on the following legal bases:
Shoppers can exercise any of the rights listed in Section 8 at any time.
We share the minimum data needed with the following third parties, and only for the purposes below:
@ariochat.com addresses.We share data with law enforcement or government authorities only when legally required (for example, a valid subpoena or court order). We will challenge overbroad requests where we believe they are unlawful.
Data is stored on Supabase and Vercel infrastructure, with primary storage in secure data centers in the European Union or the United States depending on the specific service. Conversations may transit to Anthropic's API servers in the United States for AI processing. All data is encrypted in transit (TLS) and at rest.
If you are in the EEA or UK, by using the Service you consent to the international transfer of your data as described above. We rely on Standard Contractual Clauses or equivalent safeguards where required.
Depending on where you live, you have some or all of the following rights:
To exercise any of these rights, email privacy@ariochat.com. We respond within 30 days. For California residents under the CCPA/CPRA and residents of other US states with comparable laws, the same rights apply and the same contact address.
Shopify merchants can also delete shopper data automatically by using the GDPR webhooks Ario implements (customers/data_request, customers/redact, shop/redact), which Shopify triggers on your behalf.
Ario's widget uses browser local storage (not cookies) to store a random session identifier and the most recent messages in a shopper's current conversation. This is strictly necessary for the widget to function and is not used for tracking, advertising, or analytics.
The Ario admin interface, which only merchants see, uses session cookies for authentication.
We implement industry-standard security practices: TLS encryption for all data in transit, encryption at rest, the principle of least privilege for database access, OAuth-scoped access tokens for Shopify APIs, and regular security reviews. No system is perfectly secure. If we become aware of a security incident affecting your data, we will notify affected merchants without undue delay and in any event within 72 hours where required by law.
Ario is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact privacy@ariochat.com and we will delete it.
We may update this policy from time to time. When we make material changes, we update the "Last updated" date at the top and notify installed merchants by email. Continued use of the Service after changes become effective constitutes acceptance of the updated policy. Prior versions are available on request.
Questions, concerns, data requests, or complaints:
If you are in the EEA or UK and have an unresolved concern, you have the right to lodge a complaint with your local data protection authority.