Privacy Policy

Zubby AI is a service operated by Cuibit. For questions about this policy or your personal data, contact hello@zubbyai.com.

We collect information you provide directly to us, including account details, workspace settings, billing contacts, and support requests. When you connect a store, we also collect store metadata, catalog records, storefront interaction events, and operational logs needed to run Zubby AI securely and reliably.

We use information to provide and improve the service, including answering shopper questions, generating recommendations, powering cart rescue and recovery workflows, authenticating users, measuring usage, preventing abuse, and maintaining auditability, billing accuracy, and platform security.

Connected store content may include product data, collections, variants, storefront events, selected site pages, knowledge documents, and order attribution signals. We process this content on your behalf so the AI agent can answer store-specific questions and report on performance. You are responsible for ensuring you have the right to provide this data to us.

When a merchant connects a Shopify store, the WooCommerce plugin, or our API, we receive the store's customer and order data needed to run the features the merchant turns on: customer names, email addresses, phone numbers, shipping and billing addresses, order details (items, totals, discounts, status, fulfillment and tracking), and product costs the merchant provides. We use it to answer a signed-in shopper's own order questions and verify their identity, attribute sales and profit to the AI agent, run recovery and loyalty messages the merchant enables (email, SMS or WhatsApp only where the shopper can receive them), create support tickets, and show the merchant reports. Shopper messages and the minimum context needed to answer them are sent to our AI infrastructure providers (such as Anthropic, OpenAI, Microsoft Azure OpenAI and Google) to generate replies; we do not sell this data and do not use it to train third-party foundation models. Store access tokens and connection secrets are encrypted with store-bound context and all traffic uses TLS. When a merchant uninstalls the Shopify app, the store's data is scheduled for deletion 48 hours later (cancelled if they reinstall within that window); Shopify's customer data request, customer redaction and shop redaction requests are processed automatically, and verified requests are completed within 30 days.

When a merchant connects a Facebook Page, Instagram professional account, or WhatsApp Business number, we receive the content of messages and comments sent to that business, along with the sender's public name/username and platform user id. We use this data solely to display the conversation to the merchant, generate AI replies, route it to support tickets or sales leads, and let the merchant publish posts and reply to comments on their own account. We request only the permissions these features require, we do not sell this data, and we do not use the content of shopper messages to train third-party foundation models. Use of data obtained via the Meta APIs follows the Meta Platform Terms and Developer Policies. A merchant can disconnect at any time from the dashboard, which revokes our access.

You can request deletion of your data at any time via our privacy contact or by emailing hello@zubbyai.com; we complete verified requests within 30 days. Removing the app from your Facebook settings triggers an automatic deletion of the messages and comments tied to your account through our data-deletion callback. See the subprocessor overview, retention controls and data processing agreement overview for related details.

Depending on your jurisdiction, we process information to perform our contract with you, comply with legal obligations, protect legitimate business interests, and in some cases based on consent. We do not sell personal information. We may share information with subprocessors that help us operate the service, including hosting, payments, observability, email delivery, and AI infrastructure providers, subject to contractual safeguards.

We retain information only for as long as reasonably necessary for service delivery, support, analytics, security, and legal compliance. We use role-based access controls, encrypted secrets, audit logging, and other safeguards designed to protect merchant and shopper data. Subject to applicable law, you may have rights to access, correct, export, or delete personal information. Requests can be submitted through our support or compliance workflows.

If you access the service from outside the country where our providers operate, your information may be transferred across borders. We use appropriate safeguards where required. We may update this Privacy Policy from time to time, and the latest version will always be posted on this page with the effective date reflected in the published site content.