Legal

Privacy Policy

Last updated: June 10, 2026

At brng.ai, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our platform, or interact with our services.

1. Information We Collect

Information You Provide

When you book a demo, create an account, or contact us, we may collect:

  • Name, email address, and phone number
  • Company name and website URL
  • Messages or feedback you submit through forms
  • Payment and billing information (processed securely via third-party providers)

Information Collected Automatically

When you use our website or platform, we may automatically collect:

  • Device information (browser type, operating system, device identifiers)
  • Usage data (pages visited, time spent, search queries, interaction with search results)
  • Location data (IP address, approximate location based on IP) — applies to visitors of our website and end-users of direct-integrated brng.ai deployments. We do not collect IP addresses or location data from shoppers using the BrngAI Shopify App's storefront widget. See Section 3 for details.
  • Cookies and similar tracking technologies

End-User Search Data

When brng.ai is deployed on a customer's website, we process search queries entered by that customer's end users. This data is used to deliver and improve search results, enhance platform performance, and develop our products and services. We may also use aggregated or anonymized search data for analytics, research, and to train and improve our AI models.

2. How We Use Your Information

We use the information we collect to:

  • Provide and maintain our services
  • Improve and personalize your experience
  • Process transactions and manage your account
  • Communicate with you about updates, security, and promotions
  • Analyze usage patterns to enhance platform performance
  • Comply with legal obligations and enforce our terms

3. BrngAI Shopify App

This section applies if you are a merchant using the BrngAI Shopify App on your Shopify store, or a shopper using the on-storefront search widget powered by the app. It describes data flows specific to the Shopify integration that differ from our general practices described above.

3.1 Data we access via the Shopify Admin API

With your explicit consent at install time, the BrngAI Shopify App requests these Shopify Admin API scopes:

  • read_products — to ingest your product catalog (titles, descriptions, variants, images, prices, inventory levels, vendor, product type, and tags) and use it as the knowledge base of the AI-powered search widget.
  • read_orders — to receive orders/create webhook events and attribute completed orders to widget interactions for revenue analytics. We read total order value, currency, timestamp, and line-item product references only; we do not read or store customer billing addresses, payment methods, shipping details, or customer contact information from these payloads.
  • read_customer_events — to record on-storefront events from Shopify's web pixel API (product views, cart additions, checkout starts, order completions). Event payloads include the numeric Shopify customer identifier (where available) but no customer name, email, address, or phone number.
  • write_pixels — to install and update our web analytics pixel on your storefront.

You can review and revoke these permissions at any time from your Shopify admin under Apps → BrngAI Product Search.

3.2 Data we do not access

The BrngAI Shopify App does not request, store, or otherwise access:

  • Customer names, postal addresses, email addresses, or phone numbers
  • Customer payment-card details or financial information
  • Customer date of birth or demographic information
  • Order shipping addresses or carrier tracking details
  • Product cost or supplier information
  • Any data outside the scopes listed in Section 3.1

If we add a feature that would require additional scopes, we will prompt you to re-approve the app's permissions at next load; new data flows do not begin until you approve.

3.3 Storefront widget data

When a shopper uses the BrngAI search widget on your storefront, we collect:

  • The text of their search query
  • Click-through events to product or collection pages
  • Anonymous per-session metadata used only for conversational follow-up responses; the session resets when the shopper closes their browser

We do not collect from storefront shoppers:

  • IP address (the IP is read transiently from the request only for abuse-prevention rate-limiting, then discarded without being written to any database, log, or analytics record)
  • IP-derived geolocation (country, region, city, coordinates)
  • Names, email addresses, phone numbers, or other contact details
  • Browser fingerprints
  • Aggregated geographic analytics of any kind

This handling is enforced at the data-ingest layer: our application checks whether the originating shop is installed via the Shopify App Store and, if so, never persists IP address, never performs geolocation lookup, and never writes to the geographic-aggregation table. As a consequence, the geographic analytics surface in our merchant admin returns no data for Shopify App Store shops.

3.4 Storefront analytics events

We capture three categories of storefront analytics events today:

  • Widget interactions — search queries, click-throughs, and in-widget product views — are captured by the search widget itself and described in Section 3.3.
  • Order completions are received via Shopify's orders/create webhook (the read_orders scope). From each order payload we read only the order identifier, total amount, currency, timestamp, and line-item product references. We do not read, store, or process customer names, email addresses, postal addresses, payment-card details, or any other personally identifying customer information from these payloads.
  • Web pixel events — the BrngAI Analytics web pixel is registered on your storefront under the write_pixels scope. Its event handlers are currently inactive pending integration work; no shopper event data flows through the pixel today. When event handlers are enabled in a future update, the pixel will track checkout-start and checkout-completion events, and the payloads will include a Shopify-assigned customer identifier (where available) along with product or order references and a timestamp. We will update this policy before activating the pixel to describe the new data flow.

