Privacy Policy

How BOBBI Oy (Espoo, Finland) collects, uses and protects personal data for BOBBI Smart Store and bobbi.live. BOBBI is hosted in the EU and built to be GDPR-compliant.

This Privacy Policy explains how BOBBI Oy ("BOBBI", "we", "us", or "our") collects, uses, shares, and protects information in connection with the BOBBI Smart Store application and related services (the "App") that we provide to merchants on supported e-commerce platforms, including Shopify and SHOPLINE.

By installing or using the App, you agree to the practices described in this policy. If you do not agree, please do not install or use the App.

1. Who we are

BOBBI Oy is the data controller for the personal data we process about merchants and the merchant's authorized users. For personal data relating to a merchant's customers (shoppers), BOBBI acts as a data processor on behalf of the merchant, who is the data controller.

You can contact us at any time at founder.chatbob@gmail.com .

2. Information we collect

a) Merchant & account data

When you install the App, we receive information from your e-commerce platform (e.g. Shopify or SHOPLINE) such as your store name, store domain, email address, and basic store configuration. We also store authentication tokens needed to access the platform's APIs (such as the Shopify Admin API) on your behalf.

b) Store & product data

To power the Smart Store experience, the App accesses store data through your platform's APIs (Shopify, SHOPLINE), including products, collections, prices, inventory, and store content. We use this data to generate AI-driven product discovery and shopping guidance.

c) Shopper interaction data

When a shopper interacts with the BOBBI assistant on a merchant's storefront, we process the messages they send, the products they view, and related interaction events. This may include personal data the shopper chooses to provide in conversation. We do not intentionally collect payment card details.

d) Technical data

We automatically collect technical information such as IP address, browser type, device information, and usage logs for security, debugging, and analytics.

3. How we use information

To provide, operate, and maintain the App and its features;
To generate AI-powered product recommendations and shopping assistance;
To authenticate merchants and secure access to the service;
To improve, troubleshoot, and develop our products;
To communicate with merchants about the service;
To comply with legal obligations and prevent fraud or abuse.

4. AI processing

BOBBI uses third-party large language model providers to generate conversational responses. Relevant store data and shopper messages may be sent to these providers solely to produce a response. We do not permit these providers to use your data to train their general models, where such controls are available.

5. Sub-processors & sharing

We share data only as necessary to operate the service. Our sub-processors include:

Shopify and SHOPLINE — store platforms and APIs;
Hetzner Online GmbH — cloud hosting (EU, Germany/Finland);
AI model providers (xAI, OpenAI, Anthropic) — generating assistant responses and search embeddings;
Cloudflare — network routing and SSL for published storefront domains;
Clerk — merchant authentication;
Analytics providers — privacy-conscious usage analytics.

We do not sell personal data. We may disclose information if required by law or to protect our rights and the safety of users.

6. Data retention

We retain merchant and store data for as long as the App is installed and as needed to provide the service. When you uninstall the App, we delete or anonymize the associated personal data within a reasonable period (typically within 30–90 days), unless we are required to retain it to comply with legal obligations. Your platform (Shopify or SHOPLINE) may also send us a mandatory data-erasure request, which we honor.

7. Data security

We use industry-standard measures — including encryption in transit (HTTPS/TLS), access controls, and isolated infrastructure — to protect data against unauthorized access, loss, or misuse. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

8. International transfers

Our infrastructure is primarily located in the European Union. Where data is transferred outside the EU/EEA (for example to AI model providers), we rely on appropriate safeguards such as Standard Contractual Clauses.

9. Your rights (GDPR)

If you are in the EU/EEA, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. Shoppers should direct such requests to the merchant whose store they used; merchants and authorized users may contact us directly. To exercise your rights, email founder.chatbob@gmail.com . You also have the right to lodge a complaint with your local data protection authority.

10. Cookies

The BOBBI storefront assistant may use cookies or similar technologies to maintain session state and measure usage. Merchants are responsible for disclosing such use in their own cookie/privacy notices to shoppers.

11. Children's privacy

The App is not directed to children under 16, and we do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, where appropriate, notify merchants of material changes.

13. Contact us

BOBBI Oy Email: founder.chatbob@gmail.com