Privacy Policy

1. Who we are

Squid Support is a multi-tenant, AI-powered customer support platform. Businesses (“merchants”) use Squid Support to manage customer conversations across email and chat, with AI agents that resolve inquiries and escalate to human agents when needed.

This policy explains what personal data we process, why, on what legal basis, who we share it with, how long we keep it, and what rights individuals have.

2. What this policy covers

• The support dashboard used by merchant staff (agents, admins, owners).
• The embeddable chat widget installed on merchant storefronts (a Shadow-DOM isolated bundle).
• The customer return portal used by merchants’ shoppers to submit and track returns.
• The email channel, inbound and outbound, including inbound-parse mailboxes.
• Our APIs and webhooks, including the Shopify app install, lifecycle, and mandatory privacy webhooks.
• The squidsupport.ai website.

3. Our two roles: controller and processor

Squid Support acts in two distinct capacities, and the rights and routes differ between them.

Where this policy describes shopper data, we are acting as a processor. Shoppers should normally direct requests to the merchant they contacted (see Section 10).

4. Data we process

4.1 Merchant account data (we are the controller)

• Organization, brand, and user records: names, email addresses, role assignments, team structure.
• Authentication data: password hashes, session and WebSocket tickets, multi-factor state where enabled.
• Integration credentials: OAuth access tokens and API keys for the services a merchant connects. These are encrypted at the application layer before storage (see Section 11).
• Plan, subscription, invoice state, and usage counters (tickets handled, AI messages generated).
• Support correspondence with us, and product telemetry and error diagnostics.

4.2 Shopper / end-customer data (we are a processor)

Shopify protected customer data. When a merchant installs our Shopify app, we read customer and order information through the Shopify Admin GraphQL API to give the agent — human or AI — the context needed to answer a support request. We request the minimum set of scopes for that purpose:

This data is purpose-limited to resolving that merchant’s support requests. We do not use it for marketing, profiling, scoring, advertising, resale, or to train AI models.

Other shopper data.

• Conversation transcripts — the full content of support conversations across chat and email, including messages written by shoppers, human agents, and AI agents.
• Widget pre-chat information — contact and context details a shopper types into the chat widget’s pre-chat form. See Section 12 for what is stored in the shopper’s own browser.
• Email content and attachments — bodies, subjects, sender and recipient addresses, and files.
• Return portal submissions — order identifiers, return reasons, contact details, and any photos a shopper uploads as evidence.

5. Why we process it, and our legal basis

We do not sell personal data, and we do not use shopper data for our own purposes.

6. AI processing

Squid Support uses large language models (LLMs) to understand support requests and draft responses, and — where a merchant switches it on — to send responses and take order actions.

Which providers receive data. Conversation content, order context, and the merchant’s configured instructions are sent to the model providers below. These are the only LLM providers we use:

No training on your data. We do not permit model providers to train on merchant or shopper data processed through Squid Support. Google Vertex AI and OpenAI do not use data submitted through their APIs to train their models under the terms that apply to us.

Redaction. Before conversation text is used on internal review surfaces (for example AI-feedback excerpts), automated redaction scrubs email addresses, phone numbers, card-like numbers, order identifiers, and internal record identifiers.

Human oversight. AI behaviour is configurable per brand. A merchant can run the AI in draft mode, where a human reviews and approves every message before it is sent, or enable automatic sending. In every mode the AI can escalate to a human team, and human agents can override, edit, or take over any conversation. We do not use AI to make automated decisions producing legal effects for a shopper.

7. Subprocessors

We engage the following subprocessors. Each processes only what it needs for the stated purpose, and each is bound by a data processing agreement.

Core infrastructure — every merchant

Optional — only when a merchant enables the integration

We maintain the current subprocessor list here and give merchants advance notice of additions as required by our DPA.

8. How long we keep data

A merchant can also delete individual conversations and customer records at any time from the dashboard.

Backups are encrypted at rest by our managed database provider and are held in the same EU region as the live database. Because a backup is a point-in-time copy, data you delete may persist inside an existing backup until that backup ages out of the 30-day window; it is not restored into the live service, and the backup is destroyed on schedule.

