Privacy policy

Who we are

Copiara is a B2B wholesale app for Shopify stores, operated by Yikes Dude LLC, a Texas limited liability company. In this policy, “Copiara”, “we”, and “us” mean that company.

This policy covers copiara.com and the Copiara application that a merchant installs into their Shopify store from the Shopify App Store, including the admin app embedded in the Shopify admin, the buyer-facing surfaces that run on the merchant’s own storefront, and the APIs behind them.

Our relationship with Shopify

Copiara does not host a store, a checkout, or a buyer account system. The merchant’s store runs on Shopify, and Shopify remains the system of record for products, inventory, companies, orders, and payment state. Copiara reads and writes that data through Shopify’s APIs under the access scopes the merchant grants at install, and it keeps a derived copy so it can serve the features Shopify does not provide.

Shopify’s own handling of merchant and buyer data is governed by the merchant’s agreement with Shopify and by Shopify’s privacy policy, not by this one. Uninstalling the app ends our access.

The two roles we play

Copiara handles personal data in two distinct capacities, and your rights differ depending on which one applies to you.

• As a controller. For visitors to this website, people who contact us, and the merchant staff who administer a Copiara installation, we decide what is collected and why. This policy governs that data.
• As a processor. For everything that reaches us from a merchant’s Shopify store or is created in the app, including their buyers, company contacts, catalog, pricing, quotes, and orders, the merchant is the controller and we act on their instructions. If you are a buyer using a merchant’s store, that merchant’s privacy notice governs your relationship, and requests about your data should go to them first. We will support them in answering you.

What we collect on this website

If you submit the contact form, we collect the name, work email, company, and, when you provide them, your role, an indication of catalog size, and, on pages that ask, whether you sell on Shopify today, and whatever you write in the message field. We also record the submission time, the IP address the request came from, and the browser user agent. The IP address and user agent are used for rate limiting and abuse prevention, not for profiling.

To tell which page or campaign a contact request came from, the site remembers, for the current browser tab session only, the first page you landed on, the website that referred you, and any UTM campaign tags in the link. If you submit the contact form, those values are sent with it and stored with your request. If you never submit the form, they are never sent to us, and they disappear when you close the tab.

The form includes a hidden honeypot field that real visitors never fill in. A submission that fills it is discarded without being stored or forwarded.

We use Google Analytics 4 on this website to understand which pages are read and where visitors arrive from. It is the only analytics tool on the site. We do not run advertising pixels, retargeting tags, or cross-site tracking, and we do not sell or share any of this for behavioral advertising.

In the EEA, the UK, and Switzerland, analytics storage is off until you accept the analytics notice, and Google’s tag does not load until you accept. Until then your browser does not request it, so Google Analytics receives nothing about your visit. If you accept, the tag loads with analytics storage allowed and advertising storage, advertising data sharing, and ad personalization denied, and it sets analytics cookies. If you decline, the tag does not load and the site deletes any Google Analytics cookies this site set. If you later withdraw, the site tells the tag to stop, deletes those cookies, and the tag does not load on your later visits.

Everywhere else, analytics runs from your first page and sets its cookies, and you can turn it off at any time with Analytics settings in the footer. That control is there in every region.

To decide whether to show the notice and whether Google’s tag may load, our server reads the country that our host, Vercel, derives from your IP address for that one request and answers only yes or no. We do not store the country. If it cannot tell where you are, we treat you as being in the EEA, the UK, or Switzerland. Your choice is saved in your browser’s local storage under the name copiara_analytics_consent, and it is not sent to us. If your browser blocks local storage, we cannot save your choice. In the EEA, the UK, and Switzerland the notice then appears again on each full page load; elsewhere analytics resumes on the next full page load, and the Google Analytics opt-out add-on described under Cookies is the lasting way to turn it off.

What we receive from a merchant’s Shopify store

At install, a merchant grants the app seventeen Shopify access scopes. Shopify shows the exact list before the merchant approves it, and the app cannot read or write anything outside it. These are the scopes, grouped, and why each is needed.

The personal data inside those scopes is mostly business contact information: the names, work email addresses, phone numbers, and job roles of the people at a merchant’s buying companies, together with company and location addresses. We process it as a processor for the merchant.

