Privacy Policy

Last updated: 17 May 2026

Merchant Buddy helps online stores answer customer messages using their own catalog, policies, and order data. This policy explains what information we collect from merchants and their customers, how we use it, and the choices you have.

1. Who we are

"Merchant Buddy", "we", "us", and "our" refer to the operator of the Merchant Buddy service available at this website and through the merchant dashboard. If you have questions about this policy, contact us at [email protected].

2. Information we collect

2.1 Account information

When a merchant signs up, we collect:

• Name and email address used to create the account.
• Organization name and basic store profile.
• Authentication credentials (passwords are stored hashed; we never see them in plain text).

2.2 Connected store data

When a merchant connects a WooCommerce or other supported store, we retrieve and store the data needed to answer customer questions:

• Product catalog (titles, descriptions, prices, stock, images).
• Store pages and policies (shipping, returns, FAQs).
• Order metadata used to answer order-status questions (status, fulfillment, totals).
• Customer contact records associated with orders.

We use OAuth or store-issued credentials to retrieve this data. The merchant can revoke our access at any time from their store and from the Merchant Buddy dashboard.

2.3 Conversation content

Merchant Buddy stores the messages exchanged between a customer and the merchant (or the AI agent acting on the merchant's behalf), including:

• Message text and timestamps.
• Attachments such as images and audio recordings sent through supported channels.
• Conversation status (open, snoozed, closed) and which channel the conversation arrived on.

2.5 Usage and diagnostic data

We collect minimal diagnostic data to keep the service running: IP addresses on login, error logs, and basic event counts. We do not use third-party advertising or behavioral analytics trackers on the merchant dashboard.

3. How we use information

• Deliver and operate the dashboard, AI agent replies, and messaging integrations.
• Generate AI-drafted replies that reference the merchant's own catalog, policies, and order data.
• Notify merchants of new messages and conversation activity.
• Diagnose problems, prevent abuse, and improve reliability.
• Comply with legal obligations.

4. AI processing

To generate replies and summaries, Merchant Buddy sends the relevant conversation context, the merchant's stored knowledge (catalog, policies), and the customer's latest message to a third-party large language model provider (currently Anthropic) through their API. These providers process the data on our behalf to return a model response and, per their published terms, do not use API inputs to train their models. We do not sell merchant or customer data to model providers or anyone else.

5. How we share information

We share data only with service providers that are necessary to run Merchant Buddy:

• Hosting and infrastructure providers that run our application and databases.
• AI model providers (see Section 4) for generating drafts and summaries.
• Email delivery providers for transactional emails such as login and notifications.
• Meta Platforms when sending replies through the Instagram API on the merchant's behalf.

We do not sell personal data. We may disclose information when required by law, to enforce our terms, or to protect the rights, property, or safety of users.

6. Data retention

• Account data is retained while the merchant has an active account.
• Conversations and messages are retained while the connection that produced them is active, so the merchant has a history.
• Instagram access tokens are deleted when a merchant disconnects Instagram or deletes their account.
• On account deletion, we remove personal data within 30 days, except where we are legally required to keep specific records (e.g. invoicing).

7. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing. To exercise these rights:

• Merchants can manage and delete connected accounts and conversations directly from the dashboard, or email [email protected].
• Customers who have messaged a merchant using Merchant Buddy can contact the merchant they messaged to request deletion. They may also email us at the address above and we will forward the request.
• See our Data Deletion Instructions for the full process for Instagram-connected accounts.

8. Security

We use TLS for data in transit, encryption at rest for access tokens, and restrict internal access to personal data to staff who need it to operate the service. No system is perfectly secure; we will notify affected users promptly if we become aware of a breach that affects their data.

9. International transfers

Merchant Buddy and the service providers listed above may process data in countries other than your own, including the United States and the European Economic Area. Where required, we rely on standard contractual clauses or equivalent safeguards.

10. Children

Merchant Buddy is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top and, for material changes, notify merchants through the dashboard or by email.