Privacy Policy

Last updated: March 4, 2026

1. Introduction

MooChatAI ("we," "our," or "us") operates the MooChatAI platform, which provides an AI-powered shopping assistant for WordPress & Shopify stores. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, API, plugins, and related services (collectively, the "Service").

2. Information We Collect

2.1 Account Information

When you register for an account, we collect:

  • Email address
  • Name (optional)
  • Password (stored as a salted hash, never in plain text)

2.2 Site and Store Data

When you connect your online store, we collect:

  • Store domain and name
  • Product catalog data (names, descriptions, prices, images, stock status)
  • Store configuration settings
  • Shopify OAuth access tokens (encrypted at rest using Fernet symmetric encryption)
  • Shopify shop domain and installation metadata
  • Store pages and blog content (only when explicitly imported by the merchant)

2.3 Chat Data

When visitors use the chat widget on your store, we collect:

  • Chat messages between visitors and the AI assistant
  • Visitor identifiers (anonymized browser-generated IDs)
  • Page URLs where chats occurred
  • Device type, browser, and language preferences
  • Voluntarily provided contact information (name, email)

2.4 Payment Information

Payment processing is handled by Stripe (for WordPress) and Shopify Billing API (for Shopify). We do not store credit card numbers. We retain:

  • Stripe customer and subscription identifiers (WordPress)
  • Shopify charge identifiers (Shopify)
  • Billing email address
  • Plan type and billing cycle

2.5 BYOK (Bring Your Own Key) Data

If you use the BYOK plan and provide your own OpenAI API key:

  • Your API key is encrypted using Fernet symmetric encryption before storage
  • We never store or log your key in plaintext
  • The key is decrypted only at the moment it is used to make an API call on your behalf
  • You may delete your key at any time through the dashboard

2.6 Usage and Analytics Data

  • Chat session counts and message volumes
  • AI response times and token usage
  • Product recommendation and add-to-cart metrics

3. How We Use Your Information

We use the collected information to:

  • Provide and maintain the Service
  • Generate AI-powered product recommendations and chat responses
  • Process payments and manage subscriptions
  • Send transactional emails (password resets, license keys, notifications)
  • Provide analytics and usage statistics
  • Improve our AI models and service quality
  • Prevent fraud and abuse

4. Data Sharing

We do not sell your personal data. We share data only with:

  • Stripe - for payment processing (WordPress stores)
  • Shopify - for billing, authentication, and platform integration (Shopify stores)
  • OpenAI - chat messages are sent to AI models (GPT-4o-mini) for response generation; no personal identifiers are included in prompts
  • Infrastructure providers - for hosting and service delivery
  • Law enforcement - when required by law or to protect rights and safety

5. Data Retention

  • Account data is retained while your account is active
  • Chat data is retained for the duration of your subscription
  • Product data is retained while your site is connected
  • Upon account deletion, we remove your data within 30 days
  • When you uninstall the Shopify app, your installation is marked inactive; all associated data is deleted upon receiving a Shopify shop redact request

6. GDPR and Data Subject Rights (Shopify)

We comply with Shopify's mandatory GDPR webhooks. When a data request is received through Shopify:

  • Customer Data Request: We collect all data associated with the customer (chat sessions, messages, and abandoned carts) and email a report to the shop owner
  • Customer Data Erasure: We permanently delete all chat sessions, messages, and abandoned carts associated with the customer
  • Shop Data Erasure: We permanently delete all data associated with the shop, including chat sessions, messages, agents, abandoned carts, analytics, knowledge base articles, product data (including vector embeddings), licenses, and the site record itself

Merchants can also request data export or deletion at any time by contacting support@moochatai.com.

7. Data Security

We implement industry-standard security measures including:

  • HTTPS encryption for all data in transit
  • PBKDF2 password hashing with random salts
  • JWT-based authentication with token expiration
  • Rate limiting on authentication endpoints
  • Separate public and private API keys

8. Your Rights

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of your data
  • Export your data
  • Opt out of marketing communications
  • Request a copy of all data we hold about your customers (Shopify merchants)

9. Cookies

The chat widget uses browser localStorage to maintain visitor sessions and preferences. We do not use tracking cookies for advertising purposes.

10. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the new policy on this page and updating the "Last updated" date.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at support@moochatai.com.