Privacy policy

NimiBot is an AI shopping assistant for Shopify stores, operated by Premium Holdings LTD (Yael Man 1, Ramat HaSharon, Israel) ("NimiBot", "we", "us"). This policy explains what data we process when a merchant installs NimiBot and when shoppers use it on a merchant's store. It is written to comply with the Israeli Privacy Protection Law, 5741-1981, and the regulations under it, including the Privacy Protection (Data Security) Regulations, 5777-2017.

Our role

For shopper data, the merchant (the store) decides why and how the data is used, and NimiBot processes it only on the merchant's behalf and instructions. For merchant account data (the store owner and team members), NimiBot is responsible for the data. Merchants are responsible for telling their shoppers that the store uses an AI assistant and for covering it in their own privacy policy.

Data we collect

• Store data from Shopify: store name and domain, products, collections, prices, inventory, discounts, store policies and pages, so the assistant can answer from the real catalog.
• Conversations: messages shoppers send to the assistant and its replies, the page they were on, their language and approximate country (from the request; we do not store IP addresses).
• Voice and camera (optional): when a shopper starts voice chat, their audio is streamed to our AI provider to produce a reply; when they use virtual try-on, the image or camera feed they choose is sent to our try-on provider. We do not keep recordings or images after the session.
• Cart activity: products added or removed through the assistant, so merchants can see which conversations led to sales.
• Orders (optional): if the merchant grants the permission, the assistant can look up an order's status for a shopper who is logged in, or who gives both the order number and the email on it. Orders are read live from Shopify for that request and are not stored by NimiBot. We show only the order's status, items, tracking and city and country, never the full address or payment details.
• Contact details for handoff: if a shopper asks for a person and leaves an email, it is shared with that store's team.
• NimiBot accounts: for the store owner, the name and email Shopify provides when the app is installed; for team members, the names, emails or phone numbers the merchant invites. If you sign in with Google or Shopify, we receive your name, verified email and an account identifier from them (never your password). We also keep sign-in records, profile photos you upload, and whether you agreed to product news.
• Analytics: storefront events (for example, product viewed or added to cart), only when the shopper has allowed analytics under Shopify's customer privacy settings.

Shoppers are not required by law to give us any information. Without it, some features (such as order lookups or handing off to a person) will not work.

How we use data

• To answer shoppers, recommend products from the store, and add items to the cart only when a shopper explicitly asks.
• To let the store's team see and reply to conversations handed over to a person.
• To show merchants usage and results, and to bill according to their plan.
• To keep the service secure, prevent abuse, and fix problems.
• To contact merchants and team members about their account, the service and changes to it. We send product news and tips only to people who opted in, and every such email has a way to unsubscribe.

We do not sell personal data, do not use shopper data for advertising, and do not use one store's data to serve another store. Shopper conversations are not used to train AI models; our AI providers are used under terms that exclude training on API data.

Service providers and transfers abroad

Some providers are outside Israel. Data is transferred abroad in line with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, and, for data from the EU/EEA, the providers' Standard Contractual Clauses or equivalent safeguards. Each provider is bound to use the data only to provide its service to us.

Business transfers

If NimiBot is involved in a merger, acquisition, financing, reorganization or sale of all or part of its business or assets, data we hold, including NimiBot accounts, may be transferred to the buyer or successor as part of that transaction. The successor must keep using the data under this policy or give notice of any change.

Retention

Conversations are deleted automatically after 90 days by default; merchants can shorten this. Store catalog data is kept while the app is installed. When a merchant uninstalls NimiBot, Shopify sends us a deletion request and we delete that store's data within 48 hours of receiving it, except records we must keep for billing, tax or legal reasons. A person's NimiBot account (name, email, sign-in records and news preference) is separate from a store's data: it is kept after an uninstall, so you can sign back in or connect another store, until you ask us to delete it.

Security

Data is encrypted in transit (HTTPS) and at rest. API keys and secrets are stored encrypted. Every store's data is kept separate, and team members can only see the store they belong to. Requests from Shopify are verified with Shopify's signatures. Access to production data is limited to the people who need it to run the service. No system is completely secure, and we cannot guarantee that data will never be accessed without permission; if a serious security incident affects your data, we will notify you and the authorities as the law requires. Our security and incident response policy explains what we do if something goes wrong.

Your rights

Under Israeli law you may ask to see the personal data held about you (section 13 of the Privacy Protection Law) and to have it corrected or deleted if it is wrong, incomplete, unclear or out of date (section 14). Shoppers should first contact the store they shopped with, which forwards the request to us through Shopify; you can also write to us at support@nimibot.com. Depending on where you live (for example under the GDPR or CCPA), you may have further rights to delete, restrict or port your data. You may also complain to the Israeli Privacy Protection Authority or your local data protection authority.

Children

NimiBot is not directed at children under 16 and we do not knowingly collect their data.

Changes

We may update this policy. We will post the new version on this page and change the date above; material changes are announced to merchants in the app.

Contact

Premium Holdings LTD, Yael Man 1, Ramat HaSharon, Israel. Email support@nimibot.com.