What we collect inside the app

• Identity. A merchant’s staff reach the admin app through Shopify, and Shopify establishes who they are. A buyer using the storefront surfaces signs in through Shopify customer accounts, and we resolve that session to their company and location. We never see or store a Shopify password.
• Last sign-in. Copiara records the time a buyer last signed in through Copiara to count companies in use, and its audit log records the IP address and browser of account actions.
• Records the app creates. Quotes and their negotiation history, approval chains and spend limits, and credit limits and exposure. These can contain names, work contact details, and free-text notes.
• Communications. Email the app sends on a merchant’s behalf, such as a quote notification, and the templates behind it.
• AI concierge conversations. Messages from buyers, storefront visitors, and staff, the responses generated, the tool calls made to answer them and what those tools returned, and short facts about a buying company’s business drawn from its buyers’ conversations.
• Uploaded files. Catalog imports, product documents, and attachments.
• Security and audit telemetry. Every state change writes an audit entry recording the actor, the action, the record touched, a sanitized payload, and request context. That context includes the caller’s IP address and browser user agent, for every kind of caller: merchant staff, buyers, and storefront visitors, including signed-out chat visitors whose requests are refused or limited. An entry keeps its IP address and user agent until the audit retention period prunes it, including after a buyer’s personal data is redacted. Rate limiting also uses the IP address, briefly. Denied access attempts are recorded without passwords, tokens, or raw request payloads.

How we use it

• To provide the app: catalog search, quoting, approvals, credit visibility, and the AI concierge.
• To keep it secure and accountable: access control, rate limiting, abuse prevention, and the audit trail a merchant needs to answer who did what.
• To support you: answering questions, diagnosing problems, and reaching you about service and security matters.
• To run our own business: billing records, and responding to enquiries from this website.
• To improve the app in aggregate, using operational and usage measures. We do not read a merchant’s commercial data to build features for someone else.

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

Legal bases

Where the GDPR or UK GDPR applies, we rely on the following bases.

• Performance of a contract for installation, app delivery, and support.
• Legitimate interests for security, abuse prevention, audit logging, service communications, and responding to a business enquiry you sent us.
• Consent for website analytics cookies in the EEA, the UK, and Switzerland, and for optional marketing email. You can withdraw it at any time.
• Legal obligation for tax, accounting, and lawful requests.

For data we process on a merchant’s instruction, the merchant establishes the legal basis.

The AI concierge and your data

The concierge runs on Vertex AI Gemini models and Vertex AI text embeddings inside our own Google Cloud project. When a buyer, a storefront visitor, or a staff member uses it, their message, the catalog and account context needed to answer, and the generated response are sent to that project. A signed-in buyer’s chat also sends the time zone their browser reports, so due dates read in the buyer’s own time. It is used to answer and is not stored.

Under the Google Cloud terms applicable to that project, customer data sent to Vertex AI is not used to train Google’s foundation models. We do not use one merchant’s catalog, pricing, conversations, or orders to train models for another merchant, and we do not train models on customer data for general product improvement.

The merchant’s staff can read the conversations their buyers and storefront visitors have with the concierge in the Copiara admin: every message, each tool the concierge used, and what that tool returned. A conversation shows as live while messages keep arriving, and as ended once ten minutes pass without a new one or the conversation is closed. A visitor who is not signed in to the store appears with no name or company attached. Because that conversation is not tied to any account, a data request or an erasure for a named buyer cannot reach it, and it is pruned on the same schedule as every other conversation.

When a signed-in buyer’s conversation ends, the concierge may record short facts about the buying company’s business from it, such as recurring needs, preferences, and ordering constraints, so it can answer that company’s later questions. It is told to leave out prices, costs, discounts, credit, payment terms, account numbers, and names, email addresses, phone numbers, and other personal details. As a backstop, an automatic check then discards any fact that contains a dollar sign, an email address, the word USD, a run of eight or more digits, spaces, dots, hyphens, or brackets such as a phone number, an order number such as #1003 or a quote, purchase order, invoice, or shipment number, or any word that begins with pric, cost, margin, discount, or credit, such as prices, pricing, or discounted. That check does not catch every wording, so the instruction to the model is the first safeguard. A company keeps at most 40 of these facts, and the oldest give way to newer ones. A fact is kept only while at least one conversation it came from is still stored.

