Shopify AI Chat Privacy: Questions to Ask a Vendor

Shopify AI chat privacy diligence means asking vendors clear questions about scopes, chat logs, AI providers, order lookup, retention, and who is responsible for shopper requests. Use this list before you install. It helps you compare apps on paper and in a test store.

This is not legal advice. Privacy law depends on your store, region, and how you configure tools. For binding decisions, talk with your counsel or privacy advisor. For Shopify’s developer-facing protected customer data overview, see Shopify’s protected customer data guidance.

Commercial disclosure: Appifire makes Appifire AI Chat. Soft product answers appear in “How this relates to Appifire,” grounded in current product behavior and our Privacy Policy.

Why these questions matter

Storefront AI chat can touch:

• Product catalog text
• Store policies and FAQs
• Chat transcripts (and sometimes name/email)
• Order status details when lookup is enabled
• Third-party AI model providers that generate replies

A vague “we take privacy seriously” line is not enough. You need who stores what, who can see it, and what happens on uninstall or a delete request. For how product and order data typically flow (scopes, live vs stored), see How Shopify AI Apps Use Product and Order Data.

Key concepts in plain language

Term	Plain meaning
Scope	Shopify permission the app requests (for example products or orders)
Chat log	Stored messages between shopper and assistant (and related session fields)
Processor / service provider	Role many apps claim when the merchant is the business deciding why data is processed
Subprocessor	Vendor the app uses (hosting, AI models, email)
Order lookup	Fetching live order details to answer “where is my order?”
Verification	Checks that the shopper owns the order (many tools are weak here)
Retention	How long logs and related data stay stored
Redact / delete	Removing or anonymizing data after a request or uninstall

Question set 1: Shopify access and minimization

Ask:

1. Which Shopify scopes do you request, and why is each required?
2. Which data is synced and stored, vs fetched live only when needed?
3. Can we run without order scopes if we only want product Q&A?
4. Do you document protected customer data access the way Shopify expects for apps that handle customer/order context?

Good answer shape: a scope table tied to features, plus a clear live-vs-stored split.

Weak answer shape: “We need full access for AI” with no feature map.

Question set 2: Chat transcripts and visitor identity

Ask:

1. What visitor data do you collect by default (messages only, or name/email/phone)?
2. Is identity optional (guest mode), and can the merchant turn the form off/on?
3. Who can read transcripts in the admin (roles, staff access)?
4. Do you use chat logs to train public models? If yes, under what controls?
5. How do merchants export or delete a conversation when a shopper asks?

Good answer shape: identity settings, guest mode, admin access limits, training stance in writing.

Weak answer shape: vague “secure storage” with no training or delete path.

Question set 3: AI / model providers

Ask:

1. Which AI providers process message content to generate replies?
2. Is prompt content (including retrieved product/policy snippets) sent to those providers?
3. Do you have a published list of subprocessors or an equivalent disclosure?
4. Can merchants choose region or provider constraints if their policy requires it?
5. Do you claim PII redaction before the model call? If yes, what is actually implemented today?

Good answer shape: named categories of providers, what leaves your systems, and honest gaps (for example no redaction yet).

Weak answer shape: “Enterprise-grade AI” with no provider disclosure.

Question set 4: Order status and sensitive replies

Ask:

1. Does order lookup require an order number, email, login, or something else?
2. Do you verify that the shopper owns the order before showing details?
3. What order fields can appear in chat (tracking, address lines, items, totals)?
4. Are orders stored in your database for WISMO, or fetched live and not archived as an order system of record?
5. What is the not-found and escalation path when lookup fails?

Why this matters: order-number-only lookup can be convenient and privacy-sensitive. Treat it as a risk decision, not a checkbox.

Appifire’s current product stance (for comparison while you evaluate any vendor): live Admin lookup by order reference, no order-owner verification today, pre-chat email not used as proof of ownership. Details: How Order Status and Tracking Work in Appifire Chat. A dedicated secure-lookup checklist stays unpublished until stronger verification behavior is approved in product.

Question set 5: Retention, uninstall, and compliance requests

Ask:

1. How long do you retain chat logs and related personal data by default?
2. What happens on app uninstall?
3. How do you handle Shopify compliance webhooks (customers/data_request, customers/redact, shop/redact) if you are a Shopify app?
4. Who should a shopper contact first for a delete request: the merchant, the app, or both?
5. Do you provide a merchant-facing process for privacy tickets?

