OBSEDIA AI CHAT AGENT — PRIVACY POLICY
Version 1.0 | Last updated: 3 November 2026
1. Who we are and what this policy covers
Genius Nutrition S.R.L., trading as Obsedia, provides the Obsedia AI Chat Agent application for Shopify, its storefront chat and related merchant administration features (the App). Our registered address is Business Logistic Center, Tamasi Street No. 20, Hall 6A, Buftea, Ilfov, 070000, Romania. Company registration: J23/4568/2015. VAT number: RO35355847. Contact: agents@obsedia.ai.
This policy applies specifically to the App and related support communications. It does not replace privacy information for other Obsedia products, the Obsedia website's separate activities, a merchant's own store, Shopify or other applications.
For personal data used to operate a merchant's store assistant, the merchant determines the purposes and acts as controller; Obsedia acts as processor under the Merchant Data Processing Agreement (DPA). Where a merchant is itself a processor, Obsedia acts as its subprocessor for the relevant instructed processing. Obsedia separately acts as controller for its own merchant relationship, necessary business records, service security and communications.
2. Information we process
Depending on the enabled features, merchant configuration and Shopify permissions, the App processes the following categories:
- Merchant and installation information: store identifiers and domain, authorized account/session references, installation status, settings and merchant contact details needed to provide the service.
- Store content: the merchant-approved catalogue, product information, pages and policies used to ground answers.
- Conversations: shopper messages, App replies, original timestamps, language/locale and references needed to associate a conversation with the correct store and session. Messages can contain information the shopper chooses to provide.
- Verified customer context: a server-verified Shopify customer reference and, when permitted, name, email, phone, relevant address, account creation information, locale, order count, total spending/currency and relevant order summaries or statuses.
- Order support information: the limited identity-verification and order facts needed for the authorized order-support service.
- Commercial and operational records: accepted plan/subscription references, usage and charge records, agreement-acceptance records, support communications and allowlisted technical/security metadata necessary to operate and protect the service.
We receive information from the installing merchant, its approved Shopify sources, shoppers who use the chat and necessary service providers. The App does not request payment-card credentials through chat. Merchants and shoppers should avoid sending passwords, identity documents, health information or other unnecessary sensitive data.
3. How identity and the customer panel work
A customer association is based on verified Shopify identity and the App's internal conversation identity. An email, name or order reference typed into a message is not sufficient proof. Anonymous, unverified and mixed-account conversations are not presented as belonging to one guessed customer.
The merchant customer panel reads permitted profile and order information on demand for the authorized merchant. It does not build a permanent copy of the complete Shopify customer profile or purchase history. Necessary conversation associations, rights-request records and existing authorized order-support records have their own limited purposes and retention.
The panel's profile and purchase-history results are not automatically added to AI input. Shopper messages may themselves contain personal information, and the existing verified order-support service may supply limited authorized facts needed to answer an order question.
4. Why we use information
We process the relevant information to:
- Answer grounded product, store-policy and customer-support questions and provide merchant-controlled, explicit product/cart actions.
- Display retained conversations and permitted verified customer/order context to the authorized merchant.
- Authenticate access, manage installations and settings, operate the service and provide support.
- Administer accepted agreements, subscriptions, usage and charges through the existing Shopify billing flow.
- Protect tenants, detect abuse and unauthorized access, investigate incidents and maintain service integrity.
- Handle verified access, correction, deletion and other rights requests and meet applicable legal obligations.
We do not sell personal data or share it for independent advertising, cross-context behavioral advertising or cross-merchant profiling. Necessary technical providers process information to supply and protect the service. We do not use Merchant Data to train public general-purpose AI models or authorize that use by our providers.
The App does not make automated credit, eligibility or comparable decisions producing legal or similarly significant effects about shoppers. Merchants remain responsible for their own customer-service and commercial decisions.
5. Legal grounds and merchant responsibilities
For shopper data processed on the merchant's behalf, the merchant is responsible for an appropriate lawful basis, store notices, any required consent and respecting shoppers' choices. Obsedia acts on the merchant's documented instructions under the DPA.
For our separate controller processing, the relevant grounds include performance of a contract where the individual is a contracting party; legitimate interests in administering business relationships, supporting the service and preventing abuse, balanced against individuals' rights; compliance with legal obligations; and consent where required for an optional activity. We do not treat a merchant's acceptance of the DPA as a substitute for any consent legally required from a shopper.
6. Necessary providers and disclosures
Our necessary technical providers include:
- Railway Corporation: application hosting, PostgreSQL and Redis infrastructure, and native encrypted backup services.
- OpenAI, through the applicable API services contracting entity and its authorized providers: AI inference for chat input and relevant approved source/order facts needed for the enabled AI service.
Shopify supplies the commerce platform, identity and authorized API data under its own relationship with the merchant and performs its own platform/billing processing. Shopify's privacy information governs its separate activities.
Technical providers may use their disclosed authorized subprocessors. They receive only information needed for their functions, under applicable processing and confidentiality arrangements. We may also disclose information to professional advisers under confidentiality, to comply with a binding legal requirement, or as necessary to establish or protect legal rights, with appropriate safeguards.
