Privacy Policy

Trabot.ai is a product of Growth15 Ltd, a company registered in England and Wales under company number 13552418. In this policy, "Trabot", "we", "us" and "our" refer to Growth15 Ltd. You can reach us at support@trabot.ai.

This policy covers personal data processed through:

• The trabot.ai marketing website (this site).
• The Trabot merchant application at app.trabot.ai, including the Shopify app listing and the standalone dashboard.
• The AI sales agent that operates on the messaging and social channels the merchant connects (for example, WhatsApp via Meta's Business Platform, Instagram and Messenger via Meta, and web chat embedded on the merchant's storefront).

For visitors to trabot.ai and merchants who sign up for an account, Growth15 Ltd is the data controller.

For end-customer conversations that happen on a merchant's WhatsApp number, the merchant is the data controller and Growth15 Ltd acts as a processor on their behalf, under a Data Processing Addendum. Merchants remain responsible for the lawful basis of every message they send to their customers.

Depending on the surface, we process the following categories:

• Merchant account data: name, work email, password hash, Shopify store URL, billing details, roles and permissions.
• Shopify store data: products, collections, orders, fulfilments, customer records and metafields — read via the Shopify Admin API under the scopes you approve at install.
• Messaging & social channel conversations: message content, media, timestamps, sender identifiers (WhatsApp phone numbers, Instagram / Messenger IDs, web-chat visitor IDs), and message status — received from and sent through the channels the merchant connects.
• Merchant-provided knowledge sources: the content of the merchant's website (catalogue, product pages, published content) and any documents the merchant uploads (policies, PDFs, terms, ops docs) — indexed to provide the service.
• AI processing metadata: prompts, agent responses, tool calls, latency, token counts.
• Usage and diagnostic data: IP address, browser and OS, pages viewed, error traces.

We do not intentionally collect special-category data. Please do not send special-category personal data through the agent.

• Provide the service (contract) — running the agent, syncing your Shopify catalogue, sending replies on your WhatsApp number.
• Bill, prevent abuse, and keep the service secure (legitimate interest, legal obligation).
• Improve product quality (legitimate interest) — aggregated, de-identified metrics only.
• Send transactional emails about your account (contract) and, where you have opted in, product updates (consent).

To deliver the service we rely on the following categories of sub-processors:

• Messaging & social: Meta Platforms (WhatsApp Business Platform, Instagram, Messenger) — message delivery on the merchant's connected channels.
• AI models: OpenAI, Ireland (LLM inference for agent responses).
• Hosting and storage: Amazon Web Services EMEA SARL — region eu-central-1 (Frankfurt).
• Payments: Shopify Billing (for merchants who subscribe through the Shopify app), and our direct billing processor for merchants who subscribe outside Shopify.

A current list of named sub-processors is available on request from support@trabot.ai. We give at least 30 days' notice of a material change so you can object.

Merchant and conversation data are stored in AWS eu-central-1 (Frankfurt, Germany). Some sub-processors may transfer data outside the UK/EEA under Standard Contractual Clauses and the UK International Data Transfer Addendum.

• Merchant account data: for the life of the account and up to 12 months after closure for billing and audit.
• WhatsApp conversations and Shopify data: deleted within 48 hours after the app is uninstalled from your Shopify store, or on written request from the controller, whichever is sooner. Automated deletion is triggered by the Shopifyapp/uninstalled webhook.
• Diagnostic logs: up to 30 days, then aggregated.

We implement the three Shopify GDPR compliance webhooks that Shopify requires of every listed app:

• customers/data_request — on request from a shop's customer, we return the personal data we hold about that customer for the shop, via the shop owner, within 30 days.
• customers/redact — we delete a specific customer's personal data on request, provided the shop has not asked us to retain it for a legal reason.
• shop/redact — 48 hours after a shop uninstalls Trabot, we permanently delete all data belonging to that shop.

Depending on where you live, you may have the right to access, correct, erase, restrict, port, or object to our processing of your personal data, and to withdraw consent where processing is based on consent. You can also complain to your local supervisory authority (in the UK, the ICO).

To exercise a right, email support@trabot.ai. If we process your data as a processor on behalf of a merchant, we'll forward your request to that merchant.

The trabot.ai marketing website sets no cookies and uses no client-side tracking. No analytics script, advertising pixel, or third-party tag loads in your browser. The only analytics we use for this site are aggregate, server-side request statistics that contain no cross-site identifiers.

The merchant app at app.trabot.ai uses only strictly necessary cookies (session and CSRF token) required to sign you in securely.

We use TLS in transit, encryption at rest for merchant and conversation data, least-privilege access controls, and audit logging on production access. No system is perfectly secure; if we become aware of a personal-data breach we notify affected controllers without undue delay.

Trabot.ai is not directed to children under 16 and we do not knowingly collect personal data from them.

We may update this policy from time to time. Material changes will be announced in the merchant app and, where you have opted in to product updates, by email. The "Last updated" date at the top always reflects the current version.

Growth15 Ltd — England and Wales, company number 13552418. Email: support@trabot.ai.