How VoiceAgent handles information

1. Who is responsible

AZ Digital Inc. provides and operates VoiceAgent. A Shopify merchant decides whether to install the app, where the widget appears, its settings, and which approved store content is available to shoppers. The merchant remains responsible for its storefront, products, notices, consents, and its own use of app outputs. Depending on the context and applicable law, AZ Digital may act as the merchant's service provider or processor and may act independently for account, security, billing, legal-compliance, and support records.

2. Information processed

Merchant, store, and administrator information

• Shopify store domain, installation state, scopes, locale, app and billing status, configuration versions, and eligibility records.
• Shopify administrator session fields that Shopify supplies, which can include user ID, name, email, locale, role flags, session expiry, and encrypted access or refresh credentials.
• Products, collections, publication state, prices, variants, legal policies, locales, and merchant-approved FAQ or knowledge content available through the app's Shopify permissions.
• Settings for languages, voice, widget, privacy review, retention, usage protection, and activation.

Anonymous storefront and session information

• An anonymous session ID, store, page type, storefront locale, market, currency, device class, session timing, outcome, bounded quality signals, tool result status, usage, and feedback.
• A random shop-bound device identifier stored as a signed browser token for up to 30 days. The server stores a shop-scoped one-way HMAC rather than the random device identifier itself.
• Forwarded network information is used transiently to create a daily rotating one-way network HMAC for abuse controls. VoiceAgent does not write the raw forwarded IP address to app storage.
• Product and cart identifiers and action results needed during a session to answer a request and perform a separately confirmed cart action.

Voice, text, and support information

• Microphone audio, generated audio, live-session instructions, and relevant tool context processed by Google Gemini or OpenAI according to the saved voice. Typed chat is processed by OpenAI.
• Finalized source text that is redacted before app display or any selected English translation or review processing. Redaction reduces risk but cannot be guaranteed to identify every sensitive detail.
• Temporary conversation memory, encrypted in the app's short-term store so follow-up questions work across voice and typed chat: the redacted text of the shopper's latest message for up to 30 seconds while an answer is prepared and, for no longer than the conversation's 30-minute lifetime, short quotes of preferences the shopper states (budget, size, colour and allergies) and a short excerpt of their latest redacted message (up to 384 bytes of text). The quotes and excerpt are included as context when the assistant answers, so the selected voice or chat provider processes them as described below. The memory expires automatically within the conversation's 30-minute lifetime. Stated allergies only guide product answers and are not medical or product-safety advice.
• A redacted English summary or redacted English turns when the merchant enables that review mode.
• Redacted display messages and public product cards kept in the current browser tab so shoppers can continue after navigating or reloading a store page. This browser history excludes audio, session credentials, and cart confirmation permissions. Recent redacted messages may be sent to the assistant provider as context when the shopper continues the conversation.
• Contact details and message content a merchant voluntarily sends to support. Merchants should follow the restrictions on the support page.

3. Why information is used

• Authenticate the Shopify app and keep store access tenant-safe.
• Ground answers in eligible, published Shopify product and policy data and revalidate cart actions.
• Deliver voice and chat, apply language settings, and return product, cart, checkout, or contact handoffs.
• Enforce session, device, store, plan, cost, concurrency, replay, abuse, and provider-safety boundaries.
• Provide merchant analytics, reconcile usage and Shopify billing, investigate failures, answer support requests, and meet legal or Shopify compliance obligations.

4. OpenAI processing

When an OpenAI voice is selected, voice uses the Realtime API. Audio travels through a WebRTC connection and the server controls model requests, tools and usage. Typed chat uses the Responses API with response storage disabled. The app does not send payment, customer account or order records to these features.

OpenAI does not train on API data by default unless the customer opts in. Its default abuse monitoring may retain customer content for up to 30 days, or longer where legally required. This app does not claim approved zero data retention. See OpenAI’s data controls.

The app encrypts a redacted typed answer and its delivery fingerprint in Redis for up to 90 seconds to handle a retry without another paid answer. Public product references may remain for the 30-minute conversation. Budget receipts contain numerical usage, model and pseudonymous session identifiers, without source audio or question text.

Google Gemini processing

The storefront receives a short-lived, constrained credential and connects to Google Gemini Live for a bounded session. VoiceAgent requests session-resumption state. Google states that requested Live resumption state may contain text, audio, or video and may remain provider-side for up to 24 hours. This state is separate from VoiceAgent's application database.

Google also describes provider-level abuse monitoring that may retain prompts, contextual information, and outputs for up to 55 days and may include authorized human review. See Google's Live data-retention guidanceand Gemini API usage policies.

Production project setting observed August 25, 2026:Google AI Studio shows developer-owned storage disabled for the GenerateContent API. Storage for the separate Interactions API is enabled at its 55-day default, but VoiceAgent does not call the Interactions API. VoiceAgent application code does not set a per-request storage override, create Google datasets, or add its calls to a dataset. These account settings can be changed by a project administrator; AZ Digital will update this disclosure before using a different storage or dataset setting for VoiceAgent production calls. Google's platform abuse monitoring remains separate. See Google's API logs and datasets policy.

