Privacy Policy for Aiwend
Effective date: 2026-11-10 · Last updated: 2026-11-10
1. Who we are
Aiwend is operated by ERFAN TEYMOURIKALGODARI, an individual based in Ankara, Türkiye, trading as Aiwend. Aiwend is not a company and has no separately registered legal entity. We refer to ourselves as "we" or "Aiwend".
Privacy contact: info@erfan.to · Website: https://erfan.to · Contact page: https://erfan.to/en/contact
We are not established in the European Economic Area or the United Kingdom, and we have not appointed a representative there. No postal address, registration number or representative is stated; contact is by email.
2. What Aiwend does
Aiwend is a Shopify app for store owners ("merchants"). It adds an AI shopping assistant to the merchant's storefront, helps the merchant draft product and collection text for review (Content Studio), provides forms (AI Forms) and a Knowledge Base built from the merchant's own store content, and on the Pro plan offers an optional, restricted connection for the merchant's own AI tools. The merchant connects their own AI provider account using their own API key. We do not supply AI access and do not add a markup to AI usage.
This policy explains what data Aiwend handles, why, where, for how long, and what choices exist. It describes how the software behaves; it is not a statement that any particular law applies to or is satisfied by Aiwend.
3. Roles: the merchant and us
- Shopper content (chat messages and form entries, and the identifiers Shopify forwards with a customer privacy request): the merchant decides why and how it is used and is responsible for the notices its store gives its visitors. We process it on the merchant's behalf to run the app.
- Operating data (merchant account data, security and technical logs, usage and billing-status records): we decide how this is used, only to operate, secure and support the service.
4. What we process, and why
| Category | What it contains | Why |
|---|---|---|
| Merchant and shop data | Shop domain and internal id, shop name, Shopify access session (access token, scopes, expiry), app settings, plan and subscription status read from Shopify | Sign-in, operating the app, applying plan allowances |
| Store content read from Shopify | Products, variants, collections, pages, blog articles, shop policies, publication status, and (optionally) translations and locales. Shopify scopes requested: read_products, write_products, read_content, read_legal_policies, read_publications, write_app_proxy, and optionally read_translations and read_locales | Build the Knowledge Base; draft text |
| What we write back | Product and collection description and SEO text only, and only after the merchant approves a draft | Content Studio |
| AI provider credentials | The API key the merchant enters, stored encrypted and decrypted only inside the server call that uses it; deleted when the merchant removes it or uninstalls | Let the merchant's own AI provider run the features |
| Knowledge Base | Copies of the store content the merchant allows, merchant-written entries and uploaded text, split into passages with a search index, and embeddings if the merchant configured an embedding provider | Let the assistant answer from the store's own content |
| Content Studio drafts | AI-suggested text and the original text it was based on, until applied or discarded | Review before anything changes in the store |
| Chat messages | What a shopper types into the chat, the assistant's reply and a reason code for the reply. A visitor is identified only by a random token stored as a one-way hash. Shoppers can type personal data into free text and we cannot detect it. Stored as plain text | Run the storefront assistant |
| Form submissions | The fields a shopper enters into an Aiwend form (may include personal data). Stored as plain text | Run AI Forms |
| Usage and cost records | Provider, model, feature, status, token counts, estimated cost, time. No message text. Linked to the shop | Plan allowances, budgets and cost display |
| Abuse protection | The visitor's IP address is converted to a keyed, truncated hash used only in short-lived counters; the address itself is not stored in the database | Limit abuse |
| Shopify privacy requests | When Shopify forwards a customer's data or erasure request we receive the customer's Shopify id, email and phone number. We use them only to find exact matches in that store's chat and form records, then keep only ids of matched records | Act on the request |
| Technical logs | Web server access log: IP address, time, request method, path without query string, status, size, browser user-agent. Application logs: identifiers, statuses and timings, not message text. A webhook ledger: webhook id, topic, shop domain | Security, reliability, debugging |
We do not collect payment card data (Shopify handles billing), order data or shopper accounts. Aiwend requests no Shopify access to customers or orders and does not query them.
