Pooch AI — Privacy Policy
Effective date: 15 July 2026 Last updated: 15 July 2026
1. Scope of this policy
Pooch AI ("Pooch", "we", "us") provides an AI shopping-assistant chat widget, and an associated storefront analytics pixel, that merchants install on their Shopify stores. Pooch is operated by VentureChefs LLC, a limited liability company registered at 1021 E Lincolnway, Suite #10586, Cheyenne, Wyoming 82001, United States.
This policy applies where Pooch acts as a controller — principally, to the personal data of merchants and of visitors to our own website.
It does not apply to personal data we process on a merchant's behalf. When a shopper interacts with the chat widget, or browses a store on which our pixel is installed, that merchant is the controller of the shopper's personal data and Pooch acts as a processor (or "service provider") under the merchant's instructions. That merchant's own privacy policy governs. Sections 3 to 9 describe, for transparency, what we do on a merchant's behalf, but do not make us the controller of it.
If you are a shopper and wish to exercise your privacy rights, please contact the store you were shopping with. See §10.1.
Related documents: Cookie Policy · Sub-processors · Terms of Service
2. Personal data of merchants
Where you are a merchant using our dashboard, we process:
- Account data — name, email address, and authentication data.
- Configuration data — your workspace, agent, and assistant settings.
- Integration data — credentials and tokens authorising us to access your store on your behalf.
- Usage, billing, and support data — records of your use of the service, subscription records, and correspondence with us.
We process this to provide and administer the service, to bill you, to provide support, to secure the service, and to comply with our legal obligations. Our legal bases are the performance of our contract with you, our legitimate interests in operating and securing our business, and compliance with law.
Subscriptions are billed through the Shopify Billing API. We do not receive or process your payment card details.
3. Personal data we process on a merchant's behalf
3.1 Chat data
- Conversation data — the messages exchanged between the shopper and the assistant. Shoppers are not asked to provide personal information in free-text chat, but anything a shopper chooses to include in a message forms part of the conversation record.
- Identity data — where a shopper is already signed in to the merchant's store, an identifier and email address for that shopper, obtained from the store, so a conversation can be associated with the right person.
- Order enquiry data — an order reference together with a contact detail the shopper provides, used to locate the order and confirm it belongs to the person asking before any order information is disclosed; and summary information about the order.
- Device and usage data — a device or session identifier, device type, browser, operating system, language, store market and currency, the page on which the chat was used, and usage measures such as timestamps and message counts.
3.2 Storefront analytics
Where the merchant enables it, we operate a first-party analytics pixel across the merchant's storefront. This is not limited to pages where the chat is used.
The pixel reports the following events: page viewed, product viewed, product added to cart, cart viewed, checkout started, and checkout completed. For each, it reports a visitor identifier; identifiers Shopify assigns to the shopper's browser, customer account (where signed in), cart, checkout, and order; the product and variant concerned; the monetary value and currency; and the event data Shopify provides.
The purpose is to allow the merchant to understand whether a conversation with the assistant contributed to a purchase. This is analytics and is not strictly necessary to operate the store or the chat. It is not advertising, and the data is not sent to any advertising network or third-party analytics provider — only to us, on the merchant's behalf.
In the EEA, the UK, and equivalent jurisdictions, this requires the shopper's prior consent. See §6.
3.3 Data we do not process
We do not process payment card details, financial account numbers, or government identifiers. We do not knowingly process special categories of personal data, and merchants are contractually prohibited from configuring the service to do so.
3.4 Data minimisation in order enquiries
Contact details used solely to confirm that an order belongs to the person asking about it are not stored by us. They are used for that check and then discarded. The order information subsequently shown to a shopper is limited to a summary and excludes contact details and street address.
4. Purposes and legal bases
Where a merchant is the controller, the merchant determines the legal basis. The bases below are those on which the service is designed to operate.
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Answering shopper questions about a merchant's products, content, and policies | Art. 6(1)(b) performance of a contract, and/or Art. 6(1)(f) legitimate interests in providing customer service |
| Confirming that an order belongs to the person enquiring, before disclosing it | Art. 6(1)(f) legitimate interests in preventing unauthorised disclosure of another person's data |
| Maintaining conversation continuity | Art. 6(1)(f) legitimate interests; and Art. 6(1)(a) consent where a non-essential identifier is used (§6) |
| Storefront analytics and attribution (§3.2) | Art. 6(1)(a) consent, obtained by the merchant |
| Providing merchants with analytics about their own store | Art. 6(1)(f) legitimate interests; and Art. 6(1)(a) consent where applicable (§6) |
| Securing the service, preventing abuse, and diagnosing faults | Art. 6(1)(f) legitimate interests in operating a secure service |
We do not sell or share personal data. We do not use personal data for advertising, cross-site tracking, or profiling.
5. Artificial intelligence
The assistant generates its replies using large language models provided by the third party identified on our sub-processor list. Conversation data is transmitted to that provider solely to generate a reply.
We do not use conversation data to train our own models, and our AI provider does not use data submitted through its API to train its models.
The model that converts a merchant's store content into search vectors runs within our own infrastructure; that content is not sent to a third party for that purpose.
Shoppers interact with an automated system, not a human. The assistant's replies are generated automatically and may be inaccurate or incomplete. We do not use automated processing to make decisions producing legal effects, or similarly significant effects, concerning any individual.
6. Cookies and similar technologies
The chat widget and the analytics pixel store identifiers on a shopper's device. Some are strictly necessary for the chat to function. Others — including the 12-month visitor identifier and the identifiers supporting the storefront analytics pixel — are not strictly necessary and, in the EEA, the UK, and equivalent jurisdictions, require the shopper's prior consent.
