Privacy Policy
Last updated 4 September 2026. This policy is published in English; it applies to all users regardless of the language the site or the assistant is used in.
Who is responsible
Dario Tino
Gapetschstrasse 29, 9494 Schaan, Principality of Liechtenstein
UID CHE-331.960.860
kontakt@axyom.ch
Liechtenstein is part of the European Economic Area, so the GDPR applies to this processing. Where a user or merchant is located in Switzerland, the Swiss Federal Act on Data Protection applies in addition.
What this policy covers
Three different things, with meaningfully different data:
- This website — axyom.ch, including the contact form.
- The Axyom app for Shopify — installed by a merchant into their own store.
- The storefront assistant — the chat widget a merchant's customers talk to.
The website
No cookies and no analytics. This site sets no cookies, and there is no Google Analytics, no tracking pixel and no third-party analytics service of any kind. Your browser stores your light/dark theme preference locally; that never leaves your device.
If you use the contact form we receive your name, email address, website URL and message, and we use them only to answer you.
The website itself is served by GitHub Pages (GitHub, Inc., United States). Our application servers are separate — see hosting below.
The Shopify app
When a merchant installs Axyom, we store the shop's .myshopify.com domain, the access token that lets us read the shop's catalogue, the granted permission scopes, and the subscription status. We read the shop's products, pages and policies in order to answer questions about them.
We request two permissions that Shopify classifies as protected customer data: customer_read_customers and customer_read_orders. They exist for one feature — order status — and they are described in full below.
The storefront assistant
Chat messages
Messages typed into the assistant, and the assistant's replies, are stored so the merchant can review how their assistant is performing. They are deleted automatically after 90 days.
Please do not type payment card details into a chat box. We do not ask for them and have no use for them.
Order status
We store no order data at all. To see an order, the shopper signs in to their own Shopify customer account. Order details are then read live from Shopify for that one answer and are never written to our database, our logs or our search index.
What we do hold, briefly, is one login session: an encrypted access token with a hard ceiling of 30 minutes from the moment the shopper authorises it. It is not extended by activity, and it is deleted on expiry, on sign-out, and on any authorisation failure. The identifier held by the browser is stored on our side only as a cryptographic hash, so a copy of our database does not grant access to anybody's orders.
The order information we read is deliberately narrow: order number, date, total, payment and fulfilment status, tracking information, and the items ordered. We do not read the customer's name, email address, telephone number or postal address.
Who else processes this data
| Processor | What for | Where |
|---|---|---|
| OpenAI, L.L.C. | Generating assistant replies (gpt-4o-mini) and building the search index (text-embedding-3-small). Message content is sent to OpenAI to produce an answer. OpenAI does not use data sent through its API to train its models, and its abuse-monitoring logs of that data are deleted after at most 30 days. | United States |
| Infomaniak Network SA | Application hosting, database, and outbound email | Switzerland |
| GitHub, Inc. | Hosting this website | United States |
| Shopify Inc. | The merchant's own store data and, for order status, the shopper's own account | Canada |
| Stripe, Inc. | Payments — for customers who subscribe directly. Merchants who install through the Shopify App Store are billed by Shopify and their payment data never reaches us or Stripe. | United States |
Transfers to the United States are made on the basis of the European Commission's Standard Contractual Clauses. We do not sell personal data, and we do not use chat content to train third-party models.
How long we keep things
| Data | Retained |
|---|---|
| Chat messages | 90 days, then deleted automatically |
| Order data | Not stored at all |
| Shopper login session | 30 minutes maximum |
| Merchant account and shop record | For as long as the app is installed |
| Everything belonging to a shop | Erased after uninstall, on Shopify's request |
| Contact form messages | Until the enquiry is resolved and no longer needed |
When a merchant uninstalls Axyom, Shopify asks us to erase the shop's data and we delete it — chat messages, login sessions, credentials, uploaded files, and the search index built from the shop's content.
Your rights
You may request access to your personal data, correction of it, deletion of it, a copy in portable form, or restriction of processing; you may object to processing, and you may lodge a complaint with a supervisory authority. Write to kontakt@axyom.ch.
If you spoke to an assistant on a merchant's store, that merchant is the controller for their shop's data and we act on their instructions. You can contact us at the address above and we will help, but you may find it faster to contact the shop directly.
Legal basis
- Contract — running the service for merchants who subscribe, and answering a shopper's question about their own order.
- Legitimate interests — keeping the service secure and working, and letting merchants review their assistant's quality. Balanced against your interests by the retention limits above.
- Consent — the contact form, which you choose to submit.
Security
All traffic is encrypted in transit. Access and refresh tokens are encrypted at rest; API keys and session identifiers are stored only as hashes. Access to production systems is limited to the controller named above.
Changes
If this policy changes materially we will update the date at the top and, for changes that affect merchants, notify them in the app.