5. AI providers chosen by the merchant
Aiwend runs only on an AI provider the merchant chooses, using the merchant's own key. While a feature the merchant has switched on is running, we send that provider: the shopper's message, recent turns of the conversation and the cited store passages (chat); the text being drafted (Content Studio); passages for embeddings (Knowledge Base); and form entries only when the merchant asks for an AI summary of fields marked for AI use, after a recorded acknowledgement.
Providers a merchant can use for live store and shopper data: OpenAI, Anthropic, xAI, OpenRouter (which forwards requests to third-party model hosts) and GroqCloud.
Restricted providers. Google Gemini and DeepSeek (operated from China) are currently restricted. While the restriction is on, Aiwend refuses to send live store or shopper content to them, whatever key the merchant holds, and they cannot be newly selected; a key a merchant saved earlier and any existing setting are kept unchanged and can still be tested, replaced or removed. The restriction is shown in the app's Providers page. It is enforced by Aiwend and is not lifted by a paid provider plan or by any agreement the merchant has with the provider. Aiwend may change this list; this policy will be updated when it does.
Each provider's processing, retention, storage location and terms are set by that provider and the agreement the merchant holds with it. Data sent to a provider may be processed outside Türkiye, the European Economic Area and the merchant's own country. We cannot control or promise where a provider processes data. The merchant is responsible for choosing a provider and contract suitable for its store, and for the charges its provider makes. Aiwend's budget and rate limits are safeguards inside the app; they are not spending caps set at the provider.
Aiwend does not use merchant or shopper content to train or improve AI models. Aiwend cannot control what your AI provider does with the requests you send it: terms differ between providers and between plans, and some providers may use submitted content to improve their models or keep it for a period. Check your provider's terms and settings before you connect it. For example, Google's terms for the free (unpaid) Gemini API allow Google to use submitted content to improve its products, and DeepSeek's privacy policy says it stores data in the People's Republic of China and may use inputs to train its models. We have not confirmed how DeepSeek treats API requests. Read each provider's terms before connecting it.
6. Where data is hosted and who else is involved
Aiwend's server is hosted by Hetzner Online GmbH in Germany, so data held on it is stored in Germany. Data sent to the merchant's AI provider and to Shopify is processed where those companies decide; we do not claim that all personal data stays in Germany.
| Party | Role |
|---|---|
| Hetzner Online GmbH | Hosting of the server and provider-side storage of any server snapshots we create |
| Shopify | The platform, sign-in, app billing, and the privacy-request webhooks |
| The merchant's AI provider(s) | Process AI requests as described in section 5, under the merchant's own agreement |
We administer the server from Türkiye, so we access the data held in Germany from there, and encrypted copies of the database made by the operator can also be held in Türkiye. The server is hosted by Hetzner Online GmbH in Nuremberg, Germany, under a data processing agreement the operator concluded with Hetzner on 9 November 2026. That agreement covers Hetzner's own processing; encrypting our data and backups on the server is our responsibility, and we do not encrypt the server disk or snapshots (see section 9). This policy does not claim any international-transfer mechanism beyond that: no adequacy decision, standard contractual clauses or binding corporate rules are in place between Aiwend and any merchant. Whether a transfer safeguard is required, and which party must put it in place, depends on where the merchant is established and on the processing in question; for the data sent to the AI provider the merchant has chosen, the provider's location and terms apply.
