Privacy Policy

Scope of this Policy

This policy applies to data collected through:

• useao.ai — the Hub: marketing site, documentation, merchant dashboard, and buyer account portal.
• The Shopify embedded app — installed in Shopify Admin via the Shopify App Store.
• The merchant MCP endpoint (/mcp) — used by AI agents (Claude, ChatGPT) to query and manage merchant catalog, orders, team, and fulfillment data.
• The buyer MCP endpoint (/mcp/buyer) — used by AI agents to search products, generate quotes, and complete purchases on behalf of authenticated buyers.
• A merchant's own domain — where a merchant has claimed one: the shop's buyer chat, and the shop's own connector for AI agents (/mcp/buyer on that domain).
• The BDM MCP endpoint (/mcp/bdm) — used by authorised business development managers to provision and manage merchant accounts.
• The Theme App Extension — injects JSON-LD into merchant storefronts; collects no data itself.

What We Collect

Merchant account data

• Shopify shop domain (e.g. yourstore.myshopify.com) — required for app authentication.
• Shopify access token — stored encrypted in Firebase Firestore, scoped to read/write products and metafields only.
• Merchant profile — trading name, brand, and ship-from address used for Shippo label generation.
• Stripe Connect account ID — stored to enable payment processing for AO-native orders. AO stores no card numbers.
• Shippo OAuth token — stored to enable shipping label generation and rate fetching.
• App installation and uninstallation timestamps.
• Team member data — display name, email address (masked in MCP responses), and role for invited team members.

Product catalog data

• Product titles, descriptions, handles, images, prices, and variant data — fetched from Shopify or ingested directly for AO-native merchants.
• Audit scores and gap analysis results — stored in Firestore under your shop domain.
• AI-enriched attributes — suggested by an AI model, reviewed by the merchant before being written to Shopify metafields or the AO catalog.
• GTIN / barcode data — read from Shopify, written back to variant.barcode and standard facts metafields.

Buyer account data

• Sign-in — email address and name from a Google or password sign-in, used for account authentication and order notifications.
• Profile — name, phone number and default shipping address, if the buyer provides them.
• Saved preferences — what a buyer tells an AI assistant they need from a shop (for example a vehicle and how it is used), kept separately for each shop. Only the buyer can see them: the shop does not.
• Saved card record — when a buyer saves a card with a shop, AO stores the card brand, last four digits, expiry date and Stripe's identifiers for the customer and payment method. The card itself is held by Stripe on the shop's own Stripe account.
• Assistant connections — which AI assistants a buyer connected and the access each holds.
• Activity records — when an assistant searched or asked for a quote for the buyer, what it searched for, how many results it found, and which assistant it was.
• Shipping address — collected at checkout and stored with the order for fulfillment.
• Order history — purchase records including line items, amounts, fulfillment status, and tracking numbers, stored in Firestore.
• Messages with a shop about an order.
• Wholesale relationship data — payment terms, discount entitlements, and tax-exempt status granted by specific merchants.

Order and transaction data

• Order records — line items, shipping address, payment status, fulfillment status, tracking numbers, and Stripe charge IDs.
• Shippo shipment and transaction records — carrier, rate, label URL, and tracking data for fulfilled orders.
• Refund and cancellation records — Stripe refund IDs and status for cancelled orders.

MCP telemetry

• Tool call logs — tool name, sanitised arguments, response shape, duration, session ID, and the identifier of the account that made the call, stored in the mcp_telemetry Firestore collection.
• AI agent identity — user-agent string (e.g. Claude-User, ChatGPT) logged per request for platform analytics.
• Telemetry is used to improve tool reliability, detect errors, and inform model fine-tuning. It is not shared with third parties.

Usage and analytics

• Audit run counts per month — used to enforce usage limits on free and paid plans.
• Aggregated, anonymised performance metrics (audit duration, enrichment latency) — used to improve the service.

What we do NOT collect

• Payment card numbers or CVVs — handled entirely by Stripe.
• Shopper browsing data or cookies for advertising or cross-site tracking.
• Data from stores or buyers where AO is not installed or authenticated.
• Biometric or sensitive personal data of any kind.

How We Use Your Data

• To run catalog audits and generate AI Readiness scores for merchant products.
• To send product attributes and merchant-provided text to our AI provider (Anthropic) for enrichment, drafting and previews — see the Third Parties section.
• To process buyer purchases — generating quotes, charging payment methods via Stripe, creating shipping labels via Shippo, and recording order data.
• To remember what a buyer tells an assistant they need from a shop, for that shop only, and to show it back to the buyer so that they can change or forget it.
• To provide merchant order management — fulfillment status, packing slips, tracking, and refund processing.
• To inject and maintain JSON-LD structured data via the Shopify theme extension.
• To enforce plan limits and manage billing via Shopify Billing API.
• To log MCP tool calls for reliability monitoring and service improvement.
• To respond to support requests submitted via email.

