ShopLead AI

Privacy Policy

Last updated: August 15, 2026

This policy explains how ShopLead AI, operated by XDRX Labs ("ShopLead AI", "we", "us"), processes information when a Shopify merchant installs the app or a shopper interacts with its storefront assistant.

Information we process

• Merchant information, including store domain, store name, contact email, installation status, subscription status, and app usage.
• Shopper information submitted through the assistant, including an email address, marketing consent choice, chat messages, and the product or page connected to the request.
• Storefront interaction data needed to provide contextual help, such as an app-generated visitor identifier, pages viewed, product context, visit count, and timestamps.
• Technical and security logs generated by our hosting providers, such as request timestamps, response status, and network metadata.

How we use information

We use information to operate the assistant, answer product questions, capture and attribute leads for the merchant, remember a shopper when permitted, enforce plan limits, secure and troubleshoot the service, and comply with legal obligations. We do not sell personal information.

Merchant and shopper roles

For shopper data collected on a merchant storefront, the merchant is generally the controller or business deciding why the information is collected, and ShopLead AI acts as its service provider or processor. Merchants are responsible for providing required notices and choosing lawful settings for their stores.

Service providers and international processing

We use Shopify to authenticate merchants and deliver the storefront extension, Google Cloud to host the application and database, and OpenAI to generate assistant responses. These providers may process data in countries other than the country where it was collected and protect it under their contractual and security commitments.

Retention and deletion

We keep information only as long as needed to provide the service, meet contractual obligations, resolve disputes, and maintain security. Shopify privacy webhooks are used to respond to customer data requests and deletion requests. Store data is deleted when Shopify sends the required shop-redaction request following uninstall. Limited records may be retained when required by law or for fraud and security.

Security

We use encrypted HTTPS connections, access controls, managed secret storage, database backups, and monitoring. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

Your choices and rights

Shoppers can decline optional marketing consent and can contact the merchant whose storefront collected their information. Merchants and shoppers may also contact us to request access, correction, deletion, or other rights available under applicable law. We may need to verify the request and coordinate with the relevant merchant.

Changes to this policy

We may update this policy as the service or legal requirements change. The date at the top identifies the latest version.