Privacy policy
Codexta, operated by Codecta. Last updated 28 October 2026. Questions: codexta@codecta.com.
Who this covers
Codexta is a chat assistant that a shop (the "merchant") adds to its online store, and a back-office assistant in the merchant's admin. For shopper conversations the merchant decides why and how the data is used and Codexta processes it on the merchant's behalf. For the merchant's own account Codexta is the controller.
What we process
| Data | Why |
|---|---|
| Chat messages between a shopper and the assistant, and the assistant's replies | To answer the shopper and to show the merchant their conversations and unanswered questions. |
| For a signed-in shopper: the shop's customer id, and the shopper's own orders when they ask about them | To tell the shopper about their own orders. Another person's orders are never shown. |
| Name and email the shopper gives when a ticket or a live chat with a person is opened | So the merchant's team can reply. |
| Order id, total and time of orders that followed a chat | To report how many orders the assistant helped with. The order's webhook body, which names the buyer, is erased after processing. |
| Merchant staff: name, email, role in the shop | To sign them in through Shopify and control who may change settings. |
| Shop settings and knowledge-base notes the merchant writes | To run the assistant. |
We do not ask for payment card details, passwords or government ids, and the assistant is told not to collect them. We do not sell personal data and do not use it for advertising.
Who receives it
Conversation text is sent to the language-model providers that power the assistant (currently DeepSeek and OpenAI) only to generate replies. Emails and numbers are masked before conversations are summarised. Data is also processed by our hosting provider. We share data with no one else except where the law requires.
How long we keep it
Conversations are kept for 30 to 365 days depending on the merchant's plan, then deleted. Daily statistics hold counts only, with no text and no person.
Requests, access and erasure
- Access / export. A shopper can ask the shop, or write to us at the address above. We answer within 30 days. Shopify's data request notice reaches us automatically and is handled the same way.
- Erasure. When Shopify sends a customer erasure request we delete that person's conversations and records in Codexta. 48 hours after a shop uninstalls the app, we delete all of the shop's data.
- Merchants can export or delete their shop's data on request to the same address.
Security
Traffic is encrypted in transit. Access tokens for the shop are stored encrypted. Only a shop's owner and admins can change the assistant's settings.
Changes and contact
We will post changes here and change the date above. Contact: codexta@codecta.com.