Good answer shape: retention language in the privacy policy, uninstall behavior, and a request path.

Weak answer shape: “We comply with GDPR” with no mechanism.

Question set 6: Merchant responsibilities (do not skip)

Even with a careful vendor, merchants usually still own storefront choices:

Merchant choice	Privacy impact
What you put in Knowledge Hub / FAQs	Avoid pasting secrets, internal notes, or staff-only data
Pre-chat identity on/off	Collect only what you will use
Which pages show the widget	Limits where transcripts can start
Human handoff channel	Where sensitive cases should go instead of inventing answers
Staff access to chat logs	Who on your team can read shopper messages

Automation split: Shopify Customer Support Automation: What to Automate and Keep Human. Escalation: When Should an AI Chatbot Escalate to a Human Agent?.

Decision framework

If the vendor…	Then…	Because…
Cannot list scopes by feature	Pause install	You cannot minimize access
Sends chat text to AI providers but will not say which category of provider	Pause or require written disclosure	Shadow subprocessors break reviews
Offers order lookup with no ownership check	Decide consciously; route sensitive cases to humans	Convenience is not the same as verification
Has no delete / redact story	Do not treat “GDPR” marketing as enough	You need a process, not a badge
Lets you disable identity collection	Prefer that default for low-risk FAQ use	Less data collected is easier to defend
Refuses a test-store trial with log review	Be cautious	You cannot see what is stored

Practical vendor worksheet

Copy one row per vendor:

Question theme	Vendor answer	Evidence (policy URL / screenshot)	Pass / risk	Notes
Scopes
Live vs stored
Chat logs + identity
AI providers
Order verification
Retention / uninstall / redact
Merchant admin access

Run the same accuracy test after privacy review. Privacy-safe tools can still invent product facts.

Risks and limits of this guide

• Not a certification, DPIA template, or regional law checklist
• Vendor answers change; re-check after plan or scope updates
• Named competitor privacy claims need their current policies, not rumors
• Secure order-owner verification is a separate product decision; do not assume every WISMO chat has it

How this relates to Appifire

This page owns vendor questions, not a full Appifire legal opinion. For Appifire AI Chat, start with the published Privacy Policy. In plain product terms today:

Theme	Current Appifire stance (high level)
Catalog	Product knowledge from synced published store data for answers
Orders	Live lookup for status answers; not an Appifire order archive for WISMO
Order verification	No order-owner verification in the current lookup flow
Chat data	Messages/sessions used to operate chat; merchants can review chat logs in admin
AI providers	Replies use AI/model providers as described in the privacy policy (AI and model providers category)
Shopify compliance	App handles Shopify compliance webhook topics used for customer/shop redact flows in the product ops docs
Training claims	Do not invent “never trains” or “always trains” lines beyond the privacy policy

Honest gaps to weigh: order-number lookup without ownership proof; no claim of full pre-LLM PII redaction as a marketed guarantee; talk-to-human is contact handoff, not a private live-agent vault inside the widget.

Related product reading: How Order Status and Tracking Work in Appifire Chat · Getting Started With Appifire AI Chat on Shopify · How Appifire Compares Shopify AI Chat Tools (includes privacy docs as a comparison criterion).

Related reading

• How Appifire Compares Shopify AI Chat Tools
• How to Choose an AI Shopping Assistant for Shopify
• Can Shopify AI Chatbots Hallucinate? Risks and Guardrails
• Best Shopify Apps for Customer Support Automation

FAQ

What privacy questions should I ask a Shopify AI chat vendor?

Ask about scopes, live vs stored data, chat logs and identity, AI providers, order lookup verification, retention, uninstall/redact handling, and who handles shopper delete requests.

Is this legal advice?

No. It is a practical merchant checklist. Use counsel for legal determinations in your region.

Does order-number lookup mean the chat verified the shopper?

Not by itself. Many tools look up by the number provided. Ask whether ownership checks exist.

Who is responsible for shopper privacy requests?

Often the merchant is the primary contact for store customers, while the app provides tools or processes as a service provider. Confirm the path in the vendor’s policy.

Should I avoid AI chat for privacy reasons?

Not automatically. Many stores use it with clear scopes, limited identity collection, human escalation for sensitive cases, and documented vendor answers. Skip vendors who will not answer the worksheet.