We do not promise zero provider retention. Provider security, abuse-monitoring or legally required records can have a separate retention schedule. OpenAI's API data controls describe its applicable processing and retention practices; an App API setting alone does not establish zero retention or a particular processing location.
7. International processing
The App's primary production hosting and database infrastructure are configured in Railway's Europe region. This is not a guarantee that all provider processing, AI inference, authorized support or subprocessor activity occurs only in that region.
Where personal data is transferred outside the EEA, UK or another protected jurisdiction, we use an applicable lawful transfer mechanism, such as an adequacy decision or the relevant Standard Contractual Clauses and UK addendum, with supplementary safeguards where required. Information about applicable arrangements is available through agents@obsedia.ai and the DPA/provider materials. A hosting-region selection does not replace those safeguards.
8. Retention and deletion
Conversation archive: messages are retained for 90 days from each message's original timestamp. A later message does not restart retention for older messages. Earlier valid deletion requests or termination obligations can require deletion before the 90-day period ends.
Active AI session state: retained under its separate 24-hour lifetime. Expiry of active session state does not by itself remove a separately retained archive message that is still within its permitted period.
Customer panel: profile and purchase-history results are fetched on demand, not retained as a permanent customer directory. Necessary customer/conversation associations are retained only for the retained conversation and applicable rights/security purposes.
Rights and deletion records: restricted records are retained as needed to verify authority, complete requests, prevent deleted data from reappearing and demonstrate fulfillment of obligations. A pending request is not discarded before it is completed. Where a record must be retained for a legal obligation or dispute, it is restricted to that purpose.
Account, agreement, billing and security records: retained only for their applicable contractual, statutory, security or dispute-related purpose, assessed by the record category, legal requirement and whether it remains necessary. This does not extend the ordinary transcript-retention period.
Production infrastructure backups: native daily backups have a six-day rotation period. Backup copies are encrypted and restricted from routine service use. Deletion requirements must be reapplied before restored data returns to ordinary processing. Necessary provider-side security or legal records are governed by their applicable separate arrangements.
Termination and earlier deletion: where Shopify's API terms require deletion following uninstall, loss of necessity or an enforceable request, we delete originals and copies within the applicable 30-day period unless applicable law prohibits or varies that requirement. An earlier legal deadline takes precedence. Any legally required residual record is isolated and not used to continue providing the terminated service.
Data already deleted cannot be recovered by removing an interface limit. A request receipt is not confirmation that deletion or an access response is complete.
9. Security
We use authenticated Shopify boundaries, tenant-scoped authorization and database isolation, restricted runtime roles, protected credentials, encryption for hosted storage and transport, and controlled access to operational data. Internal administrative access is restricted and protected by strong passwords and two-factor authentication. We maintain access-audit, data-loss-prevention and incident-response procedures.
Technical logging is designed to avoid raw transcripts, credentials and unnecessary personal information. Test and production data are separated. Necessary providers implement their own documented security controls. No system can guarantee absolute security; report suspected App incidents promptly to agents@obsedia.ai.
10. Rights and choices
Depending on applicable law, individuals may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, or withdraw consent without affecting earlier lawful processing. Applicable US privacy laws may also provide rights to know, correct, delete, opt out of sale/sharing or targeted advertising, appeal a request decision, and receive nondiscriminatory treatment for exercising those rights. We do not sell personal information or share it for targeted advertising.
Using the chat is optional. Without the information necessary to verify identity or locate an order, the Service may be unable to provide the corresponding customer-specific support. This does not prevent you from contacting the merchant through its other available support channels.
Shoppers should normally contact the merchant whose store they used. Merchants may contact agents@obsedia.ai and use supported Shopify privacy-request channels. We assist the merchant under the DPA. For processing where Obsedia is controller, contact us directly. We respond within applicable legal deadlines, normally within one month for GDPR requests, and explain any permitted extension or refusal.
We may need proportionate verification before disclosure or action. Merchants must verify a requester's authority and review mixed-account or unverified conversations to avoid exposing another person's data. You may complain to your competent supervisory authority, including Romania's National Supervisory Authority for Personal Data Processing where relevant. You may also contact us about an applicable appeal or authorized-agent request.
11. Session storage and children
The App uses necessary browser/session identifiers and storage to operate the chat and maintain session continuity. These functions are not used for independent advertising. Merchants are responsible for their store's required cookie/storage disclosures and choices.
The App is a business service for merchants and is not directed to children. Merchants must not intentionally use it to collect children's personal data unlawfully. Contact us or the merchant if you believe a child has provided information that requires action.
12. Changes and contact
We will publish updates to this policy and notify affected merchants of material changes through an appropriate channel. A new purpose, provider arrangement or permission requiring further notice, consent or acceptance will be handled through the applicable process before the relevant processing begins.
Privacy contact: agents@obsedia.ai. Provider: Genius Nutrition S.R.L., at the address in section 1.