Privacy policy

1. Who we are

SideMick is made by Webgro Ltd (“Webgro”, “we”, “us”), a company registered in England and Wales with company number 10889889. Our registered office address is [to be added].

SideMick is an AI live chat app for Shopify stores. Merchants install it on their store, and it adds a chat widget that answers their customers’ questions. In this policy, “merchant” means a business that installs SideMick, and “shopper” means someone who uses the chat widget on a merchant’s store.

We handle personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies, the EU GDPR.

2. Our role for each kind of data

• Shoppers’ data (chat messages and the order and customer details SideMick reads to answer them): the merchant is the controller and we are their processor. We handle this data only to provide SideMick to the merchant and on their instructions. If you are a shopper, the merchant’s own privacy policy also applies, and you should contact them first about your data.
• Merchant account data (store details, contact details of the person who installed the app, settings and billing status): we are the controller.
• Website signups (early-access email addresses and support emails): we are the controller.

3. Data SideMick accesses from Shopify

When a merchant installs SideMick, they grant it access to parts of their store through Shopify’s API. SideMick asks only for the access it needs to answer shoppers’ questions:

• Store details: store name, myshopify.com address, primary domain, plan, currency, time zone, and the store owner’s name and email address.
• Orders: order number, date, status, items, fulfilment status, carrier, tracking number and tracking link.
• Customer details on orders: the customer’s name, email address and delivery address, and whether a logged-in customer is linked to the order. We use these to confirm that the person asking about an order is entitled to see it, and to answer delivery questions. Replies never show a full delivery address or any payment details.
• Products: titles, descriptions, variants, prices, stock levels and images.
• Policies: the store’s refund, shipping, privacy and terms of service policies.
• Pages: the store’s online store pages, such as FAQ, About and Contact pages.

Order and customer details are read from Shopify at the time a shopper asks about an order. We don’t keep a copy of a merchant’s order or customer records. The details that appear in Mick’s reply become part of the chat transcript (see section 4). We never receive card numbers or other payment details, because Shopify does not share them with apps.

Products, policies and pages are copied into the merchant’s knowledge base so Mick can search them, and are updated when they change in Shopify.

4. Chat conversations

When a shopper uses the chat widget, we process:

• the messages they send and the replies they receive (the chat transcript)
• the date and time of each message and the store page the chat was started on
• a random session identifier stored in their browser (see section 12)
• if they are logged in to the store, the Shopify customer ID that Shopify passes to us, so their orders can be found without asking for details
• if they ask about an order as a guest, the order number and email address they give us
• if they ask to be contacted by a person, the email address they leave and their question
• their IP address and browser type, used to limit the number of requests and prevent abuse of the widget

Shoppers should not share sensitive information, such as payment card numbers or health details, in the chat. If a merchant uses the chat for handoff, the transcript is sent to the merchant’s chosen support inbox.

5. Merchant account and knowledge base

For each store we keep the account details listed in section 3, the widget settings (agent name, greeting, avatar, colour, font and position), the plan and billing status Shopify reports to us, and the content of the knowledge base. That includes anything the merchant adds, such as web pages, PDFs and their own questions and answers, and the suggested answers SideMick drafts. Merchants should not add personal data about individuals to the knowledge base.

6. How AI replies are generated

Mick’s replies are generated using the Claude API provided by Anthropic PBC. Anthropic acts as our processor (and so as a sub-processor for merchants). To write a reply, we send Anthropic the shopper’s message, the earlier messages in the same conversation, the relevant extracts from the knowledge base, and any order details needed to answer the question.

Under Anthropic’s commercial terms, data sent through the API is not used to train its models. Anthropic keeps API data for a limited period, set out in those terms, to detect misuse, and then deletes it. We don’t use merchants’ or shoppers’ data to train AI models ourselves.

Replies are generated automatically and can be wrong. SideMick is designed to answer only from the merchant’s store data and knowledge base, to name its source, and to hand the chat to a person when it isn’t sure. It does not make decisions that have legal or similarly significant effects on shoppers.

7. How we use data and our lawful bases

We don’t sell personal data, and we don’t use shoppers’ data for advertising.

