Privacy Policy

1.Who we are

CreaScale AI is an AI sales-assistant application ("the App", "we", "us") operated by Matrix Tower LLC. The App connects to a merchant's online store and answers that merchant's customers on WhatsApp, Instagram and an embeddable web chat widget, and can create orders — including cash-on-delivery (COD) orders.

For personal data processed through the App, the merchant who installs the App is the data controller, and Matrix Tower LLC acts as a processor acting on the merchant's instructions. For account, billing and operational data of the merchant themselves, we act as controller.

Data-protection contact: support@creascale.ai.

2.Scope of this policy

This policy covers personal data processed by the CreaScale AI application when it is installed on a Shopify store (or connected via our supported channels) and when it converses with end-customers. It does not cover the merchant's own website, the Shopify platform itself, or third-party services the merchant uses independently of the App.

3.Data we process

a. Merchant & account data

• Store identifier (e.g. your *.myshopify.com domain) and tenant identifier.
• Your Shopify access token, stored encrypted (see §8) and referenced by indirection — never in plain text.
• Plan, operating mode, credit balance and usage/cost metering needed to run and bill the service.

b. Store data accessed via the Shopify Admin API

With your authorization (see the scopes in §6), the App reads store data to answer customers accurately and place orders:

• Products, variants, prices and collections;
• Inventory levels and locations;
• Orders (for order-status and store context);
• Customer records, including names, phone numbers and addresses, to match a returning customer and their order history.

c. End-customer data captured in conversations

• Contact identifier (phone number for WhatsApp, Instagram user id, or web-widget session);
• Name, delivery address and phone provided by the customer to place an order;
• Purchase intent (e.g. a cash-on-delivery order request);
• The content of messages exchanged with the assistant.

d. Conversation history & memory

We store conversations, a rolling conversation summary, and structured "memory" facts (for example a customer's stated preferences or last order) so the assistant can hold context across messages. Catalog text, knowledge-base text and those memory facts are indexed as numerical embeddings to enable semantic search, which is why the memory facts appear in the Google row of §5.

4.Why we process it & legal bases

Where required, the merchant is responsible for obtaining any consent from its own customers for messaging on WhatsApp/Instagram.

5.Sub-processors

We use the following sub-processors to run the App. Each receives only the data needed for its function.

International transfers. Some sub-processors are located outside the EEA/UK (e.g. in the United States). Where personal data is transferred internationally, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and equivalent mechanisms.

This is the current list. It is also available on request at support@creascale.ai, and §13 below explains how we inform you before we add or replace a sub-processor.

6.Shopify Protected Customer Data

The App requests the following Shopify access scopes:

read_products · read_orders · write_orders · read_customers · read_inventory · read_locations

Reading customer name, address and phone is Protected Customer Data under Shopify's requirements. We access it only to answer the customer, recognise a returning customer, and create the order they request; we do not sell it or use it for advertising; and we apply the security controls in §8.

We do not ask for the customer's email address. No query the App sends to Shopify selects that field, so the App never reads it and never stores it. This is a deliberate minimisation: the assistant answers on WhatsApp, Instagram and the web widget, and it does not need an email address to do that. The App also only reads customer records — it never writes to them.

Mandatory Shopify compliance webhooks

We implement Shopify's three privacy webhooks (endpoint /api/compliance/shopify/gdpr, requests are HMAC-verified):

• customers/data_request — we log the request and build an export of the customer's stored data, which is emailed to the merchant (see the Resend row in §5), who can forward it to the data subject, within 30 days.
• customers/redact — we erase that customer's personal data (orders, conversations and messages, memory, opt-in and related records). Records are deleted wherever deletion is possible; the few rows that carry a usage quota, an idempotency key or a revenue figure are anonymised instead — the recipient is erased so that the row no longer identifies the customer, while the counter it protects stays intact.
• shop/redact — after a store uninstalls, we erase that store's data and stored credentials on the same basis: deleted where deletion is possible, anonymised where a row carries a quota, an idempotency key or a revenue figure.

Uninstalling the App immediately revokes and purges the stored Shopify access token.

7.Data retention

An automated purge runs on a schedule. Personal data that has passed the window below is either deleted or irreversibly anonymised. The windows are:

• Operational personal data — conversations, messages, order records and memory facts that hold a customer's name, phone number or address: 90 days after the last activity on the record.
• Ingestion log — the technical journal of incoming webhooks and imported rows: 30 days.
• Proof of messaging consent — the opt-in records: 365 days.
• Access journal — who read which protected personal field, and when: 365 days.

Revoked opt-ins are never purged. When a customer opts out — for example by replying "STOP" — that revocation is kept indefinitely and is deliberately excluded from the purge: erasing it would let messaging resume towards someone who has objected.

Some records are anonymised rather than deleted. A row that carries a usage quota, an idempotency key (which is what stops the same message or the same order from being sent twice) or a revenue figure is kept for that purpose, but the recipient is erased from it, so the row no longer identifies anyone.

