SparkGPT Privacy Policy

Last updated: July 5, 2026

This Privacy Policy explains how SparkGPT ("SparkGPT", "we", "us", or "our"), operated by Zhen's Capital, collects, uses, shares, and protects information when a merchant installs and uses the SparkGPT app on their Shopify store, and when shoppers interact with the SparkGPT chat widget on a merchant's storefront. By installing or using SparkGPT, you agree to this Policy.

1. Who this Policy covers

• Merchants: Shopify store owners and staff who install and configure SparkGPT.
• Shoppers: visitors who chat with the SparkGPT agent on a merchant's storefront.

2. Information we collect

From merchants and their stores

• Account details such as your name, email address, and store domain.
• Store content used to train and operate your agent: products, prices, pages, and store policies, accessed through Shopify's read_products and read_content permissions.
• Order data accessed through Shopify's read_orders permission, used solely to attribute sales to conversations for usage-based billing.

From shoppers

• The messages a shopper sends to, and receives from, the agent.
• A first-party identifier stored in the shopper's browser (for example sg_vid) and the page URL, used to link a conversation to a later order for sales attribution.
• An email address only if a shopper voluntarily provides one in the conversation.

We do not intentionally collect special categories of personal data, and we ask merchants and shoppers not to share payment card numbers, passwords, or government identifiers in chat.

3. How we use information

• To create, train, and operate your AI sales agent so it can answer questions and recommend products.
• To keep the agent up to date as your catalog changes.
• To attribute orders to conversations so usage-based fees can be calculated and reported to Shopify.
• To provide the in-app dashboard, support merchants, prevent abuse, and improve the service.
• To meet legal, tax, and compliance obligations.

4. AI processing and subprocessors

SparkGPT generates responses using third-party large language model providers, which may include Anthropic and OpenAI. Conversation content needed to produce a reply is processed by these providers under their respective data protection terms. We send the minimum content required to generate a response and do not use identifiable shopper contact details for this purpose. We also rely on infrastructure and Shopify platform services to deliver the app.

5. How we share information

• Shopify: we report attributed usage events to Shopify so it can bill merchants under the app's pricing plan. We do not include shopper contact details in these events.
• Service providers: the AI, hosting, and infrastructure providers described above, acting on our behalf.
• Legal: when required by law, regulation, or valid legal process.

We do not sell personal information.

6. Data retention and deletion

• We retain merchant and conversation data for as long as the app is installed and as needed to provide the service.
• When a merchant uninstalls the app, we honor Shopify's mandatory compliance webhooks: customers/redact erases the personal data we hold for an identified shopper, and shop/redact deletes the store's data after uninstall.
• A merchant or shopper may also request deletion directly using the contact details below.

7. Protected customer data

SparkGPT accesses protected customer data (order information) only to attribute sales to conversations for billing. We apply the principle of data minimization, restrict access to authorized systems, encrypt credentials at rest, transmit data over secure connections, and retain this data only as long as needed for the purpose described. We comply with Shopify's Protected Customer Data requirements.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or restrict the processing of your personal information, and to object to certain processing (for example under the GDPR or the CCPA). To exercise these rights, contact us at the address below and we will respond as required by applicable law.

9. Security

We protect information using technical and organizational measures, including encryption of stored access tokens, transport encryption (HTTPS), and access controls. No method of transmission or storage is completely secure, but we work to protect your information and to notify affected parties of incidents where required.

10. International transfers

We may process and store information in countries other than the one in which it was collected. Where we transfer personal data across borders, we take steps to ensure it receives an adequate level of protection.

11. Children

SparkGPT is a business tool for merchants and is not directed to children. We do not knowingly collect personal information from children.

12. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, provide additional notice.

13. Contact us

For any question about this Policy or to exercise your privacy rights, contact us at contact@zhenscapital.com.