Privacy policy

Scope

This policy covers BNZ Advise (“the app”), the Shopify application published by BNZ, SARL. It describes what the app processes on behalf of a merchant who installs it, and what it processes when a shopper uses the chat widget on that merchant's storefront.

The merchant is the data controller for their storefront. BNZ acts as a processor on their instructions. Information about the bnzed.fr website itself is in the legal notice.

Data we process

Store data

On installation, the app receives from Shopify the store's domain and its product catalogue — the same information a shopper sees on the storefront — along with the merchant's contact details as Shopify provides them. It also holds any document the merchant chooses to add to the app's knowledge base.

Shopper data

When a shopper uses the widget, the app records the conversation, an anonymous session identifier, the products shown or added to the cart during that session, and any rating left on an answer. If an order follows, it records the order reference and its amount, so the merchant can see which conversations led to a sale.

What the app does not collect

The app does not ask Shopify for access to customer records, and receives no customer name, email address or customer ID. A conversation is tied to an anonymous session identifier and nothing else. Whatever a shopper types is kept as part of the transcript — including personal information they choose to enter — and the erasure rights below apply to it.

Browser storage

The widget keeps a few values in the browser's local storage, so that a conversation survives a page change and the same invitation is not shown twice. They are not advertising cookies, they are not shared with anyone, and clearing the site's data removes them.

Why we process it

• To answer shopper questions from the merchant's own catalogue and documents.
• To show the merchant which products raise questions and which conversations end in a cart.
• To apply the limits of the merchant's subscription plan.
• To diagnose faults and keep the service running.

We do not sell data, we do not share it with advertisers, and we do not use merchant catalogues or shopper conversations to train models.

Who else receives it

• OpenAI generates the answers. The shopper's question and the relevant catalogue extracts are sent to its API and processed in the United States. OpenAI does not use content submitted through its API to train its models. See the OpenAI privacy policy.
• Our hosting provider, within the European Union, stores the data on our behalf and does not access it.

No one else receives this data.

Retention and erasure

• Catalogue, documents, conversations and analytics are kept for as long as the app is installed on the store.
• When a merchant uninstalls, Shopify sends a shop erasure request 48 hours later. On receipt we delete the store's data.
• A customer erasure request relayed by Shopify is honoured on receipt, on the conversation data concerned.
• A merchant may ask for erasure at any time without uninstalling, using the address below.

Your rights

Under the GDPR you may request access to the data we hold, its rectification, its erasure, its portability, or object to its processing. Write to renaud@bnzed.fr and we will answer within one month.

The app implements Shopify's three mandatory compliance webhooks — customer data request, customer redaction and shop redaction — so a request made through Shopify reaches us automatically.

You may also lodge a complaint with the CNIL, the French supervisory authority.

Security

Data travels over encrypted connections and is stored on servers that are not publicly reachable. Access is limited to the people who operate the service, and each store's data is kept isolated from every other store's.

Changes

If this policy changes materially, the date at the top of this page changes with it and merchants using the app are notified by email.

Contact

BNZ, SARL — 101 730 224 R.C.S. Boulogne-sur-Mer
renaud@bnzed.fr