dotreply.aiPrivacy Policy
The short version. Dotreply helps Shopify merchants talk to their own customers over iMessage. We only process shopper data that a merchant's store already holds (name, phone number, cart and order details) in order to send and answer messages on the merchant's behalf. We don't sell personal data, we don't message people who haven't shopped with the merchant, and anyone can opt out by replying to a message.
This policy explains what we collect, why, who we share it with, and the choices you have. If anything is unclear, email [email protected].
- Who we are
- Merchants vs. shoppers
- What we collect
- How we use it
- AI processing
- Who we share it with
- Retention
- Your rights
- Security
- Children
- Changes
- Contact
1. Who we are
Dotreply ("Dotreply", "we", "us") operates the website dotreply.ai, the Dotreply Shopify app and the related messaging service (together, the "Service"). You can reach us at [email protected].
2. Merchants and shoppers
We handle two kinds of people differently:
- Merchants are businesses that install Dotreply on their Shopify store, and the people who use the Dotreply dashboard on their behalf. For merchant account data, Dotreply is the data controller.
- Shoppers are a merchant's customers who receive or send messages through the Service. For shopper data, the merchant is the data controller and Dotreply is a data processor acting on the merchant's instructions under our Terms of Service. Shoppers should also read the privacy policy of the store they purchased from.
3. What we collect
From merchants
- Account details — name, work email, store name and Shopify store domain, and the information you give us when you request a demo or contact us.
- Store configuration — the products, collections, shipping, returns and brand information you share so the agent can answer questions accurately ("Agent knowledge"), and your settings such as tone of voice, sending windows and opt-out keywords.
- Billing details — handled through Shopify Billing. We do not store card numbers.
- Usage data — log data, device and browser information, and how you use the dashboard, collected through standard server logs and privacy-respecting analytics.
From shoppers, on behalf of merchants
- Contact details — name and mobile phone number, received from the merchant's Shopify store when a shopper leaves a checkout or places an order and has provided a phone number for communications.
- Cart and order details — items, prices, checkout URL, order status, shipping method and delivery information relevant to the conversation.
- Messages — the content of messages sent and received through the Service, timestamps, and delivery status.
- Conversation outcomes — for example whether a cart was recovered, used to report results to the merchant.
We do not collect payment card numbers, government identifiers, or precise location from shoppers, and we ask the agent not to request them.
4. How we use information
- To send and answer messages on a merchant's behalf, including recovering abandoned carts and handling post-purchase questions.
- To operate, secure, troubleshoot and improve the Service.
- To show merchants reporting about their own conversations (recovered revenue, recovered carts, conversation counts).
- To honor opt-out requests and apply sending limits.
- To communicate with merchants about their account, the Service and, with consent where required, product updates.
- To comply with law and enforce our terms.
Where the GDPR or UK GDPR applies, our legal bases are performance of a contract (providing the Service to merchants), legitimate interests (securing and improving the Service, communicating with business customers) and consent where we ask for it. Merchants are responsible for ensuring they have a lawful basis to message their shoppers.
5. AI processing
Replies to shoppers are generated by large language models using the conversation, the shopper's cart or order context and the merchant's Agent knowledge. We currently use Anthropic's Claude models through their API. Under our agreement with Anthropic, API inputs and outputs are not used to train their models. The agent is instructed to answer only from merchant-provided information, to say when it doesn't know, and to hand the conversation to the merchant's team when needed. Merchants can review conversations in their dashboard.
6. Who we share information with
We share personal data only with providers that help us run the Service, under contracts that restrict how they may use it:
- Shopify — the merchant's store platform, which is the source of shopper, cart and order data and the destination for checkout links.
- Messaging delivery providers — the infrastructure we use to send and receive iMessage and SMS messages (currently Sendblue). They receive phone numbers and message content in order to deliver messages.
- AI providers — Anthropic, as described above.
- Cloud hosting — Amazon Web Services, where the Service and its data are hosted in the United States.
- Email and support tools — used to communicate with merchants.
We may also disclose information when required by law, to protect the rights and safety of Dotreply, our merchants or others, or as part of a merger, acquisition or sale of assets (in which case this policy will continue to apply to the transferred data). We do not sell personal data and do not share it with third parties for their own marketing.
7. Retention
We keep merchant account data for as long as the merchant's account is active and for a reasonable period afterwards to resolve disputes and meet legal obligations. Shopper messages and conversation data are retained for as long as the merchant uses the Service, and are deleted or anonymised within 30 days of a merchant uninstalling the app, unless a longer period is required by law. Opt-out records are kept so we can continue to honor them. Shopify data-erasure requests received through the app are processed within the timeframe Shopify requires.
8. Your rights and choices
- Shoppers: reply STOP (or any clear request to stop) to any message and you will not be contacted again by that merchant through Dotreply. To access, correct or delete your data, contact the merchant you purchased from, or email us and we will forward your request to the relevant merchant and assist them.
- Merchants: you can view and update your account and Agent knowledge in the dashboard, and request export or deletion of your data by emailing us. Uninstalling the app triggers deletion as described above.
- Depending on where you live, you may have rights to access, correct, delete, restrict or port your personal data, to object to processing, and to lodge a complaint with a supervisory authority. We will not discriminate against you for exercising these rights.
Dotreply operates globally and data may be processed in the United States and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses for international transfers.
9. Security
We use encryption in transit and at rest, access controls, secrets management and logging, and we restrict access to personal data to people who need it to operate the Service. No system is perfectly secure; if we become aware of a breach affecting your data we will notify affected merchants and authorities as required by law.
10. Children
The Service is intended for businesses and their adult customers. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. We will post the new version here with a new effective date and, for material changes, notify merchants by email or in the dashboard.
12. Contact
Questions, requests or complaints: [email protected].