3.5 Shopify Protected Customer Data policy and GDPR webhooks

We comply with Shopify's Protected Customer Data (PCD) Policy:

  • We request only the Admin API scopes required to operate the app (see Section 3.1) and do not request access to elevated PCD scopes.
  • We minimize collection of any personally identifying data from storefront shoppers (see Section 3.3).
  • We honor the three mandatory GDPR webhooks Shopify sends to all apps:
  • customers/data_request — when a shopper submits a data access request via Shopify, we acknowledge the webhook immediately and then asynchronously compile any data we hold for that Shopify customer identifier — search history, in-widget interactions, and order-completion events — into a JSON export. We email the export to the merchant's contact email, with an internal audit copy retained at brng.ai. Completion is well within Shopify's 30-day SLA, typically within minutes.
  • customers/redact — when a shopper submits a deletion request via Shopify, we receive a webhook identifying the shopper by Shopify customer identifier. We blank any IP addresses associated with that customer in our analytics tables. Because we do not collect shopper IP addresses from the storefront widget (Section 3.3), this operation typically performs no change; the redaction logic runs defensively so that any data that were present would be removed.
  • shop/redact — when a merchant uninstalls the BrngAI Shopify App, Shopify sends this webhook 48 hours later. Upon receipt, we delete all data associated with the shop — the merchant account, configuration, raw and aggregated analytics history, and the ingested catalog and webpage embeddings stored in our vector database. Deletion typically completes within seconds and is always completed within 48 hours of receipt.

3.6 Data retention for Shopify shops

Retention windows depend on your plan tier and the data type:

Data type Starter Growth Pro
Raw search-event history (per-query rows) 30 days 180 days Unlimited
Aggregated analytics (daily, monthly, yearly) Retained while the subscription is active; the merchant analytics dashboard displays up to the most recent 12 months Same Same
Ingested product catalog (with embeddings in vector database) While the app is installed While the app is installed While the app is installed
Merchant account and shop configuration While the app is installed While the app is installed While the app is installed

On uninstall, the shop is marked inactive and data is preserved pending Shopify's 48-hour shop/redact webhook (this allows the merchant to reinstall and resume without data loss within that window). Within 48 hours of receiving shop/redact, all shop-related data is permanently deleted from our primary database and vector database.

3.7 Third-Party Services Specific to Shopify Shops

When you use the BrngAI Shopify App, the following third-party services are involved in handling your data. The full list of all services we use (including those used only for non-Shopify deployments) appears in Section 4.

  • Shopify — Shopify Billing handles all subscription charges for the app under the Managed Pricing model. We do not process Shopify-shop payments via any other provider.
  • Amazon Web Services (SES) — sends transactional email to merchants, including over-capacity warnings and support correspondence.
  • Groq (primary) and OpenAI / Anthropic (failover) — large-language-model inference used to generate conversational search responses.
  • DeepInfra — text-embedding inference for your product catalog and crawled content.
  • Weaviate — vector database that hosts the embeddings above.
  • Dedicated infrastructure provider — bare-metal servers hosting the application and primary PostgreSQL database.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

  • Service providers: Third-party vendors who help us operate our business (e.g., hosting, payment processing, analytics)
  • Legal requirements: When required by law or to protect our rights, safety, or property
  • Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users
  • Business partners: We may share aggregated or anonymized data with partners for analytics, benchmarking, or commercial purposes
  • With your consent: When you explicitly authorize us to share information

Third-Party Services We Use

We use the following third-party services to deliver our application. We share with each only the minimum data needed for them to perform their function, and we do not authorize any of them to use your data outside the scope of the service they provide to us. Each provider operates under its own privacy policy and terms of service, which you can review at the provider's website.

Shared infrastructure (all customers):

  • Amazon Web Services — authentication (AWS Cognito), transactional email delivery (AWS SES), and internal job queues (AWS SQS).
  • Groq — primary large-language-model inference provider.
  • OpenAI — alternative LLM provider used as failover.
  • Anthropic — alternative LLM provider used as failover.
  • DeepInfra — text-embedding inference.
  • Weaviate — vector database hosting embeddings.
  • Dedicated infrastructure provider — bare-metal hosting for the application and primary PostgreSQL database.

Used only for direct (non-Shopify) deployments:

  • Stripe — payment processing for direct (non-Shopify) clients. Shopify-merchant payments are handled exclusively by Shopify Billing (see Section 3.7).
  • MaxMind (GeoLite2) — offline IP-to-location lookup. Not used for Shopify App Store shops; see Section 3.3.
  • Cloudflare (Turnstile) — bot-protection CAPTCHA on brng.ai sign-up and login. Shopify merchants authenticate via Shopify OAuth and do not encounter this challenge.

5. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit and at rest, access controls, regular security audits, and secure development practices. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we securely delete or anonymize it. For users of the BrngAI Shopify App specifically, retention is tied to your plan tier and data type; see Section 3.6 for the full table and post-uninstall behavior.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access, correct, or delete your personal information
  • Object to or restrict certain processing activities
  • Request data portability
  • Withdraw consent at any time
  • Lodge a complaint with a supervisory authority

For shoppers on stores using the BrngAI Shopify App, data-subject requests are processed via Shopify's customers/data_request and customers/redact webhooks; we handle these within Shopify-required timelines (see Section 3.5). Merchants may additionally contact us directly using the address below.

To exercise any of these rights, please contact us at [email protected].

8. Cookies

We use cookies and similar technologies to enhance your experience, analyze site traffic, and understand usage patterns. You can control cookie preferences through your browser settings. Disabling cookies may affect after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, please contact us at [email protected].