How ShopSifu Keeps Your Store Data Private

When you connect an AI to your store, you're handing it real customer and order data. You deserve to know exactly how that data is handled. Here is our approach, in plain terms.

Every merchant is isolated

Your store's data lives in its own isolated schema — not pooled into a shared bucket with other merchants. One store can never see another store's products, conversations, or customers. This isolation is structural, not a setting you have to remember to turn on.

Sensitive credentials are encrypted

Your Shopify access token is the key to your store, so we treat it like one:

• Encrypted with AES-256 at rest — never stored in plain text.
• Tokens refresh automatically and expire on Shopify's schedule.
• Decrypted only in memory, only when a request needs it.

Your data does not train third-party models

This is the one people care about most: we never use your store data to train external AI models. Your catalog, your customer conversations, your policies — they power your shopkeeper and nothing else.

Built for compliance

• An immutable audit log records data events for accountability.
• We support GDPR data export and deletion requests.
• Each merchant accepts a Data Processing Agreement before going live.

Why we lead with this

A shopping assistant lives or dies on trust — your shoppers' trust in you, and your trust in us. We'd rather over-explain our security than ask you to take it on faith.

Read the full detail on our Security and Privacy pages, or reach out with any questions.