5. Retention

• Raw audio and source-language transcripts: not retained in VoiceAgent's server database, logs, or analytics. Provider-side processing is described above.
• Temporary conversation memory: encrypted redacted shopper text for up to 30 seconds, and stated preferences with a short excerpt of the latest message for no longer than the conversation's 30-minute lifetime, as described above. It is kept in the app's short-term store and shared with the voice or chat provider only as context for the conversation.
• Browser conversation history: redacted display messages and public cards remain in the same tab for up to 30 minutes of inactivity. Selecting End conversation clears this history. Voice pauses on navigation and resumes only after a shopper action.
• Conversation review text: analytics-only mode retains no review text. Redacted English summaries or turns use the merchant's selected 7-, 30-, or 90-day period. Related session events follow that review deadline unless a separate rule below is required.
• Device and network protection data: rotating shop-scoped HMAC values on completed sessions and rolling device usage records normally expire after about 25 hours. Short-lived Redis keys range from seconds to the relevant 10-minute, UTC-day, rolling-day, or verified Shopify billing-period boundary. They are used for admission, replay, cost, and abuse controls, not customer profiles.
• Issued-credential risk reservations: once Google issues a constrained credential, VoiceAgent reserves the possible non-billable 600-second session allowance even if the browser never connects or stops heartbeating. The fixed credential-exposure slot can last up to 660 seconds. Admission-only aggregates remain through the applicable store UTC day, the exact verified Shopify billing period, and—for the pseudonymous device boundary—final possible use plus 24 hours. These reservations limit cost and abuse risk and are not treated as connected-time billing.
• Usage and billing evidence: normally retained for 400 days and then scheduled for deletion so usage can be reconciled with Shopify. It can be deleted earlier by a required shop-redaction event where applicable.
• Daily aggregate analytics: retained for the full metric day plus about 400 days. Aggregates contain no session, shopper, device, network, product, order, audio, or transcript identifier.
• Webhook receipts: normally retained for 30 days. Unresolved destructive or billing work can remain until it is safely completed or no longer required for deduplication and legal obligations.
• Support and legal records: retained as reasonably necessary to answer the request, document the resolution, prevent abuse, and meet applicable legal obligations.

Scheduled deletion is performed in bounded batches, so physical removal can occur after a stated deadline. Backups and provider systems may age out on their separate controlled schedules.

6. Deletion, uninstall, and Shopify redaction

An authorized merchant can delete an individual retained English conversation review in the app. The review text is erased immediately and the terminal session record is scheduled for the bounded retention worker; independent billing evidence and aggregate metrics continue under the periods above. The current app does not offer a merchant-facing date-range or all-data deletion button.

Uninstall immediately blocks new storefront use and starts revocation, settlement, and cleanup work; it is not itself a promise of immediate erasure. Shopify's authenticated shop-redaction process later deletes the shop row and cascaded app-owned tenant data. Minimal pseudonymized receipt metadata may remain to prove and deduplicate compliance processing. A Google Live connection already issued to a browser cannot be revoked by Vercel and has a fixed maximum exposure window of approximately 11 minutes.

7. Service providers and transfers

VoiceAgent uses Shopify, Vercel, Supabase, Upstash, OpenAI and Google to deliver the service. The production web functions, primary database, and Redis resource are configured in Canadian regions, but AI provider processing, content delivery, control planes, support, security, and other provider operations may occur outside Canada. VoiceAgent does not promise Canadian-only processing. The current provider purposes and location boundaries are listed on the subprocessors page.

8. Security

AZ Digital uses tenant-scoped authorization, encrypted transport, application-layer encryption for stored Shopify access and refresh credentials, restricted production database roles, short-lived Google credentials, signed storefront sessions, confirmation and replay controls, and bounded logs. No safeguard eliminates all risk, and not every database field is encrypted again at the application layer.

9. Adult-directed service and shopper choices

VoiceAgent is available only for stores and experiences directed to adults aged 18 or older and is not intended for child-directed use. Shoppers can use the storefront without starting a VoiceAgent voice session, deny or revoke microphone permission, end a session, clear site storage through browser controls, and decline any proposed cart action.

10. Access, correction, deletion, and questions

Merchants and shoppers can contact AZ Digital about information handled by VoiceAgent. Provide the store domain, the nature of the request, and an anonymous conversation ID if available, but do not send sensitive data. AZ Digital may need to verify the requester's authority and may direct a shopper to the merchant when the merchant controls the relevant information. Applicable legal rights and exceptions continue to apply.

11. Changes to this policy

AZ Digital will update the date on this page when this policy changes. Material changes that affect merchant configuration or required disclosures may also be communicated through the Shopify app or the merchant support channel where appropriate.