Conversations are stored against the merchant’s installation and pruned on the retention schedule below. Merchant and buyer content is treated as data, never as instructions to the model: a message cannot grant access to another merchant’s store, change a role, or bypass an approval path.

Events from the storefront and account pages

Copiara’s storefront blocks, its chat assistant, and its customer account pages publish named events, for example a quote request being sent or an item being added to a quote request, to the merchant’s own Shopify customer events. The merchant decides which pixels receive them, for instance an analytics or advertising pixel the merchant has set up in Shopify. Whether and where an event is delivered depends on the merchant’s Shopify setup and customer privacy settings, not on Copiara.

The events describe what happened, such as the type of action, a quantity, or a product SKU. They carry no names, email addresses, or free text. Company and branch identifiers and amounts are included only if the merchant turns those settings on, and they are off by default.

Copiara does not receive or store these events. They go from the visitor’s browser to Shopify and to whatever the merchant has connected there. On storefront pages the events are also announced on the page itself, where a script the merchant has installed, such as a tag manager, can listen for them. The merchant is the controller for that data, so a question about what a merchant’s pixels do with it belongs with that merchant. This is separate from the concierge itself: when a buyer uses the chat assistant, their messages reach Copiara so it can answer, as described above.

Cookies and similar technologies

• This website. Google Analytics 4 sets analytics cookies (named _ga and _ga_ followed by an identifier) when analytics storage is allowed: in the EEA, the UK, and Switzerland only after you accept the analytics notice, and everywhere else from your first page unless you turn it off. Your choice is kept in local storage, not in a cookie. Nothing else on copiara.com sets a cookie. You can also block them with your browser settings or the Google Analytics opt-out add-on, and the site works normally without them.
• The app. Only strictly necessary storage: the short-lived session tokens that keep an admin or a buyer authenticated for the current session, the identifier that lets a concierge chat continue from page to page in the same browser tab, a quote request you have started and not yet sent (kept in that tab for up to 24 hours), and the preferences you set in the interface. Copiara sets no analytics or advertising cookies in the app or on the surfaces it adds to a merchant’s storefront, and it does not receive the events described under Events from the storefront and account pages. A cookie set by a pixel the merchant has installed is set by that merchant’s tools, not by Copiara.

Sub-processors

These are the vendors that process personal data to run the site and the app. Each is engaged under terms that require confidentiality and appropriate security. Shopify is not listed here: it is the merchant’s own platform and the source of the data, not a vendor we introduce.

Copiara does not use a payment processor. Subscriptions are billed by Shopify through Shopify’s app billing, so no card or bank details ever reach us, and buyer orders are placed and settled in the merchant’s Shopify store, on its payment terms or through a Shopify payment link, rather than through us.

Merchants can ask to be notified in advance of a new sub-processor by writing to hello@copiara.com. We give notice before a new one starts processing customer data, and a merchant may object.

When we share information

• With the sub-processors above, for the purposes listed.
• Back to the merchant’s own Shopify store, which is where the data came from and where the order settles.
• Within a merchant’s installation, according to the roles and permissions their administrators configure.
• When the law requires it, in response to a valid legal demand. Where we are permitted to tell the affected merchant, we will.
• In a corporate transaction, such as a merger or acquisition, in which case this policy continues to apply to the transferred data until it is replaced by a notice at least as protective.

International transfers

Copiara is operated from the United States and the production database and object storage are in Google Cloud’s us-central1 region. If you are outside the United States, using the app means your data is transferred there. For transfers from the EEA, the UK, or Switzerland to our vendors, we rely on the European Commission’s Standard Contractual Clauses in our vendors’ terms.

Copiara runs in a single region today. That is a current residency boundary, not a global residency promise. A merchant that needs data held in another region should raise it before installing so it can be scoped properly.

