Privacy policy
Last updated 2026-10-31 · This is a working draft; replace placeholders with your real company details before relying on it in production.
Yamam ("we", "us") provides an AI chat assistant that online stores embed on their site. This policy explains what data we collect, why, how long we keep it, who processes it on our behalf, and the rights people have over their data.
Who the data controller is
- Yamam the platform: we are the data controller for shop-owner accounts and the platform itself.
- Each shop is the data controller for its own shoppers' chats (we process that data on the shop's behalf as a data processor). A shopper's requests about their chat data go to the shop; the shop uses our Privacy & data page to act on them.
What we collect
- Shop-owner account: username, email, phone, hashed password, plan, billing history.
- Shop configuration: shop name, persona, rules and policies, FAQ, WhatsApp numbers, branches, business hours, delivery areas, journeys, as entered in the dashboard.
- Catalog data: product titles, descriptions, images, variants, stock, prices (synced from Shopify or uploaded as CSV / JSON).
- Chat data: messages between shoppers and the bot, which product cards the bot showed, which buttons the shopper tapped, the language of the chat, and whether the chat resulted in an order. We store the shopper's IP address only as an HMAC hash (so we can delete all of one visitor's data when asked, but can't reconstruct an IP from the stored value).
- Analytics / errors: aggregated counts, response times, and server-side error traces. No shopper identifiers are included.
We only collect what we need to run the service. We don't track shoppers across sites, we don't build advertising profiles, we don't buy or sell personal data.
Why we collect it (lawful bases)
- Contract: running the service you've subscribed to.
- Legitimate interest: keeping the service running (fraud / abuse detection, backups, security), with each use documented and limited.
- Consent: for the cookie consent banner's non-essential cookies (currently none), for marketing communications you opt in to, and for any specific disclosure a shop asks a shopper to accept.
- Legal obligation: where we must respond to a lawful request.
How long we keep it
- Chat data: kept for the retention period the shop sets (default: unlimited unless
DATA_RETENTION_DAYS is configured).
- Shop account + configuration: kept for as long as the account is active; deleted on account closure or on request.
- Billing records: kept for 7 years to meet tax-reporting rules.
- Backups: rolling 14-day backups overwrite themselves; a deletion propagates within that window.
Who we share it with (sub-processors)
- DeepSeek (China): each chat message is sent to generate the reply. No shopper identifiers are sent.
- OpenAI (United States): product descriptions sent once per catalog for semantic-search embeddings.
- Railway (United States): our hosting and compute provider.
- Shopify (where applicable): only product and store metadata we sync down.
- We never sell data to third parties. We never share data with advertisers.
Where the recipient is outside your country, we rely on their standard contractual safeguards.
Cookies
We only use strictly-necessary cookies: a signed session cookie for the dashboard, a language-preference cookie on the public site, and a session identifier the chat widget sets per shopper to join their messages into one conversation. We don't set tracking or advertising cookies.
Full breakdown: Cookie policy.
Your rights
A shopper or a shop owner can ask us to:
- Access a copy of the personal data we hold.
- Correct inaccurate data.
- Delete ("right to be forgotten"), subject to legal retention we're required to keep.
- Port data to another service in a common machine-readable format.
- Object to processing based on legitimate interests.
- Withdraw consent at any time where processing is consent-based.
Submit a request via the Data deletion request form, or email us (replace with your email address). We respond within 30 days.
Children
The service is not directed at children under 13. We don't knowingly collect their data; if we do, we delete it on notice.
Security
Data in transit uses TLS 1.2+. Passwords are bcrypt-hashed. Shopify tokens and other third-party secrets are stored encrypted at rest when TOKEN_ENCRYPTION_KEY is set.
Changes to this policy
Material changes are notified by email to account holders at least 14 days before taking effect.