Merchants are responsible for obtaining and honouring that consent through their store's consent-management banner, and for ensuring their deployment of the widget and pixel reflects shoppers' choices. See our Terms of Service, §5.
A full itemised list is in our Cookie Policy.
7. Sharing and sub-processors
We share personal data with service providers who help us operate the service: cloud hosting and infrastructure; an artificial intelligence provider; and the commerce platform on which a merchant's store runs.
A current, itemised list of our sub-processors — their identity, location, and role — is maintained at /legal/subprocessors. We give merchants at least 30 days' notice before adding or replacing a sub-processor that processes shopper data.
Beyond these, we disclose personal data only: to professional advisers under a duty of confidentiality; where required by law, court order, or binding regulatory request; to establish, exercise, or defend legal claims; and to an acquirer in connection with a merger, acquisition, or sale of assets, with notice to affected merchants.
8. International transfers
Personal data is stored and processed in the United States.
Our personnel access personal data from Pakistan. Access is limited to a small number of authorised administrators (§11).
<!-- CONFIRM BEFORE PUBLISHING: this must list EVERY country from which staff or contractors can reach production personal data — not only where the company is registered. Under GDPR, a person in another country opening a screen that renders EU personal data is itself a transfer to that country, whether or not the data moves. If anyone works from, or travels and works from, a third country, it belongs here. An omission is precisely what a merchant's data protection review looks for. -->Where personal data is transferred from the EEA, the UK, or Switzerland to a country without an adequacy decision — which includes the United States and Pakistan — we rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum, and the Swiss addendum as applicable, together with any supplementary measures identified by a transfer impact assessment. These are incorporated into our Data Processing Addendum. Merchants may request further information at privacy@pooch-ai.com.
9. Retention
We retain personal data for as long as necessary for the purposes described in this policy, and in accordance with the following principles.
- Order enquiry contact details are not retained (§3.4).
- Live conversation data is held in our operational cache only while a conversation is active, and is moved to archival storage shortly after the conversation ends or becomes inactive.
- Archived conversation, analytics, and storefront event data is retained for the duration of the merchant's account, so that the merchant can access its own history and analytics, and is then deleted in accordance with the below.
- Merchant account and billing records are retained for the life of the account and for 7 years afterwards, as required for tax and accounting purposes.
Erasure. When a merchant uninstalls the application, or when a merchant or the commerce platform notifies us of a customer erasure request, we delete the corresponding shopper data from our systems. Data residing in backups is removed on the ordinary backup rotation cycle, during which it remains protected and is not actively processed.
10. Your rights
10.1 Shoppers
Subject to applicable law, you may have the right to access, correct, delete, port, or restrict the processing of your personal data, to object to processing, and to withdraw consent.
Because the merchant is the controller of your data, please direct your request to the store you shopped with. If you contact us directly, we will refer you to that merchant and notify them of your request. Where a merchant asks us to assist in responding, we do so within the timeframe applicable to that request.
We do not discriminate against anyone for exercising these rights.
10.2 Merchants
To exercise rights in respect of your own account data, contact privacy@pooch-ai.com. We will respond within the period required by applicable law.
10.3 Region-specific disclosures
EEA, UK, and Switzerland. You may object at any time to processing based on legitimate interests, and you may lodge a complaint with your local supervisory authority. {{IF_APPLICABLE — Our Art. 27 representative is {{EU_REP_DETAILS}}.}}
California. We have collected the categories of personal information described in §2 and §3 in the preceding twelve months, for the purposes described in §4, and disclosed them to the categories of recipients described in §7. We do not sell or share personal information, as those terms are defined by the CCPA/CPRA, and have not done so in the preceding twelve months. We do not process sensitive personal information for any purpose that would give rise to a right to limit. Where we process shopper data we act as a service provider and do not retain, use, or disclose it other than to perform the service. California residents may exercise their rights to know, delete, correct, and opt out through the merchant, and may use an authorised agent.
Other US states. Residents of states with comprehensive privacy legislation have comparable rights, exercisable through the merchant. We act as a processor under those laws. We do not engage in targeted advertising, the sale of personal data, or profiling in furtherance of decisions producing legal or similarly significant effects.
Canada. We handle personal information in accordance with PIPEDA. Complaints may be directed to the Office of the Privacy Commissioner of Canada.
Australia. We handle personal information in accordance with the Australian Privacy Principles. Complaints may be directed to the Office of the Australian Information Commissioner.
Brazil. Where the LGPD applies, the merchant is the controlador and Pooch is the operador. Data subjects hold the rights set out in Art. 18 LGPD, exercisable through the merchant.
11. Security
We maintain technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, separation of production and non-production environments, and restriction of access to personal data on a least-privilege basis.
Our security commitments to merchants, including an itemised description of our technical and organisational measures, are set out in the Data Processing Addendum at Schedule 1 of our Terms of Service. No system is completely secure and we cannot guarantee absolute security.
12. Children
The service is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided personal data through the widget, please contact the relevant merchant, or us at privacy@pooch-ai.com, and it will be deleted.
13. Changes
We may update this policy from time to time. Where a change materially affects the processing of personal data, we will notify merchants at least 30 days before it takes effect. The "last updated" date above reflects the current version.
14. Contact
VentureChefs LLC 1021 E Lincolnway, Suite #10586, Cheyenne, Wyoming 82001, United States privacy@pooch-ai.com