Privacy Policy
Last updated: September 28, 2026
Kira is an AI beauty assistant that Shopify merchants add to their online stores. It provides product recommendations, beauty and skincare guidance, and customer support to the merchant's customers ("shoppers"). This policy explains what information Kira processes, why, where it is stored, how long it is kept, and how it is deleted.
Who is responsible
For shopper information collected through a store's chat widget, the merchant is the data controller and Kira acts as the merchant's processor, processing that information only to provide Kira's features to the merchant. For information about merchants themselves (store and account details), Kira is the controller.
Information we process
From shoppers, through the chat widget:
- Chat messages you type, and the assistant's replies.
- Images you upload, such as selfies or product photos (up to 4 per message, JPEG, PNG or WebP).
- A pseudonymous device identifier, stored in your browser's local storage so a conversation can continue across page loads. The widget also keeps your recent conversation in local storage on your own device.
- Your Shopify customer ID, only if you are logged in to the store's customer account.
- Your cart token, so that products added to the cart from a recommendation can be attributed to the conversation.
- Order details, only when you ask the assistant about an order and provide the details needed to look it up. The order is read from the merchant's Shopify store to answer your question.
- Technical details of each reply, such as the detected language, the kind of request (for example, recommendation or support), and which AI model answered.
From merchants: the store's domain and name, the Shopify access credentials needed to run the app, and — for store staff who open the app in Shopify admin — their name, email address and locale as provided by Shopify. We also keep records of which products Kira recommended, which were added to cart, and which were ordered, so merchants can see the revenue Kira generated.
We do not use cookies for advertising, and we do not use third-party analytics or tracking tools.
How images are handled
Uploaded images are never stored. Each image is held in memory only while your message is being answered, sent to our AI provider for analysis, and then discarded. We keep only the number of images attached to a message, never the image itself, its file name or any copy of it — including in our diagnostic logs, where images are replaced with a placeholder.
Images are analysed only for visible characteristics relevant to beauty and skincare recommendations (for example, skin tone or a product's shade). Kira does not use facial images to identify, recognise or authenticate anyone, and does not create biometric templates.
Why we process information
- To answer shopper questions, analyse uploaded images and recommend products from the merchant's catalogue.
- To answer order and store-policy questions on the merchant's behalf.
- To show merchants their conversations and the sales Kira contributed to.
- To diagnose errors, measure quality and cost, and keep the service secure.
- To comply with legal obligations, including data-access and deletion requests.
We do not sell personal information, and we do not use shopper conversations or images to train AI models.
How long we keep it
Kira deletes data automatically on a fixed schedule:
| Data | Kept for |
|---|---|
| Uploaded images | Not stored — discarded once the reply is sent |
| Conversation messages, customer ID, device identifier and cart token | 90 days after the conversation's last message |
| Diagnostic copies of AI requests and responses | 30 days |
| Data-access exports prepared for a merchant | 30 days after the request |
| All data belonging to a store | Deleted about 48 hours after the merchant uninstalls Kira |
When a conversation expires, its messages and every identifier are deleted. What remains is an anonymous record of which products were recommended, added to cart or ordered, which merchants use for sales reporting and which can no longer be linked to a person.
Where data is stored and who we share it with
Kira's servers and database are hosted by our hosting provider in the European Union.
We use the following subprocessors:
| Subprocessor | Purpose | Data shared | Location |
|---|---|---|---|
| Our EU hosting provider | Application server and database | Everything Kira stores | European Union |
| Anthropic, PBC | AI model that generates replies and analyses images | Chat messages, uploaded images, and relevant product and store information | United States |
| OpenAI, L.L.C. | Alternative AI model for the same purposes | Chat messages, uploaded images, and relevant product and store information | United States |
| Shopify | Platform the app runs on; source of product, order and customer data | Data exchanged through Shopify's APIs | Per Shopify's privacy policy |
AI providers receive only what is needed to answer the current message. They process it under their commercial API terms, which do not allow them to use it to train their models; they may retain it for a limited period for abuse and safety monitoring under their own policies. Requests to OpenAI are sent with storage of the response disabled.
International transfers
Data sent to Anthropic and OpenAI is transferred from the European Union to the United States. These transfers are covered by the European Commission's Standard Contractual Clauses included in each provider's data processing terms, together with the EU–US Data Privacy Framework where the provider is certified under it.
Your rights
If you are in the European Economic Area, the United Kingdom or another region with similar laws, you have the right to access, correct, delete, restrict or object to the processing of your personal information, and to receive a copy of it in a portable format. You may also complain to your local data protection authority.
Because the merchant controls shopper data, the quickest way to exercise these rights is to contact the store where you used Kira. You can also contact us directly and we will work with the merchant to respond.
How deletion and access requests work
Kira implements Shopify's mandatory privacy webhooks:
- Access requests. When a merchant requests a shopper's data through Shopify, Kira assembles every conversation, message, recommendation, cart and order record linked to that shopper's customer ID — including anonymous conversations from the same device — and provides it to the merchant. The prepared export is deleted after 30 days.
- Deletion requests. When a merchant or Shopify asks for a shopper's data to be erased, Kira deletes all of that shopper's messages and diagnostic records and removes their customer ID, device identifier and cart token from every linked conversation, including anonymous conversations from the same device. Any pending access export for that shopper is deleted too.
- Store deletion. About 48 hours after a merchant uninstalls Kira, Shopify asks us to erase the store's data, and Kira deletes all of the store's conversations, sales records, settings and access credentials. We keep only a record of the store's subscription plan, which contains no shopper data.
Merchants and shoppers can also request deletion or access by contacting us.
Security
Data is sent over encrypted connections (HTTPS). Every request from a store's chat widget is verified with Shopify's signature before it is processed, and access to our internal tools is restricted to authorised staff with password-protected accounts.
Changes to this policy
We may update this policy as Kira changes. The date at the top of this page shows when it was last updated.
Contact
For privacy questions or requests about your personal data: support@kiraappz.com