Privacy policy
Who processes the data, and in what capacity
Amendsly is an app installed by a merchant on their Shopify store. Two distinct roles coexist:
- for the data of the merchant's customers, the merchant is the controller and Amendsly acts as a processor, solely on their instructions;
- for the merchant account's own data (their sign-in email, their store name), Amendsly is the controller.
Data processed
Amendsly applies strict data minimisation: only the data listed below is collected.
| Merchant's customer | Their email address, read from the shipped order. And, if they choose to describe a problem, the free text of their complaint along with the 1-to-5 star rating they gave. Neither their name, nor their phone number, nor their postal address is requested from Shopify or stored. |
|---|---|
| Merchant account | Sign-in email, store name, Shopify domain, Shopify access token, and the account settings (goodwill-gesture cap, sending and retention delays). |
| Public reviews | If the merchant connects Google, Trustpilot or Avis Vérifiés: the author name, rating, title, text and date of reviews already published publicly on those platforms. |
Purposes
- Send a review request to the customer after their order ships.
- Deliver the merchant's reply when a customer has described a problem and the merchant has approved the reply.
- Prepare a draft reply using artificial intelligence: categorise the complaint and propose a goodwill gesture. See the dedicated section below.
- Gather the public reviews of the platforms the merchant has connected.
A customer's email address is never used for advertising, never sold, and never shared with other merchants. Each merchant sees only their own data, which is enforced at the database level and not merely in the interface.
Automated decisions and use of AI
When a customer describes a problem, the text of their complaint is sent to Groq, which analyses it with a language model to derive a category, a draft reply and a goodwill-gesture percentage.
This analysis produces no automatic effect: nothing is sent to the customer and no goodwill gesture is granted until the merchant has read, possibly edited, and then approved the reply. The final decision always belongs to a person.
Sub-processors
| Supabase | Database and authentication. Data encrypted at rest. |
|---|---|
| Vercel | Application hosting. |
| Resend | Email delivery: recipient address and message content. |
| Groq | Analysis of complaint text. Receives the description written by the customer, never their email address. |
| Shopify | Source of the order data. Amendsly reads the customer's email from shipped orders. |
Retention periods
Personal data is not kept indefinitely. A daily automated job anonymisesit once the periods have elapsed: the merchant's statistics are preserved, but everything identifying a person goes away.
| Review requests | 90 days by default. After that, the email address is erased: the customer will not rate any more and the link has no purpose left. |
|---|---|
| Resolved cases | 24 months by default. The email address and the text of the complaint are erased at that point. |
| Unresolved cases | Kept as long as they are untreated, so the merchant retains the ability to reply. |
Each merchant can shorten both of these periods from their account settings.
Data subject rights
A customer exercises their rights with the merchant they ordered from, who is the controller. Amendsly responds automatically to the requests Shopify passes on in that capacity:
- Access request: the request is recorded and handled within the 30-day period Shopify provides for.
- Erasure request: the email address and complaint text of the customer concerned are erased immediately.
- App uninstallation: the store's data is erased and the Shopify connection is severed.
For any question about this policy: samuelsaenen@gmail.com.
Security
- Encryption in transit (TLS) and at rest (AES-256).
- Strict isolation between merchants enforced by the database itself, so that one merchant cannot reach another's data.
- Separate development and production environments: no real data is used for development.
- Access restricted to the people who need it.