Privacy Policy

Last updated: April 6, 2026

2folk ("we", "our", "us") provides an AI-powered live chat application for Shopify merchants. This privacy policy explains how we collect, use, and protect your data.

1. Data We Collect

From Merchants (via Shopify):

Store name, email address, and domain (via Shopify OAuth)
Product catalog and store policies (to provide AI context for customer questions)
Order data (order number, amount, status — for revenue attribution only)

From Store Visitors (via chat widget):

Email address (provided voluntarily to start a chat)
Chat messages (text content sent during conversations)
Images (if uploaded during a conversation)
Page browsing context (which product page they're on, for relevant assistance)

2. How We Use Data

Chat functionality: Delivering messages between visitors and merchants in real-time
AI responses: Generating helpful automated replies using conversation context and store product data
Revenue attribution: Linking chat conversations to subsequent purchases to show merchants the value of chat
Email notifications: Alerting merchants about new conversations when they're not online

3. Data Storage and Security

Data is stored on servers in Germany (Netcup, Nuremberg datacenter)
All data is encrypted in transit (TLS/HTTPS)
Database access is restricted to authenticated application connections only
Uploaded images are stored on the same secure server infrastructure

4. Third-Party Services

Mistral AI: Chat messages may be sent to Mistral AI for generating responses. See Mistral's privacy policy. Mistral processes data in Europe (GDPR-compliant).
Resend: Used for sending email notifications to merchants. See Resend's privacy policy
Cloudflare: Used for CDN and DDoS protection. See Cloudflare's privacy policy

5. Data Retention

Chat conversations and messages are retained for the lifetime of the merchant's account
When a merchant uninstalls the app, all their data (conversations, customers, settings) is deleted within 30 days
Visitor email addresses are retained only as long as the merchant's account is active

6. Merchant and Visitor Rights

Merchants can export or delete their data by contacting us
Visitors can request deletion of their chat history by contacting the store merchant
We comply with GDPR data subject access requests

7. GDPR Compliance

We process personal data as a data processor on behalf of Shopify merchants (data controllers). We maintain appropriate technical and organizational measures to protect personal data.

8. Contact

For privacy questions or data requests, contact us at [email protected]