Privacy Policy

Last updated: Oct 28, 2026

This policy explains what personal data StyleAI processes, why, for how long, and who helps us process it. It covers:

• the StyleAI assistant that stores place on their website: the chat, the product answers box on product pages, and the search box;
• the StyleAI app for Shopify;
• StyleAI Manager, where our team and our customers' teams set up their assistant;
• our website, styleai.me.

1. Who we are

StyleAI is operated by StyleAI B.V., a private limited company with its statutory seat in Amsterdam, registered with the Dutch Chamber of Commerce (KVK) under number 96804661.

Questions about this policy or your data: contact@styleai.me

2. Our two roles

For shoppers, we process data on behalf of the store. When you use StyleAI on a store's website, the store decides why and how your data is used. It is the controller and we are its processor. We use that data only to provide the store's assistant and as the store instructs. The data processing terms between us and each store are part of our Terms and Conditions (styleai.me/terms). If you are a shopper, the store's own privacy policy applies too, and the store is the first place to send a request about your data (see section 9).

For our own website, our customers' accounts and Manager users, we are the controller.

3. Shopper data we process for stores

We process only what the assistant needs to answer.

• Chat messages. What you type to the assistant (up to 1,000 characters per message) and the answers it gives you.
• Product questions. When you ask about a product, we keep the question (up to 500 characters), the answer you were shown, the product it was about and the topic it fell under. This lets the store see which questions its product pages leave open.
• Search terms. What you type into the store's StyleAI search box, any filters you change, and which products were shown. A search term that several shoppers have used may be shown to other shoppers of the same store as a suggested search. Photo searches never are.
• Photos. If the store has turned on photo input and you send a photo, the photo goes to Google's Gemini API to be described in words. We keep only that description. We do not store the photo.
• Voice. If the store has turned on voice input and you speak a message, the audio goes to Google Cloud Speech-to-Text and the text comes back to your screen. We do not store the audio. If you then send the text, it is kept like any typed message.
• Language. The language the store's site declares and the language your messages are written in, so the assistant can answer in your language.
• The product page. When you start a conversation from a product page, which product it was.
• Usage statistics. If analytics is turned on for the store's assistant, we send Google Analytics a record of each step in a conversation (for example: a conversation started, a search run, a product added to the cart), tagged with the conversation's reference and the store. It never includes what you type or say, or your IP address.

We do not collect your name, email address, customer account, location or the contents of your shopping cart. Apart from the browser type in our hosting logs (below), we collect nothing about your device. The assistant creates no shopper identifier that follows you between visits or between stores.

Our hosting provider's request logs record the IP address and browser type (user agent) of every request to our servers. We use these logs only to run and secure the service and do not link them to conversations. They are deleted after 30 days.

In your browser. The assistant sets no cookies. It uses your browser's session storage to keep the conversation on screen while you browse the store: the conversation's reference, its messages (including a photo you sent), and the products shown. Session storage is cleared when you close the tab. The search box also keeps your last six search terms in your browser's local storage, so you can run them again. They stay until you clear your browser data, and they never leave your browser unless you run one again as a search. If a store has chosen its own web font for the assistant, your browser loads that font from the provider the store chose.

AI. The assistant's answers are written by an AI model from the store's product data and the store's own guidance. Its answers are suggestions only: the assistant makes no decision with legal or similarly significant effect. We do not use conversations to train AI models.

4. Data about stores and their teams

Stores that install StyleAI from Shopify

When a store installs the StyleAI app, we receive and keep:

• the store's Shopify domain and its Shopify identifier, the store's name and the address of its main website;
• the access tokens Shopify issues to our app, encrypted (AES-256-GCM), with their expiry dates, and the permissions the store granted;
• the store's StyleAI plan and billing status as Shopify reports it: plan, trial end, billing period and any cancellation;
• the store's products that are active and published on its online store, synced from Shopify: title, description, type, vendor, tags, category, options, images, variant names, prices and availability, Shopify's standard product metafields, and any other product metafields connected when the store's assistant is set up. We read nothing about the store's customers or orders.

We also write two settings into the store, which the assistant needs to load: the store's StyleAI assistant reference and the address of our script. Conversations that start on the store's pages are recorded with the store's Shopify domain.