Data flows and who is responsible. This table describes what happens. It is not a transfer mechanism and does not say that any law is met.
| Flow | What happens | Position |
|---|---|---|
| Merchant (and its visitors) to Aiwend | Data reaches the server hosted in Germany; Aiwend is operated from Türkiye | No transfer instrument between Aiwend and any merchant is in place or claimed. |
| Operator administration from Türkiye | The operator reads and administers the data in Germany from Türkiye | Same as above |
| Encrypted copies in Türkiye | Encrypted database copies and register copies may be held on the operator's computer in Türkiye | Same as above; the copies are encrypted, the server is not |
| Aiwend to Hetzner | Hetzner Online GmbH hosts the server in Nuremberg, Germany, under the agreement concluded on 9 November 2026 | Covers Hetzner's own processing only |
| Merchant to its AI provider | Requests leave the server for the provider the merchant chose, under the merchant's key and contract | The provider sets processing and location; the merchant is responsible for that contract and for any safeguard it needs |
| OpenRouter | A routing service that forwards requests to third-party model hosts under the merchant's OpenRouter settings | We cannot see or control which host receives a request; the same responsibility as the row above |
7. How long we keep data
Automatic deletion runs hourly in a background worker unless stated.
| Data | Retention |
|---|---|
| Chat conversations | Deleted 7 days after the last message by default; never kept more than 30 days after the conversation started. The merchant can choose 1 to 30 days and can delete a conversation immediately |
| Form submissions | 90 days by default (merchant-set 1 to 365 days) or sooner if the merchant deletes them |
| Content Studio drafts | Each draft expires after 30 days and is then deleted by the hourly job shortly afterwards; also deleted when discarded and on uninstall |
| Knowledge Base | Until the merchant removes or excludes a source; deleted on uninstall |
| Shopify privacy-request results | 60 days |
| Finished background jobs, administrative and tool-connection audit records, webhook ledger | 30 days |
| Rate-limit and daily counters | Minutes to a few days; plan-quota operation keys about two months |
| Usage and cost records | No automatic deletion today. Kept while the app is installed; deleted when Shopify's shop-erasure request is processed (about 48 hours after uninstall). They contain no message text. |
| Settings | While the app is installed |
| Web server access logs | Rotated daily; up to 14 files kept, so normally about two weeks |
| Application logs | Limited by size, not time |
On uninstall: access, the AI provider key and plan status are removed immediately; sessions, Knowledge Base, drafts, chats, forms, tool-connection credentials and audit records and privacy-request results are also deleted immediately. Settings and usage records remain until Shopify's shop-erasure request arrives, at which point everything held for the store is deleted.
Backups, snapshots and database copies
There are no scheduled backups. From time to time, before a software release or other risky change, the operator creates:
- a whole-server snapshot held by Hetzner, and
- a database export of the production database, with an encrypted copy stored by the operator outside the server, which can be on the operator's computer in Türkiye; an encrypted copy can also remain on the server itself.
Our policy, adopted on 10 November 2026, is that every snapshot and database export is deleted no later than 30 days after it was first made; copying, renaming, re-encrypting or restoring a copy does not restart that period. The operator carries out the deletions by hand, using an inventory of copies with their original creation dates and a daily expiry check; deletion is not automatic. A database export is first written in the database's ordinary, unencrypted format; the encrypted copy is made from it, and the unencrypted file can remain on the server until the operator deletes it. Because the server is shared with the operator's other Aiwend environments, a snapshot contains every store's data present on the server at that moment, including chat text, form entries and usage records. A snapshot or export cannot be selectively erased. Until it is deleted, data you delete in the app, including by uninstall or Shopify's erasure request, can remain in it, and erasure requests are not applied inside it. If a copy is ever restored, erasures made after it was taken are applied again by the operator, using the register of deletion events described in section 8 where it covers them, and by hand otherwise.
8. Privacy requests
Merchants can view and delete chat conversations and form submissions in the app. When Shopify forwards a customer's request for data or erasure, we search that store's chat and form records for the customer's exact email address (or exact phone number in form fields). For erasure we delete the matches; for a data request we show the merchant the matching records so it can respond to the customer. We cannot find records that do not contain the identifier, such as an anonymous chat that never mentions it; those expire under section 7. We do not claim to find every record a person may have typed.
