Security & Trust

How BOBBI protects merchant and shopper data in BOBBI Smart Store: EU hosting, GDPR compliance, access control and careful handling of store data.

BOBBI turns online stores into AI-powered Smart Stores. Merchants trust us with their catalog and their customers' shopping sessions — this page explains, in plain language, how we protect that data.

We never touch payment data

Every purchase made through a BOBBI Smart Store is completed in the store's native platform checkout (Shopify or SHOPLINE). Card numbers and payment credentials never pass through, and are never stored on, BOBBI systems. This keeps the strictest payment-security requirements (PCI DSS) where they belong: with the platform's certified checkout.

Data stays in the EU

Our servers and databases run on Hetzner Online GmbH infrastructure in Germany and Finland. Merchant data, store catalogs, and shopper interaction data are stored and processed inside the European Union. Where a sub-processor operates outside the EU (see below), transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.

Encryption & access control

• All traffic is encrypted with TLS (HTTPS everywhere, including custom storefront domains).
• Production access is restricted to key-based authentication; there are no shared passwords.
• Services run in isolated containers; published merchant storefronts are network-isolated per merchant.
• Webhooks are verified with platform HMAC signatures before processing.
• Session and handover tokens are cryptographically signed and short-lived.
• Secrets are kept in environment configuration, never in source code.

Minimal platform permissions

The BOBBI app requests read-only store scopes (products, inventory, content, analytics). We do not request write access to orders, customers, or payment settings, and we do not access protected customer data beyond what powers the shopping experience.

GDPR & data lifecycle

• BOBBI Oy (Finland) acts as data processor for shopper data on behalf of the merchant, and as controller for merchant account data.
• Platform data-erasure webhooks (customer redact and store redact) are implemented for both Shopify and SHOPLINE and honored automatically.
• When the app is uninstalled, associated personal data is deleted or anonymized within 30–90 days.
• We maintain a record of processing activities (GDPR art. 30) and a breach-notification process.

Full details are in our Privacy Policy .

Sub-processors

• Hetzner Online GmbH — cloud hosting (EU: Germany/Finland);
• Shopify and SHOPLINE — store platforms and APIs;
• AI model providers (xAI, OpenAI, Anthropic) — assistant responses and search embeddings;
• Cloudflare — network routing and SSL for published storefront domains;
• Clerk — merchant authentication;
• Analytics — self-hosted, privacy-conscious usage analytics (no third-party tracking).

Company scale, honestly

BOBBI Oy is an early-stage Finnish company. We do not yet hold a SOC 2 or ISO 27001 certification — at our size, we invest in the practices above rather than audit paperwork. As the company grows, formal certification is on our roadmap. If your organization needs a security questionnaire filled in or a data processing agreement signed, contact us and we will respond quickly.

Reporting a vulnerability

Found a security issue? Please email founder.chatbob@gmail.com with the details. We appreciate responsible disclosure and will acknowledge reports promptly.