Privacy policy

1. Operator and business responsibilities

AutoBot is operated by John Gordon Hilley. For account, service, or privacy questions, use the contact details on this page. Businesses use AutoBot to communicate with their own customers. Each business decides what information it supplies, which channels it connects, and how it uses the conversations in its workspace.

If you contacted a business through AutoBot, that business’s privacy notice also applies. Contact that business first about its products, services, customer records, or communications. AutoBot’s operator can help route or handle a verified request concerning the service.

2. Information the service handles

• Accounts and teams: account email, authentication and session records, workspace memberships, roles, and invitation information.
• Business configuration: business and assistant names, website and mailbox details, channel settings, allowed widget origins, assistant instructions, modes, and usage limits.
• Customer conversations: message text, names or email addresses provided by customers, chat capabilities, email headers needed for delivery and threading, attachments, and conversation status and assignment.
• Business content: FAQs, policies, product or service information, approved document content, and source references. Drafts are stored for the team but are not included as published AI knowledge.
• Staff work: public replies, private notes, summaries, action approvals and results, privacy-request records, and delivery status.
• Connected services: platform account identifiers, permission information, server-held credentials, and the catalog or order information needed for enabled features.
• Operation and security: request and error information, queued-job state, rate-limit records, AI model and token usage, and estimated usage costs.

The original embedded Shopify app also stores its catalog snapshots, storefront conversations, and optional customer email captures separately from standalone workspaces.

3. Why information is processed

Information is used to authenticate accounts, enforce workspace permissions, receive and deliver customer messages, generate requested AI responses, show source references, support staff handoff, carry out authorized integration actions, investigate failures, prevent abuse, and respond to verified data requests. Contact details supplied for a customer request are not permission for unrelated marketing.

4. AI processing

When a business tests or enables AI, AutoBot sends a bounded part of the conversation, relevant published business knowledge, assistant instructions, and permitted tool results to its configured AI service. Catalog or verified order information may be included when needed for an enabled integration. Private staff notes and unpublished knowledge are excluded from the assistant’s response context.

AutoBot stores the resulting response, selected source references, and operational usage records. AI output can be inaccurate; businesses should review answers and configure human handoff. The model provider and its applicable service terms govern its own processing. This policy does not make an independent promise about every provider’s retention or model-training practices.

5. Service providers and sharing

The preserved Shopify storefront service may also use Upstash for short-lived rate-limit records. The standalone chat service uses database-backed request limits. Information is visible to authorized members of the relevant business workspace and is transmitted to customers when a public reply is sent. It may also be disclosed when required by law, to address a security incident, or at the authorized business’s direction.

6. Cookies and browser storage

Account cookies maintain login sessions and authentication flows. The website widget uses browser storage for the conversation identifier and capability needed to continue that conversation. These mechanisms support account security and conversation continuity. A business may operate other cookies or analytics on its own website; its notice should explain those separately.

7. Retention, export, and deletion

Standalone workspace information is retained for the service while the workspace is in use, subject to the business’s configured retention and verified deletion requests. There is no blanket 30-day deletion rule for all standalone customer messages.

Where a workspace owner enables automatic conversation retention, the selected period applies to eligible resolved conversations and their related records and attachments. Open or pending conversations are not automatically removed by that rule. Enabling retention does not retroactively delete conversations resolved before the policy was enabled. Disabling or changing the policy stops deletions not yet claimed; deletion already started finishes under its original policy. An attachment deletion failure can delay removal until it is retried or reviewed.

Workspace closure, customer export, and deletion requests are verified before processing. Removing a widget, stopping email forwarding, or uninstalling Shopify does not itself delete an independent AutoBot workspace. The original Shopify app has its own maintenance and platform privacy-event processing; those limits do not determine standalone workspace retention.

Messages already delivered to a recipient’s mailbox, provider delivery histories, security or audit records, and copies in backups are separate from active conversation records. They may remain under the recipient’s or provider’s retention practices, or where needed to address an unresolved request, security incident, or legal obligation. A database backup does not itself include the private attachment files; recovery procedures must account for both.

8. Security and access

AutoBot uses HTTPS, verified account identities, workspace-authorized server APIs, private attachment storage, bounded request limits, and server-held integration credentials. Order ownership and action rules are checked separately from an incoming message’s sender address. These controls reduce risk but do not eliminate it. Do not submit credentials, full payment-card details, government identifiers, health records, or other highly sensitive information to a customer conversation.

9. Choices and requests

Businesses can manage team access, published knowledge, automatic replies, and connected channels. A customer can contact the business they spoke with to request access, correction, export, or deletion of their information. Applicable rights depend on the person’s location and the circumstances. The operator may request enough information to verify authority and locate the relevant records without collecting unnecessary information.

For AutoBot account or service privacy requests, email support@figaroclothing.com. Include the business/workspace name and a concise description. Do not email passwords, access tokens, or an entire unredacted conversation.

10. International processing, children, and updates

Providers may process information in countries other than where a business or customer is located. Businesses should consider their obligations before enabling channels or integrations. AutoBot is a business tool and is not designed for use by children. Updates to this policy will appear with a revised effective date; material changes will be communicated through an appropriate service or account channel.

For help using the service, visit Support. The Terms of Service describe business responsibilities and the current pilot.