Privacy Policy

Effective: 15 August 2026

Selloway ("we", "us", "our") makes an AI sales assistant for online stores. This policy explains what we collect, why, who else touches it, and how long we keep it. It covers selloway.com, the Selloway app for Shopify, and the Selloway plugin for WooCommerce and WordPress.

There are two different people described below and it matters which is which: the merchant, who installs Selloway on their store, and the shopper, who visits that store and may talk to the assistant.

1. What we collect from merchants

Account and store details

Your store domain, the email address on the account, your plan, and your Selloway settings. For Shopify installs we also hold the access token Shopify issues so the app can read your catalogue; it is deleted when you uninstall.

Your catalogue

Product titles, descriptions, prices, images, categories and stock status are copied to our servers so the assistant can answer from them. On Shopify this uses the read_products scope, which is the only permission the app requests. It is read-only: we never modify your products, and the assistant's opening line is stored on our servers, not written back to your store.

We do not read your orders, your customers, or your payment data. We do not request those scopes.

Payment details

On Shopify, billing is handled entirely by Shopify. We never see a card. For direct subscriptions, payment is processed by Paddle, who act as merchant of record; we store only the subscription status, never full card numbers.

2. What we collect from shoppers

Conversations

What a shopper types to the assistant, and what the assistant replies, is stored so the merchant can read it, so the assistant can pick up a conversation where it left off, and so we can support and improve the service. We do not ask shoppers for their name, email or any other identifying detail. If a shopper types something personal into the chat, it is stored as part of the message.

A random identifier in the shopper's browser

The widget stores a random string in the browser's local storage. It is what lets the assistant recognise someone who comes back and continue the earlier conversation rather than greeting them as a stranger. It contains no personal information, is not shared with anyone, and is not used to track anyone across other websites. Clearing site data removes it, and the shopper is then a new visitor.

Merchants control this. In the app's settings, Memory can be switched off entirely, limited to a single product, or given a shorter window.

Technical logs

Standard server logs: IP address, browser type, referring URL and timestamps. Used for security, abuse prevention and debugging.

3. Who else processes this data

We do not sell data. It is shared only with the processors we need to run the service:

• OpenRouter and OpenAI — to generate replies, the shopper's message and the relevant product details are sent to OpenRouter, which routes them to OpenAI's gpt-4o-mini model. We do not send merchant account details or payment data.
• Hetzner — our servers and database, hosted in the European Union.
• Cloudflare — DNS and content delivery for our websites.
• Shopify — for the Shopify app, subscription billing.
• Paddle — for direct subscriptions, payment processing and invoicing.

4. How long we keep it

• Account and store data — for as long as Selloway is installed, plus 90 days.
• Conversations — up to 12 months, then deleted.
• Catalogue data — replaced on each sync, and deleted when you uninstall or ask us to.

To be precise about one thing: the Memory setting controls how far back the assistant will reach when a shopper returns. It is not a deletion schedule. Conversations older than that window stop being used but are still stored until the retention period above expires, or until you ask us to delete them.

5. Uninstalling, and erasure

Uninstalling the Shopify app deletes the access token immediately, so we lose all access to your store.

We implement Shopify's three mandatory privacy webhooks:

• shop/redact — sent by Shopify 48 hours after uninstall. We delete the store's conversations, messages and catalogue, and clear the account's email address and credentials.
• customers/redact and customers/data_request — we do not link conversations to Shopify customer accounts and hold no Shopify customer records, so in almost every case there is nothing to erase or return. Every request is logged and answered regardless.

You can ask for deletion at any time, without waiting for an uninstall, by writing to the address at the bottom of this page.

6. Your rights

If you are in the UK, EU or another region with equivalent law, you have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to your data protection authority. We answer such requests within 30 days and do not charge for them.

Our lawful bases are: performance of a contract for running the service you installed, legitimate interests for security and abuse prevention, and legal obligation for financial records.

7. International transfers

Our servers are in the European Union. Some processors listed above operate outside it, including in the United States; those transfers rely on Standard Contractual Clauses or an equivalent safeguard.

8. Security

All data in transit is encrypted with TLS. Access tokens and credentials are stored encrypted, and access to production systems is restricted. No system is perfectly secure, and we will not pretend otherwise; if a breach affects your data we will tell you and the relevant authority within the time the law requires.

9. Children

Selloway is a tool for businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, contact us and we will delete it.

10. Changes

We may update this policy. Material changes will be announced by email or an in-app notice before they take effect, and the effective date above will change.

11. Contact

Privacy questions, access requests and deletion requests: [email protected]

The data controller for the information described above is Alisher Otajanov Ollaberganovich, trading as Selloway, Orzu ko'chasi 2-yo'lak, 12-uy, Urganch, Xorazm Region, Uzbekistan.