Personal data is also erased, on the same basis, when we receive a customers/redact or shop/redact request (see §6), or on a documented request to support@creascale.ai. Stored credentials are purged immediately when a store uninstalls. Short-lived operational caches of store data are held only transiently to serve a conversation.

8.Security

• Tenant isolation. Every merchant is a separate tenant. Database access is governed by row-level security keyed to the merchant's identity, so one merchant's data cannot be read by another.
• Encrypted credentials. Shopify and messaging access tokens are stored in an encrypted secret vault and are only ever accessed through restricted, privileged database functions — never exposed to the merchant dashboard or to other tenants.
• Encryption in transit. Calls to Shopify and to messaging platforms use HTTPS/TLS. Incoming webhooks are verified with HMAC signatures.
• Least privilege & abuse controls. Public endpoints (such as the web widget) are protected by unguessable identifiers, per-tenant origin allowlists, rate limiting and cost caps.

9.Your rights

Under the GDPR, individuals in the EEA/UK have the right to access, rectify, erase, restrict or object to processing, and to data portability. Because we act as a processor for end-customer data, requests from a store's customers are normally directed to that store (the controller); we assist the merchant in fulfilling them, including through the Shopify webhooks above.

Under the CCPA/CPRA, California residents have the right to know what personal information is collected, to request deletion, to correct it, and to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information.

To exercise any right, contact support@creascale.ai. You also have the right to lodge a complaint with your local supervisory authority.

10.Cookies

The App is an assistant that runs inside Shopify and messaging channels; it does not use advertising or tracking cookies to process the personal data described here. The embeddable web widget uses only the storage strictly necessary to maintain a conversation session.

11.Children

The App is intended for use by merchants and their adult customers. It is not directed at children, and we do not knowingly collect personal data from children under the age required by applicable law.

12.Changes to this policy

We may update this policy to reflect changes in the App or in legal requirements. Material changes will be posted on this page with a revised "Last updated" date above.

13.Data Processing Agreement

This section is the data processing agreement between the merchant and Matrix Tower LLC for the personal data of the merchant's customers that is processed through the App. It applies from the moment the App is installed, and it prevails over any conflicting statement elsewhere in this policy.

a. Roles

For the personal data of end-customers, the merchant is the controller and Matrix Tower LLC is the processor. The subject matter of the processing is the operation of the AI sales assistant; its duration is the term of the merchant's use of the App; its nature and purpose are described in §3 and §4; the categories of personal data and of data subjects are those listed in §3.

b. Processing on documented instructions

We process end-customer personal data only on the merchant's documented instructions — this policy, the settings the merchant configures in the App, and the actions the merchant takes in it — unless we are required to process it by a law to which we are subject, in which case we inform the merchant before processing unless that law forbids it. We do not sell end-customer personal data and we do not use it for our own advertising.

c. Confidentiality of personnel

The persons authorised to process end-customer personal data are bound by an obligation of confidentiality, and their access is limited to what each of them needs in order to run and support the service.

d. Security measures

We implement the technical and organisational measures set out in §8 (Security), and we keep the access journal described in §7.

e. Sub-processors

The merchant gives a general authorisation for us to engage the sub-processors listed in §5. We inform the merchant before we add or replace a sub-processor, and the merchant may object to that change; if the objection cannot be resolved, the merchant may stop using the App and request the deletion or return of the data under (h) below. Each sub-processor is bound by data-protection obligations no less protective than those of this section, and we remain responsible to the merchant for their performance.

f. Assistance with data-subject rights

We assist the merchant in answering requests from its customers to access, rectify, erase, restrict, object to or port their personal data — in particular through the Shopify compliance webhooks described in §6 (customers/data_request, customers/redact, shop/redact) and through the retention windows in §7. Where such a request reaches us directly, we pass it to the merchant rather than answer it ourselves.

g. Personal data breach

We notify the merchant of a personal data breach affecting its customers' personal data without undue delay and at the latest within 72 hours after becoming aware of it, together with the information we hold on the nature of the breach, its likely consequences, and the measures taken or proposed to address it.

h. Deletion or return at the end of the service

When the merchant stops using the App, we delete or return the end-customer personal data, at the merchant's choice, and delete the existing copies — except where storage is required by law, or where a record is kept in the anonymised form described in §7. Stored credentials are purged immediately on uninstall.

i. International transfers

Where end-customer personal data is transferred outside the EEA or the UK, that transfer is covered by the EU Standard Contractual Clauses — the controller-to-processor module between the merchant and us, and the processor-to-processor module for onward transfers to our sub-processors — together with the UK International Data Transfer Addendum. Both are incorporated into this section by reference.

j. Demonstrating compliance

We make available to the merchant the information necessary to demonstrate compliance with the obligations of this section, and we allow for and contribute to audits, including inspections, carried out by the merchant or by another auditor it mandates, on reasonable prior notice and during normal business hours. Requests are sent to support@creascale.ai.

14.Contact