Privacy Policy

1. Who we are and the scope of this policy

ChiefAssist Technologies (ABN 85 596 924 679) (“ChiefAssist”, “we”, “us” or “our”) provides executive-intelligence software for Shopify businesses. This policy explains how we handle personal information through the ChiefAssist website, embedded Shopify application and integrations, customer workspace, assessment, paid services, support channels and related communications (together, the “Services”).

This policy applies to merchants, their authorised users, website visitors and people who communicate with us. A Shopify merchant may also provide us with information about its customers and staff. In those circumstances, the merchant remains responsible for its own privacy notices and lawful handling of that information, while ChiefAssist handles the information to provide the Services and follow the merchant’s lawful instructions.

2. Information we collect

Shopify identity and organisation information

Shopify provides the store and authorised staff identity used for access checks. Encrypted Shopify sessions may contain staff identifiers, name, email and approved permissions. We also store your workspace role, reminder preferences and read state. The service does not ask you to create a separate ChiefAssist password.

Shopify and connected-business information

Depending on the capabilities you enable and the permissions you approve, this may include shop identifiers and configuration, product and variant information, orders, refunds, inventory, fulfilment and other supported operational evidence. Some records may contain customer or staff personal information. We seek to access only the fields and time periods reasonably necessary to deliver enabled capabilities.

Executive context and content

This includes priorities, feedback, recorded decisions and other context you choose to give ChiefAssist, together with intelligence, summaries and records generated through the Services.

Technical and usage information

This may include IP address, device and browser type, app and device identifiers, dates and times of access, pages or features used, security events, error reports, diagnostic information and activity logs.

Billing and transaction information

We may receive your selected plan, subscription status, billing events, transaction references and related tax or administrative information from Shopify. We do not need to store full payment-card details when payments are processed by those providers.

Communications

We collect information you provide when you request support, respond to a survey, join a waitlist, give feedback or otherwise communicate with us.

3. How we collect information

We collect information:

• directly from you, your organisation or another authorised user;
• from Shopify and other services you choose to connect, using approved APIs, webhooks and permissions;
• automatically when you use the website or embedded Shopify Services, including through essential cookies, logs and security tools;
• from service providers that support authentication, hosting, billing, monitoring, communications or support; and
• from public or third-party sources where lawful and reasonably necessary, for example to verify business details or protect the Services.

4. How we use information

We use information where reasonably necessary to:

• create and administer accounts, authenticate users and manage authorised access;
• connect to Shopify, evaluate supported business evidence and provide Today, Opportunities, Ask ChiefAssist, Boardroom, Journey, assessments and related capabilities;
• retain the priorities, decisions and context you ask the Services to remember;
• operate, maintain, troubleshoot, secure and improve the Services;
• process subscriptions, maintain business records and provide customer support;
• send service notices, security messages and other administrative communications;
• send marketing communications where permitted, with an unsubscribe option;
• detect misuse, fraud, security threats or unlawful conduct;
• comply with legal obligations, enforce agreements and establish or defend legal claims; and
• create aggregated or de-identified insights that do not reasonably identify an individual or merchant.

Where consent is required by law, we will ask for it. You may withdraw consent for future handling, but that does not affect handling already undertaken lawfully.

5. Shopify data and responsibilities

When a merchant installs or connects ChiefAssist, the merchant authorises the Shopify permissions shown during installation or connection. The data available to us depends on those permissions, Shopify’s platform rules and the ChiefAssist capabilities the merchant uses.

ChiefAssist applies data-minimisation controls and uses Shopify data to provide, protect and support the Services. We do not use access to one merchant’s identifiable information to provide another merchant with that merchant’s confidential business information.

Merchants are responsible for having a lawful basis to make information available to ChiefAssist, giving any notices required to their customers and staff, and responding to privacy requests for which they are responsible. We support Shopify’s mandatory privacy and compliance processes, including valid customer-data access and deletion requests and shop-deletion requests.

6. Analytics and intelligence

The current Shopify service uses deterministic analytical rules to organise evidence, identify supported patterns and prepare executive summaries. It does not send store records or executive reflections to a generative-AI service. Outputs may include inferences about a business and may be incomplete or inaccurate. They are designed to support human judgment, not replace it.

If a future feature introduces an AI-processing provider or materially different use of Customer Data, we will update this notice before that processing begins and obtain consent where required. We do not use identifiable merchant or customer content to train general-purpose models for unrelated use unless we first provide clear notice and obtain consent where required. We may use aggregated, de-identified information to evaluate and improve quality, reliability and safety.