How long we keep things

Deleting live data and expiring a backup are different things. Cloud SQL automated backups and point-in-time recovery hold historical copies for the configured window, so a record deleted in the app can persist in a recovery snapshot until that window rolls past.

Shopify privacy webhooks

Every app distributed through the Shopify App Store must implement three mandatory compliance webhooks, and Copiara does. They are how a privacy request reaches us from the platform.

• customers/data_request. A buyer has asked the merchant for the data we hold about them. We assemble it, including the text of their conversations with the concierge and the names of the tools it used, and provide it to the merchant, who responds to their buyer. We complete this within 30 days.
• customers/redact. A buyer has asked to be erased. We redact their personal data on the schedule in the retention table above, within 30 days. As that table notes, the IP address and user agent on audit log entries stay until the audit retention period prunes those entries. Their conversations with the concierge are deleted outright, with the saved copy the concierge keeps for any reply that waited on a tool, any business fact about their company drawn from those conversations, and any data-request package of theirs we still hold.
• shop/redact. Shopify sends this about 48 hours after a merchant uninstalls the app. We delete the Shopify connection data we hold for that store: the stored access tokens, the links between Shopify customers and Copiara buyer records, the links between Shopify products and Copiara catalog records, queued work for that shop, and any buyer data-request package we still hold. We also delete the store’s concierge content: every conversation and its messages, the saved copy the concierge keeps for any reply that waited on a tool, and the business facts recorded about its buying companies. Usage counts kept for billing hold no message text and stay. The store is marked uninstalled. The merchant’s Copiara workspace and the other records the app created in it are retained and flagged rather than destroyed, because a workspace can predate a store, outlive it, and be reconnected by reinstalling. Deleting a workspace is a separate step, and a merchant can ask us for it.

In this policy, deleted means deleted from the live system. The backup and point-in-time recovery copies described above age out on their own schedule.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a portable copy, object to or restrict certain processing, withdraw consent, and be free from discrimination for exercising any of these. California residents may also ask what categories we collected, used, disclosed, and, if we did, sold or shared in the preceding twelve months. We do not sell or share personal data.

To exercise a right, write to hello@copiara.com. We respond within 30 days and will tell you if we need longer. We may need to verify your identity, and we will not ask for more information than the verification needs. You may use an authorized agent.

If your data sits inside a merchant’s Shopify store, send your request to that merchant. They can raise it with us through Shopify’s privacy webhooks or directly. We will not unilaterally change or delete their records, and we will help them respond.

If you are in the EEA or the UK you may also complain to your supervisory authority. We would rather hear from you first.

Export and deletion mechanics

• Export. A merchant can ask us for a full export of the data Copiara holds for their store, at hello@copiara.com. A generated export is kept for 30 days, its download link expires after 24 hours, and the link can be reissued while the export file still exists.
• Erasing a person. Erasing a buyer or contact replaces their name, email, and phone number with a tombstone and severs the link to their Shopify customer record. The record itself stays so that audit entries and quote history still resolve to something rather than breaking. When the erasure comes through Shopify’s customers/redact webhook, their conversations with the concierge are deleted outright. If the request reaches us another way, tell us and we delete those conversations too.
• Uninstalling. Uninstalling the app from the Shopify admin ends our access immediately. Shopify sends shop/redact about 48 hours later, and we delete the Shopify connection data and the concierge content for that store. Your Shopify store keeps everything in it, and the other records Copiara created for you stay in your Copiara workspace, retained and flagged, so reinstalling returns you to the same workspace. Ask us if you would rather have those records exported, deleted, or both.

Security

Our current security posture, including how one merchant’s data is separated from another’s, access controls, the audit trail, object storage handling, and what we do not claim, is written out on the security page. Security questionnaires are welcome before a contract.

Children

Copiara is a business product. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child’s data has reached us, write to us and we will delete it.

Changes to this policy

We update this policy as the app changes. The date at the top always reflects the current version. For a change that materially affects how we handle personal data, we notify merchant administrators by email before it takes effect.

Contact

Privacy questions, rights requests, or a sub-processor notification request all go to hello@copiara.com. Postal mail can be sent to Yikes Dude LLC, Texas, United States, and we will reply by email.