Privacy Policy

Operating entity: JolHil. Governing jurisdiction: Finland. Published contact: admin@jolhil.com.

1. Who this policy covers, and in what role

JolHil ("we", "us") is an AI assistant that a Shopify merchant ("Merchant", "you" if you're the store owner) installs on their storefront so that their shoppers ("Shoppers", "you" if you're chatting with the widget) can ask product questions and get recommendations drawn from that store's own catalogue.

Two different relationships exist under this one policy:

• Merchant account data (sign-up details, store connection, billing, usage) — here we are the data controller, responsible for that data under GDPR.
• Shop catalogue and Shopper conversation data — here we are the data processor, acting only on the Merchant's instructions, while the Merchant remains the controller responsible to their own customers. If you are a Shopper with a question about how a specific store uses your data, the store itself is who you should contact first; we process it on their behalf.

2. What we collect

From the Merchant, to run their account:

• Sign-up details: name, email address, password (hashed, never stored in plain text).
• Shopify store domain and an OAuth-issued Admin API access token, used only to read product catalogue data and register the webhooks described below.
• Billing and subscription status, handled through Shopify's own Billing API — we never see or store card numbers; Shopify bills the subscription to the Merchant's existing Shopify invoice.
• Usage and cost metering (number of AI calls, tokens, and images generated per day), so the Merchant can see their own usage and so plan limits can be enforced.

From the Shopify store, to power recommendations:

• Product catalogue data (titles, descriptions, prices, images, inventory, tags) synced automatically whenever the Merchant's catalogue changes, via Shopify webhooks.
• We request the minimum Shopify access scopes needed for this (read_products, write_products) — we do not request access to the store's customer list, orders, or payment information.

From Shoppers, while they use the widget:

• The text of what a Shopper types into the widget, so we can generate and return a reply.
• A randomly generated session identifier, stored so a conversation can continue across page loads on the same store visit. No account or sign-in is required to use the widget.
• If a Shopper chooses to use the optional "see it with your photo" visual preview feature: the photo they upload, sent for the single purpose of generating one AI preview image, and not stored by us afterwards (see section 4).
• If the Merchant later exercises Shopify's mandatory data-subject webhooks on a Shopper's behalf (see section 7), we delete or disclose what we hold exactly as those webhooks require.

We do not collect Shopper names, payment details, or shipping addresses — the widget never asks for them, and a purchase itself always completes on the Merchant's own Shopify checkout, not with us.

3. Why we collect it, and on what legal basis

• To run the service the Merchant has signed up for, and that the Shopper is actively using in the moment: performance of a contract (GDPR Art. 6(1)(b)) for the Merchant, and the Merchant's own legitimate interest in offering the assistant to their Shoppers (GDPR Art. 6(1)(f)), which we process on their behalf.
• Billing and account administration: performance of the contract between us and the Merchant.
• Usage metering and rate limiting: our legitimate interest in keeping the AI service funded correctly and protecting it from abuse (GDPR Art. 6(1)(f)).
• The optional photo preview feature: the Shopper's own action of choosing to upload a photo is the basis for that single processing event — nothing is generated from a photo unless the Shopper deliberately provides one.

4. The photo preview feature, specifically

Because a photo of a person is more sensitive than ordinary browsing data, it gets its own section rather than being folded into the list above:

• Uploading a photo is always optional and initiated by the Shopper clicking "see it with your photo" — it is never required to use the assistant.
• The photo is sent, together with the product image, directly to our AI image-generation provider to produce one preview image, and is not written to our database or any persistent storage on our side.
• The resulting preview is always labelled "AI-generated preview — illustrative only, not a guarantee of fit, colour or accuracy."
• We do not use uploaded photos to train any AI model, ours or the underlying provider's, and we do not retain them after the single request completes. We cannot, however, independently verify the underlying model provider's own transient processing logs on their infrastructure beyond what their own terms commit to — see the honest-caveats note at the end of this document.