7. When we share information

We may disclose information to:

• hosting, database, authentication, security, monitoring, communications and support providers that help us operate the Services;
• Shopify and other connected services where necessary to provide the integration, billing or compliance process you request;
• professional advisers, auditors and insurers under duties of confidentiality;
• regulators, courts, law-enforcement bodies or other parties where disclosure is required or permitted by law, or reasonably necessary to protect rights, safety and security; and
• a buyer, investor or successor in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality and privacy protections.

Core providers are Shopify (store APIs, identity, permissions and subscription approval), Vercel (application hosting and operational request logs), and Supabase (database and encrypted session storage). GitHub hosts source code and automated tests; the application does not export live store records to GitHub. Test fixtures should be synthetic, and diagnostic material should be minimised and redacted. The public website also loads fonts from Google Fonts, which receives ordinary browser request information.

Reminder preferences and read states support notifications inside ChiefAssist in Shopify. These preferences do not automatically subscribe you to email reminders. Necessary billing and connection warnings remain visible until resolved.

Where optional email reminders are enabled, a verified Shopify store owner can separately consent in Notifications. We then store the verified owner email, consent and unsubscribe state in the Shopify workspace and use Resend to send assessment, membership-status and weekly review reminders under the name ChiefAssist Technologies. We send the recipient address and reminder content to Resend, but do not include customer records or store-performance figures in those reminders. You can stop them in Notifications or using the unsubscribe link in each email. Delivery records are retained for up to 90 days for deduplication and troubleshooting, and workspace deletion removes the associated local email records. Uninstalling stops future scheduled reminders; an email already in transit may still arrive. Shopify's own billing emails are managed separately by Shopify.

We do not sell or rent personal information. We do not disclose personal information for cross-context behavioural advertising.

8. Overseas processing

ChiefAssist and our service providers may process information in Australia, the United States and other countries where approved providers operate. Privacy protections in another country may differ from those in your location. Where required, we take reasonable steps to use contractual, organisational and technical safeguards for overseas processing. You may contact us for current information about material provider locations relevant to your use of the Services.

9. Retention and deletion

We retain personal information only for as long as reasonably necessary to provide the Services, fulfil the purposes described in this policy, comply with law, resolve disputes, maintain security and enforce agreements.

• Account, workspace and connected-business information is generally retained while the relevant account or connection is active.
• After closure or uninstall, we delete or de-identify information in accordance with the merchant’s request, Shopify’s required timelines and our operational deletion cycle, except where retention is legally required or reasonably necessary for security and dispute records.
• Residual copies may remain temporarily in encrypted backups until they are overwritten through the ordinary backup cycle.
• Billing, tax, support and audit records may be retained for applicable statutory periods.

You may request more specific retention information for a category of data by contacting us.

10. Security

We use administrative, technical and organisational measures designed to protect information. These may include encryption in transit, access controls, least-privilege practices, authentication controls, logging, monitoring, vendor review, secure development practices, backups and incident-response procedures. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

You are responsible for protecting your account credentials, controlling authorised users and promptly telling us about suspected unauthorised access.

11. Your choices and rights

Subject to applicable law and relevant exceptions, you may ask us to:

• provide access to personal information we hold about you;
• correct information that is inaccurate, out of date, incomplete, irrelevant or misleading;
• delete, restrict or object to certain handling;
• provide portable information where that right applies; or
• stop direct marketing communications.

We may need to verify your identity and authority before acting. If your request concerns information held by a Shopify merchant, contact that merchant first; we will support the merchant and Shopify compliance process where required. We will not discriminate against you for exercising a privacy right.

12. Cookies and analytics

Our website and embedded Shopify application may use cookies or similar technologies that are necessary for navigation, preferences, authentication, security and service operation. If we introduce non-essential analytics or marketing technologies, we will provide any notice and choice required by law. Browser or device settings may allow you to block or remove cookies, but doing so can affect functionality.

13. Data breaches

We maintain processes to assess and respond to suspected data breaches. Where a breach is likely to result in serious harm or notification is otherwise required, we will notify affected people and the relevant regulator in accordance with the Australian Notifiable Data Breaches scheme and other applicable law.

14. Children

The Services are intended for businesses and authorised users aged 18 or older. They are not directed to children under 16, and we do not knowingly create accounts for children. If you believe a child has provided personal information directly to us, please contact us so we can assess and remove it where appropriate.

15. Privacy complaints

Please send a privacy question or complaint to privacy@chiefassist.ai. Include enough detail for us to understand the issue. We will acknowledge and investigate the matter and aim to respond within a reasonable period.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner or another regulator available to you.

16. Changes and contact

We may update this policy as our Services, practices or legal obligations change. We will publish the updated policy with a new “last updated” date and provide additional notice where a change is material or required by law.