Shopify App Privacy Policy

Piko operates the Piko Shopify app, including its merchant interface in Shopify Admin and its shopping assistant on participating merchants’ storefronts. We are based in Rawalpindi, Pakistan.

This policy describes information handled through that Shopify integration. The merchant operates the store and is responsible for its products, orders, customer relationships, and its own privacy practices. Shopify provides the commerce platform and processes information under its own policies. Piko does not operate the merchant’s checkout or handle payment processing.

For questions about this policy, contact support@trypiko.app. The general Piko website and main shopping app are covered by our separate website Privacy Policy, linked below.

When a merchant installs or uses the app, we receive store information such as the Shopify store identifier, store name, domain, storefront address, timezone, and currency. We also keep installation status, app settings, subscription and plan status, billing-cycle information, usage counts, and synchronization records needed to operate the integration.

Shopify provides credentials that allow the app to access authorized store data. We store the authentication and session information necessary to maintain that access. Where Shopify supplies it for an authenticated staff session, this may include a staff identifier, name, email address, role-related information, and locale.

If you contact support, we receive the contact information, messages, and supporting material you choose to provide. Technical records may include request times, errors, browser or device information, and IP addresses handled by our authentication or infrastructure providers.

The storefront assistant can create a guest identity without requiring a shopper to provide a name or email address. We use a pseudonymous identifier and session credentials to associate requests with the correct store and restore conversations. A pseudonymous identifier is not the same as completely anonymous data.

We store messages sent to the assistant, its replies, shopping queries, product references and selections included in the conversation, and related timestamps and generation records. We also record shopping-session identifiers and activity needed to operate the assistant and measure its use.

Messages may contain personal information that a shopper chooses to type. Please avoid sending payment credentials, passwords, or other sensitive information to the assistant. We may process technical and security information needed to authenticate requests, diagnose errors, and prevent misuse.

Product details and cart interactions use Shopify’s storefront interfaces in the shopper’s browser. This includes product and variant information, quantities, availability, prices, and cart line information needed to show and update the cart. Checkout and payment remain with the merchant and Shopify.

To associate an order with assistance provided by Piko, the widget keeps a local record of confirmed cart contributions and can write a private shopping-session marker to the Shopify cart. Our attribution requests to Piko’s backend do not include the Shopify cart token.

To identify linked orders and keep their status current, the app reads limited order information through Shopify: order identifiers, creation and update times, custom attributes, financial and cancellation status, current totals, refunded amounts, and currency. We retain attributed order records with their shopping-session association for reporting and reconciliation.

The order-reconciliation query does not request customer names, email addresses, phone numbers, billing or shipping addresses, payment credentials, or order line items. That limit does not prevent a shopper from including personal information in a chat message or support request.

We use the information described above to provide and maintain the Shopify integration and respond to merchant and shopper requests.

• Authenticate merchants and guest shoppers, keep stores separate, and restore shopping conversations.
• Answer shopping questions, find and compare products, and support product selection and cart interactions.
• Measure assisted shopping sessions and linked order values for the merchant.
• Administer app plans, usage allowances, and Shopify-managed usage billing.
• Resolve support requests, diagnose failures, protect the service, prevent abuse, and meet applicable legal obligations.

Piko uses AI providers to generate assistant responses. Depending on the service configuration, these integrations include OpenAI, Groq, or models accessed through Amazon Bedrock. Relevant messages, conversation context, shopping queries, and product or tool results may be sent to the configured provider to answer a request. Processing and retention by that provider depend on the applicable service configuration and provider terms.

Shopify processes store, product, cart, checkout, subscription, and billing information as part of its platform services. Product searches and lookups can also use Shopify’s catalog services.

We use service providers for hosting, databases, authentication, workflow execution, and technical operations. These providers process information needed to deliver their services. The AI service used can change with our configuration. Contact us if you have questions about the provider used for a particular interaction.

The storefront widget uses browser storage for a store-specific returning-guest credential, appearance preferences, and cart-attribution state. Short-lived access tokens are held in memory. When persistent storage is unavailable, some state is kept only for the current page session, which can affect returning-guest continuity.

Shopify and the merchant may use their own cookies or similar technologies for the storefront, cart, authentication, and checkout. The embedded merchant app also uses authentication mechanisms provided by Shopify.

Clearing browser storage can remove the widget’s ability to recognize a returning guest or reconcile earlier local cart contributions. It does not itself delete conversations, attributed orders, or other records already held on our servers.

We do not sell your personal information. We share information with the service providers described in this policy as needed to operate Piko, with Shopify to support the integration and app billing, and where required by applicable law or necessary to address fraud, security, or legal claims.

For paid app usage, billing events sent to Shopify contain the store identifier, the configured usage event, its occurrence time, a stable event key, and a usage value. Those billing-event payloads do not contain shopper chat content or shopper contact information. Merchants receive assisted-session counts and linked-order summaries through the app.

Piko is based in Pakistan, and our providers may process or store information in the United States or other countries where they operate. Information may therefore be processed outside your country, including outside the European Economic Area or United Kingdom. Processing locations and applicable protections depend on the provider and service arrangement. Contact us for more information about how your information is processed.

We retain information for as long as needed to provide the service, maintain conversation continuity and attribution records, support billing and reconciliation, resolve disputes, protect security, and meet applicable legal obligations. Retention periods vary by the type of information, the service purpose, and the obligations that apply.

Uninstalling the app ends its authorized store access and prevents new assistant replies once the uninstall is processed. It does not mean that every historical conversation, usage record, attributed order, or billing record is immediately erased. Information retained after uninstall remains subject to applicable deletion requirements and any legal obligations that justify retention.

You can contact us about information that should no longer be retained. We consider verified requests in accordance with applicable requirements.

Depending on applicable law, you may have rights to request access, correction, deletion, or restriction of processing of personal information. Contact support@trypiko.app to ask about these rights or raise a privacy concern.

Merchants should identify the store and explain the request. Shoppers can contact the merchant about store or order information and contact Piko about information handled by the assistant. Please identify the store and provide enough context to help us locate the relevant interaction. Do not send passwords, access tokens, or payment-card details.

We may need to verify your identity and your relationship to the information before acting. Guest identifiers can make it difficult to locate a conversation if browser credentials have been lost. Requests are handled according to applicable requirements, including any exceptions or record-retention obligations.

The merchant’s privacy policy explains its handling of store visits, customer accounts, purchases, and checkout information. Shopify’s own policies apply to Shopify’s processing. Our general website Privacy Policy describes the separate main Piko website and shopping app, including their analytics and cookie practices; those descriptions should not be read as a statement that the storefront widget implements every main-app feature.

We may update this policy when the Shopify integration or our practices change. The effective date and version at the top identify the current document. Please review it periodically.

Privacy contact: support@trypiko.app. Location: Rawalpindi, Pakistan. You can also use the Contact page linked below.