When a store uninstalls the app, we delete the access tokens straight away. Shopify then sends us a deletion request 48 hours after the uninstall (Shopify's documentation). When it arrives:

• we delete our record of the store's installation, and the products we synced from that store;
• if the assistant was created by the install and no other store uses it, we delete the assistant together with all of its conversations, product questions and search records;
• if the store had connected the app to an assistant we had already set up for it under a separate agreement, we remove only the store's connection and the synced products. That assistant and its conversations stay, under that agreement;
• if the store has reinstalled the app before the request arrives, we delete nothing.

We keep a log of changes to an assistant's settings (who changed what, and when). Those entries are not part of the deletion.

Shopify's customer privacy requests. When a store's customer asks Shopify for their data, or asks for it to be deleted, Shopify forwards the request to us. We hold no data about Shopify customers, so there is nothing to export or delete. We log each request with the identifiers Shopify sends (the store's, the customer's and the order IDs). These logs are deleted after 30 days.

StyleAI Manager users

For people who sign in to StyleAI Manager, our team and our customers' teams, we keep each user's name, email address, Google account identifier, role, which assistants they can access, and when they last signed in. Sign-in is through Firebase Authentication (Google Cloud Identity Platform). We record the email address of whoever changes an assistant's settings or writes a product note.

Our website

On styleai.me we use Google Analytics only if you agree to it. When you email us, we keep the correspondence. When you book a call through our booking calendar, Calendly passes us your name, email address and any answers you give in the booking form, and we use them to hold and follow up on the call. Our website is served by Firebase Hosting (Google Cloud). To deliver its pages, Google processes your IP address and browser type; we do not keep logs of visits to styleai.me.

5. Why we use data, and our legal bases

• To provide the assistant to stores (section 3): on the store's instructions, under our agreement with the store.
• To report usage to the store (usage statistics, section 3): on the store's instructions, under our agreement with the store.
• To provide the Shopify app and Manager accounts (section 4): to perform our contract with the store.
• To run, secure and fix the service (request logs, records of each AI step's timing and outcome): our legitimate interest in a reliable and secure service.
• To answer questions sent to us: our legitimate interest in replying.
• To arrange calls you book with us (section 4): our legitimate interest in meeting the businesses that ask us for a demo.
• Website analytics: your consent, which you can withdraw at any time.

6. Who helps us process data (subprocessors)

Google processes data for us under its data processing terms: the Cloud Data Processing Addendum for Google Cloud services, the Data Processing Addendum for Products Where Google is a Data Processor for the paid Gemini API, and the Google Ads Data Processing Terms for Google Analytics. Under the Gemini API terms, Google does not use what paid services send it to improve its products. It logs prompts and responses for a limited period, for safety and legal reasons only.

We tell stores at least 30 days before we add or replace a subprocessor.

7. Transfers outside the European Economic Area

Our servers and database are in the EU (Belgium). The other Google services in section 6, including our logs, are not tied to a region and may process data in the United States or elsewhere.

For transfers to the United States, Google relies on the EU-U.S. Data Privacy Framework. Google LLC has certified to it, and to its UK Extension and the Swiss-U.S. Data Privacy Framework (Google's statement; the framework's participant list). Where that framework does not apply, Google's data processing terms provide the European Commission's Standard Contractual Clauses: Cloud Data Processing Addendum, Appendix 3; Data Processing Addendum for Products Where Google is a Data Processor, Appendix 3A.

Calendly, which we use for booking calls, is based in the United States. Calendly LLC has certified to the EU-U.S. Data Privacy Framework, and its data processing addendum provides the European Commission's Standard Contractual Clauses where the framework does not apply.

8. How long we keep data

9. Your rights

Under the GDPR and the UK GDPR you have the right to:

• ask for a copy of your data;
• have it corrected or deleted;
• restrict or object to its use;
• receive it in a portable format;
• withdraw consent at any time, where we rely on consent.

If you are a shopper, the store is the controller of your data, so send your request to the store. If you contact us instead, we will pass it on to the store and help it respond. We hold no name or email address for shoppers, so a request needs details that let us find the conversation, such as the store, the date and what was asked.

For everything else, write to contact@styleai.me. We answer within one month.

You can also complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you believe your rights were infringed. Our lead authority is the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens. In the UK, it is the Information Commissioner's Office.

10. Security

All connections to StyleAI use HTTPS. Our hosting provider encrypts stored data, and Shopify access tokens are additionally encrypted by us. Each person signs in to StyleAI Manager with their own account and a role, and changes to an assistant's settings are logged. Access to our systems is limited to the people who need it.

11. Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, we tell stores and Manager users in advance.