Shopify's privacy webhooks are processed automatically on arrival. Shoppers should normally contact the store they used. You can also write to info@erfan.to; where the store decides how your data is used, we will refer the request to the store or help it act on it. Records inside snapshots and exports (section 7) are not reached by these requests.
Records of deletion events. When Shopify tells us a store has uninstalled, or forwards a store or customer erasure request, we first write a short record to a register on a separate storage volume at our hosting provider, and then delete the data. The register holds the store's domain, Shopify's event identifier and the time. It does not hold the person's name, email address or phone number: for a customer request it holds only keyed one-way tokens derived from the customer's email or phone number together with the store, which cannot be reversed without a secret key that is kept separately from the register. Its purpose is to let us apply the same deletions again if the database is ever restored from an older copy. The operator makes encrypted copies of the register, normally daily, on the operator's computer in Türkiye. The register is not deleted when a store uninstalls, because that would defeat its purpose. We do not promise that every event is recorded or re-applied: a record can be missing if the storage volume and the most recent copy are both lost, and if the operator's computer is unavailable the copies may be too. Our policy is to keep an entry only for as long as a copy made before it could still be restored, which is at most 30 days after that copy was made; the operator removes entries by hand after that. We aim to respond promptly. This policy does not shorten or replace any deadline or right that applicable law gives you for answering a request: where the GDPR or the UK GDPR applies, a request is answered within one month (Article 12(3), extendable in the cases the Article allows), and where the KVKK applies within thirty days at the latest (Article 13).
9. Security
Implemented: provider keys are encrypted at rest (AES-256-GCM); tool-connection tokens and visitor tokens are stored as one-way hashes; each store's records are separated and queries are scoped to the verified store; Shopify webhooks and storefront requests are verified by signature before any data is read; public routes have rate and size limits; application logs omit message text and redact secret-like content; traffic uses TLS; the database is not reachable from the internet; administrative access uses key-based authentication.
Not implemented and not claimed: chat messages and form entries are stored as plain text without application-level encryption; the server disk is not encrypted by us; snapshots are not encrypted by us; we hold no security certification; we do not promise uninterrupted availability, guaranteed deletion across every system, or zero data retention.
Who can access data. The operator is the only person with administrator access to the production server and database and has the technical ability to read stored records, including chat and form text. The operator does not read them in normal operation. Each merchant can read only its own store's chats, forms and drafts. Shopify, Hetzner and the merchant's AI provider process data as described above. If we become aware of a personal data breach affecting data we process on a merchant's behalf, we will notify that merchant, as the controller, without undue delay, and we will notify Shopify, any competent authority and others within the periods that applicable law and our agreements require.
10. Merchant responsibilities
The merchant is responsible for the notice its store gives shoppers (the chat widget shows a short notice that messages may be processed by the store's AI provider and asks shoppers not to share sensitive details; it does not link to a privacy policy, so the merchant should cover the chat in its own store privacy policy), for choosing and contracting its AI provider, for lawful use of shopper content, for acting on customer data requests we surface, and for the content it adds to the Knowledge Base and forms.
11. Children
Aiwend is a business tool and is not directed at children. A store's chat or forms may be used by anyone who visits the store; the merchant decides whether that is appropriate for its audience.
12. Applicable law
Aiwend is operated from Türkiye, so Turkish data-protection law (KVKK) may apply, and the EU/UK GDPR or other laws may apply to some merchants and visitors. This policy does not state that Aiwend complies with any of them.
13. Changes to this policy
We will update this page and its "Last updated" date when our data handling or this policy changes, and for material changes we will also post a notice on the Aiwend pages of this website.
14. Contact
ERFAN TEYMOURIKALGODARI, Ankara, Türkiye, trading as Aiwend · info@erfan.to · https://erfan.to/en/contact
See also: Terms of Service