1. Scope and roles
This policy applies to Serva at serva.olihon.com. For Shopify customer data, the merchant determines the purpose of processing and Serva acts as its service provider or processor. Serva does not sell personal data or use it for advertising.
2. Data we process
Serva follows data minimization and processes only data needed to provide the requested service.
- Merchant account data: workspace name, staff name, business email, locale, time zone, and authentication records.
- Commerce connection data: Shopify shop domain, granted scopes, encrypted offline access token, and connection status.
- Product data: product titles, descriptions, variants, prices, inventory snapshots, tags, and identifiers synchronized for search and support.
- Customer support conversations: normal customer and Agent messages are retained for continuity. Detected order references, emails, phone numbers, and addresses are masked in the display record and stored separately in encrypted form. Shopify's raw order response is not retained.
- Visitor continuity and reply notifications: the browser stores an opaque random visitor ID. If a customer chooses to provide an email, Serva encrypts it and associates it with that visitor so support replies can be delivered and the customer is not repeatedly asked. Serva does not identify visitors by IP address or use this email for marketing.
- Live order lookup data: an order reference and customer email supplied for verification, plus the minimum Shopify response needed to answer the request. Plaintext verification fields and Shopify responses are not stored in Serva's order database or application logs.
- AI assistance data: the active support conversation, including order references, email addresses, or other information the customer chooses to provide, may be sent to Alibaba Cloud Model Studio to understand the request, extract tool parameters, and generate a response. Serva sends task-relevant Shopify fields rather than the raw provider response.
- Audit metadata: tenant, authorized user, time, action, outcome, request ID, and a keyed one-way hash of a resource reference. Audit records do not contain order numbers or customer emails in plain text.
3. Purposes
We process data to authenticate merchants, connect their Shopify stores, synchronize product knowledge, perform a customer-requested live order lookup, secure the service, investigate abuse, and meet privacy obligations. We do not process customer data for unrelated profiling, advertising, data sale, or decisions with legal or similarly significant effects.
4. Retention and deletion
Governed conversation messages, including separately encrypted protected fields, and the optional visitor reply-notification email are retained for 365 days by default. Shopify responses exist only for the request and are discarded after the response is produced. Protected-data access metadata is retained for 180 days. Operational logs exclude request bodies, query strings, access tokens, customer identifiers, and web-server access records. Encrypted database backups are retained for up to 30 days. Commerce credentials and product projections are deleted after disconnection, uninstall, or a valid shop-redaction request in accordance with the documented deletion process.
5. Sharing and subprocessors
Data is disclosed only to infrastructure, commerce, and AI providers needed to operate Serva, currently Shopify and Alibaba Cloud Model Studio. Active conversation content and customer-supplied verification information may be processed by the AI provider to deliver support. Access is limited by role and applicable contractual or platform terms. We do not sell personal data.
6. Security
Serva uses TLS in transit, encrypted commerce credentials, encrypted backups, tenant authorization, strong password requirements, restricted staff access, metadata-only audit logs, and documented incident response procedures. No method of processing is risk-free, and controls are reviewed as the service changes.
7. Requests and contact
Merchants can disconnect Shopify to revoke Serva's token and can contact us for access, correction, deletion, or privacy questions. Shopify privacy webhooks are authenticated before processing. Contact Shenzhen Olihon Electronic Technology Co., Ltd. at 524520968@qq.com.