Privacy policy

This policy explains how AI Active Support (“we”), the controller for this website, processes the personal data of (1) visitors to this website and prospects, and (2) the end customers of the brands whose customer service we run. Contact: contact@aiactivesupport.com.

1. Visitors and prospects

• Data: name, business email, company, store URL, request volume, message.
• Purpose: answering your request and offering our services. Legal basis: your consent and our legitimate interest.
• Retention: 3 years after the last contact.
• This website uses no advertising cookies or third-party trackers. Technical cookies only keep signed-in portal users signed in and remember the chosen language. The contact form may use Cloudflare Turnstile to block bots.
• Anonymous audience measurement: we count visits and some actions on the website (call-to-action clicks, forms, pricing page views, estimator use, language changes). Only the type of action, the page, the button and the channel of the visit (search engine, social network, AI assistant, another website or direct, derived from the referring site and kept in the browser tab for the visit) are recorded: no cookie, no IP address, no identifier. Nothing is sent when your browser asks not to be tracked (Do Not Track or Global Privacy Control). These counts are kept 13 months.

2. Brands’ end customers (processing on their behalf)

When we process the messages of a brand’s customers, we act as a processor under Article 28 of the GDPR, on behalf of the brand (the controller), under a data processing agreement (DPA).

• Data: name, email, message content and attachments, order information (number, status, tracking) read from the store.
• Purpose: answering requests, ensuring service quality, producing the brand’s statistics and invoices.
• Artificial intelligence: messages may be analysed by an AI model (through OpenRouter, only with model providers that do not retain request data) to suggest or send replies. Personal details are masked and card numbers and IBANs removed before anything is sent to the model. We do not use this data to train models. The AI cannot take any action (refund, cancellation, order change): it suggests, a person decides.
• Retention: for the duration of the contract with the brand, then deletion or return on its request (see section 5).
• Store access: for Shopify, read access to orders only (read_orders scope); we cannot change anything in the store.

3. Recipients and transfers

Our support teams and our technical subprocessors, listed with their role and location on the subprocessors page: application hosting (Vercel, Dublin, Ireland), database (Supabase (AWS eu-west-1, Ireland)), email delivery (Brevo (Sendinblue SAS), France (EU)), AI provider (OpenRouter and the model providers it calls, in the United States), online payment (Stripe, which processes card data without us having access to it), bot protection on forms (Cloudflare Turnstile). Our support teams may work from countries outside the European Union: these transfers, like those to the United States, are covered by the European Commission’s standard contractual clauses.

4. Security

Data isolated per brand in the database, role-based access, two-factor authentication, encrypted connections (HTTPS), database and files encrypted at rest by our host, integration secrets encrypted by us (AES-256-GCM), audit log. Details, including what we do not have yet (certifications, external audit), are on our security page.

5. Retention and deletion

• Conversations, customers, orders, knowledge and files: for the duration of the contract with the brand.
• An end customer erased at the request of the brand or of Shopify: deleted at once, with their files and orders.
• End of contract: the organisation is hidden at once and fully deleted (data and files) 30 days later; the brand can export its data before.
• Sign-in log (with IP address): 1 year. Read notifications: 180 days. Technical data (jobs, webhooks, telemetry): 14 to 90 days.
• Prospects: 3 years after the last contact. Anonymous audience measurement: 13 months.
• Backups: deleted data stays in database backups until they expire; after a restore, deletions made since are applied again.

6. Your rights

You have the right of access, rectification, erasure, objection, restriction and portability. Write to contact@aiactivesupport.com. If you are a brand’s customer, we forward your request to the brand. You can complain to your country’s data protection authority (in France, the CNIL; in the United Kingdom, the ICO).