Privacy Policy

1.Who we are

CreaScale AI is an AI sales-assistant application ("the App", "we", "us") operated by Matrix Tower LLC. The App connects to a merchant's online store and answers that merchant's customers on WhatsApp, Instagram and an embeddable web chat widget, and can create orders — including cash-on-delivery (COD) orders.

For personal data processed through the App, the merchant who installs the App is the data controller, and Matrix Tower LLC acts as a processor acting on the merchant's instructions. For account, billing and operational data of the merchant themselves, we act as controller.

Data-protection contact: support@creascale.ai.

2.Scope of this policy

This policy covers personal data processed by the CreaScale AI application when it is installed on a Shopify store (or connected via our supported channels) and when it converses with end-customers. It does not cover the merchant's own website, the Shopify platform itself, or third-party services the merchant uses independently of the App.

3.Data we process

a. Merchant & account data

• Store identifier (e.g. your *.myshopify.com domain) and tenant identifier.
• Your Shopify access token, stored encrypted (see §8) and referenced by indirection — never in plain text.
• Plan, operating mode, credit balance and usage/cost metering needed to run and bill the service.

b. Store data accessed via the Shopify Admin API

With your authorization (see the scopes in §6), the App reads store data to answer customers accurately and place orders:

• Products, variants, prices and collections;
• Inventory levels and locations;
• Orders (for order-status and store context);
• Customer records, including names, phone numbers and addresses, to match a returning customer and their order history.

c. End-customer data captured in conversations

• Contact identifier (phone number for WhatsApp, Instagram user id, or web-widget session);
• Name, delivery address and phone provided by the customer to place an order;
• Purchase intent (e.g. a cash-on-delivery order request);
• The content of messages exchanged with the assistant.

d. Conversation history & memory

We store conversations, a rolling conversation summary, and structured "memory" facts (for example a customer's stated preferences or last order) so the assistant can hold context across messages. Catalog and knowledge-base text is indexed as numerical embeddings to enable semantic search.

4.Why we process it & legal bases

Where required, the merchant is responsible for obtaining any consent from its own customers for messaging on WhatsApp/Instagram.

5.Sub-processors

We use the following sub-processors to run the App. Each receives only the data needed for its function.

International transfers. Some sub-processors are located outside the EEA/UK (e.g. in the United States). Where personal data is transferred internationally, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and equivalent mechanisms.

The App is also served from cloud infrastructure. A current list of sub-processors is available on request at support@creascale.ai.

6.Shopify Protected Customer Data

The App requests the following Shopify access scopes:

read_products · read_orders · write_orders · read_customers · write_customers · read_inventory · read_locations

Reading customer name, address, phone and email is Protected Customer Data under Shopify's requirements. We access it only to answer the customer, recognise a returning customer, and create the order they request; we do not sell it or use it for advertising; and we apply the security controls in §8.

Mandatory Shopify compliance webhooks

We implement Shopify's three privacy webhooks (endpoint /api/compliance/shopify/gdpr, requests are HMAC-verified):

• customers/data_request — we log the request and provide the customer's stored data to the merchant, who can forward it to the data subject, within 30 days.
• customers/redact — we delete that customer's personal data (orders, conversations and messages, memory, opt-in and related records) from our systems.
• shop/redact — after a store uninstalls, we delete that store's data and stored credentials from our systems.

Uninstalling the App immediately revokes and purges the stored Shopify access token.

7.Data retention

We retain personal data for as long as the App is installed and needed to provide the service. Data is deleted when we receive a customers/redact or shop/redact request, when a store uninstalls (store credentials are purged on uninstall), or on a documented request to support@creascale.ai. Short-lived operational caches of store data are held only transiently to serve a conversation.

8.Security

• Tenant isolation. Every merchant is a separate tenant. Database access is governed by row-level security keyed to the merchant's identity, so one merchant's data cannot be read by another.
• Encrypted credentials. Shopify and messaging access tokens are stored in an encrypted secret vault and are only ever accessed through restricted, privileged database functions — never exposed to the merchant dashboard or to other tenants.
• Encryption in transit. Calls to Shopify and to messaging platforms use HTTPS/TLS. Incoming webhooks are verified with HMAC signatures.
• Least privilege & abuse controls. Public endpoints (such as the web widget) are protected by unguessable identifiers, per-tenant origin allowlists, rate limiting and cost caps.

9.Your rights

Under the GDPR, individuals in the EEA/UK have the right to access, rectify, erase, restrict or object to processing, and to data portability. Because we act as a processor for end-customer data, requests from a store's customers are normally directed to that store (the controller); we assist the merchant in fulfilling them, including through the Shopify webhooks above.

Under the CCPA/CPRA, California residents have the right to know what personal information is collected, to request deletion, to correct it, and to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information.

To exercise any right, contact support@creascale.ai. You also have the right to lodge a complaint with your local supervisory authority.

10.Cookies

The App is an assistant that runs inside Shopify and messaging channels; it does not use advertising or tracking cookies to process the personal data described here. The embeddable web widget uses only the storage strictly necessary to maintain a conversation session.

11.Children

The App is intended for use by merchants and their adult customers. It is not directed at children, and we do not knowingly collect personal data from children under the age required by applicable law.

12.Changes to this policy

We may update this policy to reflect changes in the App or in legal requirements. Material changes will be posted on this page with a revised "Last updated" date above.

13.Contact