Privacy Policy

1.Data controller

Saytu is a product of Bot and Life Co., Ltd. (company registration 0105547132674), 100 J.Press Tower A, Floor 12, Nanglinchee Rd., Chong Nonsee, Yannawa, Bangkok 10120, Thailand. It is the data controller for the processing described below. Privacy requests and questions go to info@botnlife.co.

2.What we process

Operating the assistant involves three kinds of data: the product catalog and store policies you connect, the text of visitor conversations with the character, and — only when order lookup is enabled — order-lookup inputs such as an order number or email needed to check order status.

3.Redaction before storage

Order-lookup inputs are passed through a redaction step before a conversation is ever written to the database. Messages produced this way are tagged as redacted at the point of storage, not redacted after the fact.

4.Contact identifiers

We don't store shopper email or phone numbers in plaintext. We store a one-way hash of the identifier (plus a short masked preview for support screens), which cannot be reversed back into the original email or phone number.

5.Retention

Contact identifiers expire automatically about 90 days after last activity, after which a scheduled job anonymizes them. Live chat session records have a 24-hour lifetime and are removed automatically after that. Conversation transcripts otherwise remain until deleted through a merchant request or app uninstall.

6.Uninstalling the Shopify app

When a merchant uninstalls Saytu on Shopify, Shopify sends a shop/redact webhook roughly 48 hours later. On receiving it, we hard-delete everything tied to that shop: conversations, messages, contacts, knowledge sources, and the shop record itself.

7.Shopify customer GDPR webhooks

We honor Shopify's mandatory customer privacy webhooks: customers/redact (erase a specific customer's data on request) and customers/data_request (report what we hold about a customer).

8.Cookies and browser storage

Saytu uses no advertising cookies and no third-party analytics. What it keeps in a browser, and why:

• saytu.ai sets no cookies of its own. We measure visits on our own server: the pages you view, time on each page, how far you scroll and which sections you reach, and clicks on the sign-up, demo, and Shopify App Store buttons. Each record also notes where the visit came from (the referring site and campaign tags), a country inferred from your browser's time zone, your browser language, device type, browser, and operating system. Records are linked by a random visit ID in your tab's session storage, replaced after 30 idle minutes, and by a code made by hashing your IP address and browser details with the date and a secret key, so it changes every day. Your IP address and full browser details are never stored, and records are deleted after 180 days.
• A campaign tag in the link you arrived by (such as ref or utm_source), and the plan you pick on the pricing page, stay in session storage until you close the tab. The tag is added to links to our Shopify App Store listing and sent with a demo request or booking. “Don’t count me” on the site's cookie notice turns off the measuring and the campaign tag for your browser; your answer to the notice is kept in local storage.
• The Product Hunt badge in the site footer is an image served by producthunt.com, whose network provider, Cloudflare, may set a short-lived bot-protection cookie (__cf_bm) on that domain.
• The Saytu app on the web uses Clerk's sign-in cookies and one cookie of ours that remembers whether the Studio sidebar is collapsed. Interface settings, setup progress, and the help chat's conversation ID are kept in your browser's local storage. Inside Shopify, a session cookie connects the app to your shop.
• On a store, the chat widget keeps a random conversation ID in the shopper's browser for about 30 days so one conversation carries across visits. Each store's widget has its own ID, and we don't use it to follow shoppers between stores. The widget also remembers the shopper's choices (sound off, chat-only view) and the prompts they have closed. When the store runs proactive prompts, it remembers when a prompt may show again and, for returning-visitor prompts, whether this browser has visited before.

9.Subprocessors

We use the following service providers to operate Saytu. Conversation content is sent to the AI, speech-to-text, and text-to-speech providers below solely to produce a reply — it is not used to train their public models.

• OpenAI and/or OpenRouter — generating chat replies
• Groq — speech-to-text
• Cartesia — text-to-speech
• AWS S3 — asset and uploaded character model storage
• MongoDB Atlas — database
• Shopify — billing for Shopify installs
• Stripe — billing for web installs
• Clerk — authentication for web installs

10.International transfer

Most of the subprocessors above are US-hosted. Using Saytu means conversation and account data may be transferred to, and processed in, the United States and other countries outside Thailand.

11.Your choices

Merchants can request anonymization or deletion of their shop's data from Settings or by contacting info@botnlife.co. Shoppers who want their data deleted or reported on should ask the merchant's store to submit that request — see the Shopify customer GDPR webhooks above for how that's handled.

12.Changes to this policy

We may update this policy as the product changes. The date at the top of this page reflects the last update.

13.Contact

Privacy questions can be sent to info@botnlife.co.