Shopify app privacy

How Zens AI handles Shopify storefront data

Last updated: September 23, 2026

This notice applies to the Zens AI Shopify app and supplements the general Zens AI Privacy Policy. Contact hello@zens.ai with a privacy request or question.

Shopify permissions

The first release requests no Shopify Admin API scopes for customers, orders, discounts, product administration, or theme files. The embedded setup page uses an online Shopify session to verify the current shop, create its own Zens support site, save that site’s public identifier on this app installation, and check theme-extension activation. Shopify authenticates these requests through App Bridge; Zens does not store an Admin API access token. Zens stores the Shopify shop ID and domain to keep each store’s site and subscription separate. The app does not copy Shopify customer or order records.

Storefront context the app can send

When a merchant opens the app and enables the app embed, the extension loads the Zens browser SDK. The Site ID is stored in the app installation's private app-data metafield and can be read by the app's theme extension. The SDK can receive the public page URL and title, referrer, browser language, anonymous visitor and session identifiers, chat messages, and attachments. This Shopify embed does not prompt visitors to register or leave an email for follow-up. If public product context is enabled, the extension also sends the current Shopify template, store domain, product or collection title and handle, vendor, public price, availability, and cart item count.

The extension does not send the logged-in Shopify customer object. Public Liquid context is used to make a conversation relevant to the page a shopper is viewing, not to build a hidden customer profile. Session recording is disabled for this Shopify app.

Use, security, and retention

Zens uses the data to provide AI customer support, conversation history, product-context troubleshooting, and service security. Zens does not sell Shopify data, use it for targeted advertising, or use Shopify integration data to train general AI models. Data is retained while the app is installed according to the merchant’s plan, configuration, and applicable law. On app uninstall or a verified Shopify shop-redact request, Zens deletes the linked support site and its conversations, subject to legal retention duties.

Merchants can read their store’s chat messages and uploaded attachments in the embedded Shopify app. Access requires a valid Shopify session token and is limited to the store’s own support site.

The Site ID is a public widget identifier. It is validated against the store origin by Zens. Shopify compliance requests are accepted only after HMAC verification with the app secret. The app secret and any Zens signing secret remain server-side and must never be pasted into the theme editor.

Merchant and visitor choices

Merchants can disable product context or the floating launcher in the theme editor. They can disable the app embed or uninstall the app to stop future collection. Uninstalling the app initiates deletion of the linked Zens site and conversations, subject to legal retention duties.

An authorized merchant can request access, export, correction, or deletion by emailing hello@zens.ai with the store domain. Visitors should contact the store first because the merchant is responsible for its storefront support data. Zens will assist the merchant with verified requests within applicable legal timelines.

Contact and support

Email hello@zens.ai for privacy questions. For installation help, open the Shopify app support page.