GDPR and privacy controls
The privacy controls implemented in the product. It is not a certification or legal advice.
Roles and instructions
The merchant normally determines why shopper data is processed and acts as controller. Zubby AI processes that data for the connected store under the merchant’s instructions. Merchants remain responsible for their notices, lawful basis, and request verification.
Consent and Global Privacy Control
The storefront widget defaults optional analytics and marketing consent to off. Consent is stored per store. A detected Global Privacy Control signal forces marketing consent off and records do-not-sell/share preference state.
Access and deletion
Authenticated store operators can submit shopper data requests. The GDPR worker exports or deletes the matching profile, aliases, conversations, messages, orders, carts, recommendations, learning signals, journeys, tickets, channel identities, consent records, and related operational rows for that store.
Retention
Conversation retention defaults to 365 days and can be configured by the merchant from 30 to 3,650 days. Scheduled minimization also removes old request payloads, raw webhook payloads, performance telemetry, browse events, and analytics events on their documented service windows.
Infrastructure and vendors
The sub-processors overview describes documented provider categories and when they are used. It is not proof of the provider or region active for every tenant. Request the current hosting and processing details for your review. Conditional AI, email, DNS, source-control, and commerce providers process data when their related feature or routing lane is used.
For a request, contact the merchant that operates the store first. Platform questions can be sent to hello@zubbyai.com.