9. International transfers

We store and process personal data in the European Union (Google Cloud europe-west1).

Some subprocessors in Section 7 process data outside the EEA (in particular in the United States). Where they do, the transfer is made under an appropriate Chapter V GDPR safeguard — Standard Contractual Clauses (SCCs), or the provider’s certification under the EU–U.S. Data Privacy Framework where applicable — together with the technical measures in Section 11.

You can request details of the mechanism applying to a specific subprocessor at legal@squidsupport.ai.

10. Your rights

Individuals have the right to access, rectification, erasure, restriction, data portability, and objection, and the right to complain to a supervisory authority. For people in the Netherlands the authority is the Autoriteit Persoonsgegevens.

• Merchant staff — where we are the controller, contact legal@squidsupport.ai.
• Shoppers — where we are a processor, contact the merchant you dealt with; they control your data. We assist merchants in answering these requests.

Requests that arrive through Shopify. For merchants on Shopify we implement Shopify’s mandatory privacy webhooks, and every one of them verifies Shopify’s HMAC signature before acting:

• customers/data_request — we gather the customer’s stored record and conversation transcripts, package them as a JSON export, and deliver them to the merchant’s administrators so the merchant can answer the shopper.
• customers/redact — we erase the identified customer’s personal data for that merchant. Every personal-data field on the customer record is cleared and the conversation transcripts are scrubbed. We keep the de-identified record and non-personal aggregates (such as order count) so the merchant’s history stays referentially intact, and we write a proof-of-erasure audit entry that contains no personal data.
• shop/redact — after a merchant uninstalls, we erase the shop’s cached customer data, the stored access tokens, and the store’s brand links.

Our commitment. We complete a validated data subject request within 30 days.

11. How we protect data

• In transit — every connection between you, your shoppers, your store platform and our services is encrypted with TLS. Traffic between our own backend services and their databases and caches does not leave our private cloud network: those datastores have no public IP address and are not reachable from the internet.
• At rest — AES-256 provider-side encryption for stored data. Sensitive secrets, including Shopify and other OAuth tokens, receive an additional application-layer encryption pass (Fernet with key rotation support) before they are written.
• Tenant isolation — every database query is scoped to a single organization, enforced in code and covered by automated tests, so no merchant can reach another merchant’s data.
• Access control — role-based access control gates every endpoint with a specific named permission. Staff passwords are hashed; access follows least privilege.
• Access logging — a dedicated personal-data-access event is recorded whenever a customer’s Shopify record is accessed or exported, and privacy-request handling writes audit entries.
• Integration integrity — inbound webhooks are HMAC-verified and unsigned or forged requests are rejected. Webhook deliveries are de-duplicated so a replay cannot re-trigger an action.
• Separation of environments — production and staging run in separate cloud projects; production data is never copied into staging.
• Monitoring and response — error and security event monitoring with alerting, and a written security incident-response policy covering detection, containment, notification, and review.

12. Cookies and browser storage

Our dashboard uses strictly necessary cookies and tokens to keep you signed in. We do not use advertising or cross-site tracking cookies.

The chat widget stores a small amount of data in the shopper’s browser so a conversation survives a page reload:

• Local storage — the pre-chat information the shopper entered and the current conversation identifier.
• Session storage — the conversation’s session token, held in session storage rather than local storage to limit exposure.

This storage is strictly necessary to provide the chat the shopper started. Merchants are responsible for how the widget is presented within their own cookie and consent notices.

13. Children

Squid Support is a business tool and is not directed to children, and we do not knowingly collect personal data from children. Shoppers interact with a merchant’s storefront under that merchant’s terms.

14. Changes to this policy

We may update this policy. Material changes are communicated to merchants in the product or by email, and the “Last updated” date above always reflects the current revision.

15. Contact

Squid Solutions B.V.
Goudvinklaan 92, 3722 VE Bilthoven
The Netherlands
Company registration 42033298

• Privacy and data protection: legal@squidsupport.ai
• Data subject requests: legal@squidsupport.ai