We do not use your data for advertising, do not share it with third-party marketers, and do not use it to train AI models without your explicit consent.

Third-Party Services

Data Security & Storage

• All data in transit is encrypted using TLS 1.3.
• Firestore data is encrypted at rest using AES-256 (Google Cloud default).
• Shopify access tokens are stored encrypted and scoped to the minimum required API permissions.
• Stripe Connect account IDs and Shippo OAuth tokens are stored in Firestore with role-based access control.
• MCP Bearer tokens are single-use or time-limited (24-hour expiry) and stored in Firestore.
• When a buyer deletes their account, their sign-in session and every AI assistant's access end at once, and a token issued earlier is refused.
• Access to Firestore is restricted to Firebase service accounts with role-based access control.
• The Shopify app complies with Shopify's mandatory compliance webhooks: customers/data_request, customers/redact, shop/redact.
• MCP tool arguments containing email addresses are sanitised (masked) before being written to telemetry logs.

Data Retention & Deletion

Active merchant accounts

Product catalog data and audit results are retained for as long as the app is installed. Audit results older than 90 days may be purged automatically to manage storage costs.

Active buyer accounts

Buyer account data, saved preferences, order history, and wholesale relationship data are retained for as long as the account is active. Buyers can see and forget what their assistant remembers for each shop, remove a saved card, and delete their account in Settings.

Deleting a buyer account

A buyer can delete their account in Settings at any time. The buyer is signed out straight away, and other browsers and devices are signed out within about a minute.

Deleted

• The saved card and customer record on each shop's Stripe account — the card is detached and the customer is deleted there.
• Saved preferences for every shop.
• Every AI assistant's access to the account, including connections made in Claude or ChatGPT.
• The profile, shipping address, spending limits and sign-in.
• Any checkout session that was still open.

Anonymised — the record stays, and the buyer's identity and anything they typed are removed

• The log of assistant sessions and searches — the account identifier, the words searched for, and any copy of saved preferences.
• The traffic log — the account identifier.
• Records of cancelled or expired quotes — the account identifier and the assistant's free-text notes.
• The log of tool calls — the account identifier, and the arguments and results of the calls.

Kept

• Orders — the items, shipping and payment records, and messages with the shop about them — for as long as tax, accounting and dispute rules require.
• A shop's own copy of an order is not changed, and orders are not cancelled by deleting an account.

Each shop is told that a buyer closed their account and that the card and customer record were removed. The notice does not name the buyer.

If a step cannot be completed — for example because Stripe is unavailable — the deletion stops, the buyer is shown a message, and nothing further is removed. Steps that already finished stay finished, and a new attempt carries on from there.

Orders, disputes and tax

Each shop is the merchant of record for what a buyer buys from it. A card network usually lets a cardholder dispute a charge for up to about 120 days, and sometimes longer, depending on the network and the reason. Deleting an account therefore does not cancel or void a dispute or refund on a past order, and shops keep their order records for as long as tax, accounting and dispute rules require.

MCP telemetry

Tool call logs are retained for up to 12 months for reliability monitoring and model improvement purposes, then purged automatically.

App uninstallation

When the Shopify app is uninstalled, a app/uninstalled webhook fires. The shop's access token is immediately invalidated and deleted from Firestore. Catalog data and audit results are deleted within 30 days.

Shopify compliance webhooks

• customers/data_request — we return no personal shopper data collected via Shopify (none is stored via the Shopify channel).
• customers/redact — acknowledged; no Shopify-sourced shopper data to redact.
• shop/redact — all shop data deleted within 30 days of receiving this webhook.

Your Rights

As a merchant or buyer using this service, you have the following rights:

• Access: Request a copy of the data we hold for your account or shop.
• Correction: Request corrections to inaccurate data.
• Deletion: Buyers can delete their account themselves in Settings at any time (see Deleting a buyer account above). Merchants: uninstalling the app triggers automatic deletion per the schedule above. Buyers and merchants may also contact us for deletion.
• Control: See what your assistant remembers about you for each shop, and forget any of it, in Settings.
• Portability: Request your order history, audit results, and enriched attributes in machine-readable format (JSON).
• Objection: Object to any processing beyond what is strictly necessary to provide the service.

To exercise any of these rights, contact us at hello@fivedollarworkday.com. We will respond within 30 days.

Changes to this Policy

We may update this policy as the platform evolves. Material changes will be communicated via the app dashboard. Continued use of the service after the effective date constitutes acceptance of the revised policy.