8. Service providers

We use these providers to run SideMick. Each handles data only on our instructions and under a written contract.

Shopify provides the platform SideMick runs on and handles billing. Shopify’s own use of data is covered by Shopify’s privacy policy. We will update this list before adding or replacing a provider that handles personal data.

9. International transfers

Some of our providers are based in the United States. Where personal data leaves the UK or the European Economic Area, we rely on an adequacy decision (such as the UK’s data bridge with the United States for certified companies) or on approved safeguards, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

10. How long we keep data

• Chat transcripts and handoff emails: 12 months from the end of the conversation, unless the merchant deletes them sooner, the app is uninstalled, or we receive a redact request (section 11).
• Order and customer details: not stored separately. They are read from Shopify when needed and only kept as part of the transcript.
• Knowledge base and settings: while SideMick is installed. Deleted within 30 days after we receive Shopify’s shop redact request.
• Security and request logs: 30 days.
• Early-access emails: until we have told you SideMick has launched, or until you ask us to remove you, and in any case no longer than 24 months.
• Support emails: up to 24 months after the conversation ends.
• Billing records: six years, to meet UK tax rules.

11. Shopify privacy requests

Shopify requires every app to respond to three privacy webhooks. This is what SideMick does with each:

• Customer data request (customers/data_request): Shopify sends this when a shopper asks a merchant for the data held about them. We find the chat transcripts and handoff emails linked to that customer’s email address or customer ID and send them to the merchant, so the merchant can pass them on. We aim to do this within 30 days.
• Customer redact (customers/redact): Shopify sends this when a merchant asks for a customer’s data to be deleted. We delete or anonymise that customer’s chat transcripts, handoff emails and any linked identifiers within 30 days, unless we must keep something to meet a legal obligation.
• Shop redact (shop/redact): Shopify sends this 48 hours after a merchant uninstalls SideMick. We delete all data for that store, including settings, the knowledge base, chat transcripts and handoff emails, within 30 days. Billing records we must keep for tax are retained separately.

12. Cookies and browser storage

The chat widget stores one item in the shopper’s browser: a random session identifier. It lets the conversation continue as the shopper moves between pages of the store. It contains no personal details, isn’t used for tracking or advertising, and is removed when the conversation closes after 24 hours with no messages. Because it is strictly necessary to provide the chat the shopper has chosen to use, it does not need consent under the Privacy and Electronic Communications Regulations.

The sidemick.com website does not set cookies and does not use analytics or advertising tools.

13. The sidemick.com website

If you join the early-access list, we keep your email address and use it only to tell you when SideMick is available on the Shopify App Store. Each email will include a way to unsubscribe. If you email us, we use your message and contact details to reply. Our hosting provider keeps standard server logs, including IP addresses, for security.

14. Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to the people who need it to run and support SideMick. Each store’s data is kept separate from every other store’s. SideMick requests only the Shopify access it needs. If a personal data breach affects merchants or shoppers, we will tell affected merchants without undue delay, and the Information Commissioner’s Office where the law requires it.

15. Your rights

Under data protection law you have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct data that is wrong or incomplete
• ask us to delete your data
• ask us to restrict how we use your data
• object to our use of your data where we rely on legitimate interests
• ask for your data in a portable format
• withdraw your consent at any time, where we rely on consent

If you are a shopper, please contact the store you chatted with first, because they are the controller of your data. We will help them respond. You can also contact us directly and we will pass your request to the right store.

To make a request, email hello@sidemick.com with “Data request” in the subject. We may need to confirm your identity. We will reply within one month.

You can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. We would be grateful for the chance to deal with your concern first.

16. Children

SideMick is a business tool for merchants. We don’t knowingly collect data from children through this website. Merchants whose stores are aimed at children are responsible for meeting the rules that apply to them.

17. Changes to this policy

We will update this page when the way we handle data changes, and change the date at the top. If a change materially affects merchants, we will tell them by email or in the app before it takes effect.

18. Contact us

Webgro Ltd, company number 10889889
Registered office: [to be added]
ICO registration number: [to be added]
Email: hello@sidemick.com

See also our terms of service.