5. Cookies and session identifiers

The widget sets a minimal, first-party session identifier (cookie or local storage) solely to keep a Shopper's conversation working across page navigations on the same store. We do not use advertising cookies, third-party tracking or marketing pixels, and we do not combine this identifier with other sources to build a profile of the Shopper. Under EDPB guidance, strictly first-party, non-tracking identifiers used only to keep a service working do not require a cookie-consent banner; this is the reason the widget doesn't show one. If that ever changes — for example if advertising or cross-site tracking is added — a proper opt-in banner becomes required and will be added before that feature ships.

6. Who we share data with (sub-processors)

• Shopify — the e-commerce platform the Merchant's store runs on; we connect to it via OAuth to read catalogue data and register webhooks.
• Supabase — our database provider, hosting Merchant accounts, synced catalogue data, usage records, and billing state.
• Lovable — our application hosting provider, and the operator of the AI Gateway that routes our AI calls to underlying model providers (currently OpenAI for text recommendations, and Google for the photo preview feature) without us holding direct accounts with those providers ourselves.
• We do not sell Merchant or Shopper data, and we do not share it with data brokers or advertisers.

Where any of these providers process data outside the EU/EEA, appropriate safeguards (such as Standard Contractual Clauses) apply as required by GDPR Chapter V.

7. Mandatory Shopify compliance webhooks

As required by Shopify for every app with storefront access, we implement the three mandatory GDPR webhooks:

• customers/data_request — when a Shopper requests their data from the Merchant, we return what we hold tied to that Shopper's session.
• customers/redact — when a Shopper's data must be deleted, we erase what we hold tied to that Shopper.
• shop/redact — when a Merchant's store data must be deleted (for example, 48 hours after uninstalling the app, per Shopify's own timeline), we erase that store's catalogue, conversation, and account data from our systems.

8. Data retention

• Shopper conversation text and session identifiers are kept only as long as needed to run the conversation and for a limited window afterward for quality and abuse-prevention purposes, and in any case no longer than 13 months.
• Uploaded photos for the preview feature are not retained at all, per section 4.
• Merchant account, billing, and usage records are kept for the life of the account plus the period required for our own tax and accounting obligations, then deleted.
• Catalogue data is deleted on uninstall per the shop/redact webhook timeline above.

9. Your rights

Under GDPR, both Merchants and Shoppers have the right to: access the data held about them, request correction or deletion, restrict or object to processing, request a copy in a portable format, and withdraw consent where processing relies on it. Shoppers should generally start with the store they were shopping on, since the Merchant is the controller for that relationship; we fulfil the technical request through the webhooks in section 7. Merchants, or anyone with a direct question for us, can contact admin@jolhil.com. Everyone also has the right to lodge a complaint with their national data protection authority (in Finland, the Office of the Data Protection Ombudsman).

10. AI output is informational, not guaranteed

Product recommendations are generated from the Merchant's own catalogue and are meant to be a genuinely useful starting point, not a guarantee of price, availability, or fit. Visual previews are explicitly AI-generated illustrations, not a promise of how a product will actually look. The decision to purchase is always the Shopper's, made on the Merchant's own storefront.

11. Security

Each Merchant's data is isolated from every other Merchant's at the database level (row-level security), OAuth access tokens are never exposed to the browser, and all inbound webhooks are signature-verified before being processed. A fuller description of our security practices is available on request while a dedicated public security page is still being written.

12. Children's data

The widget is intended for use by a Merchant's general shopper base and is not knowingly directed at children. We do not knowingly collect data from children through the widget, and the optional photo feature should not be used by or for anyone under the age of consent for data processing in their jurisdiction.

13. Changes to this policy

We may update this policy as the product evolves. Material changes — for example, adding a new sub-processor, or adding tracking cookies — will be reflected here with an updated date at the top.

14. Contact

JolHil — admin@jolhil.com