Privacy policy
Effective date: 28 October 2026 · Last updated: 28 October 2026
This policy explains how Chillss handles information in connection with FAQHive, our product-question-and-answer app for Shopify, and the Chillss website. It covers merchants using the app, shoppers interacting with its widget, and people contacting us.
1. Who we are and how to contact us
FAQHive is operated by Chillss. You can contact us about privacy at contact@chillss.com.
Mailing address:
Chillss
4 Putnam Hill
Greenwich, CT 06830
United States
When we process shopper information on a merchant’s instructions to provide FAQHive, the merchant is generally the data controller and Chillss acts as its processor. For information used to manage our own business relationships, support and service administration, Chillss generally acts as a controller.
2. Information we process
We process information needed for FAQHive’s product-answer and merchant workflows:
| Category | Information and purpose |
|---|---|
| Store and merchant accounts | Store and merchant account information used to operate and configure the service. |
| Product knowledge | Product information, store policies, published knowledge and saved knowledge used to answer product questions. |
| Shopper interactions | Shopper questions, generated answers, feedback and usage statistics used to provide answers, identify knowledge gaps and understand answer usage. |
| Connected integrations | Notification email addresses and Slack workspace and channel identifiers, together with relevant alert content and merchant replies, when these integrations are enabled. |
| Support and privacy requests | Information you provide when contacting us and records associated with handling privacy requests. |
FAQHive does not request access to individual Shopify customer records or orders. Questions may nevertheless contain personal information voluntarily entered by shoppers. We attempt to remove email addresses and phone-like numbers before storing questions. Names, addresses and other personal details are not comprehensively removed, so this filtering does not guarantee anonymization.
Please do not include passwords, payment-card details, sensitive personal information or unrelated personal details in product questions.
3. How we use information, including AI
FAQHive uses product knowledge and submitted questions to provide relevant answers on product pages, make previously asked questions and FAQs available, group questions by meaning, identify missing information and support merchant responses through Slack.
We use feedback and usage statistics to understand how answers are used and where product information needs improvement. We also use information you send us to respond to support and privacy requests.
AI processing and sharing: FAQHive uses OpenAI for AI-generated answers and content processing. FAQHive has opted in to share API inputs and outputs from its production OpenAI project for model improvement and training, in connection with OpenAI’s daily complimentary-token allowance. Relevant shopper questions, product and knowledge content, and generated responses sent to OpenAI may be used for those purposes. Model-feedback sharing and evaluation/fine-tuning data sharing remain disabled.
Store-level permission: Each store must explicitly opt in within FAQHive Settings > AI data sharing before any new OpenAI AI processing. The checkbox is not preselected. By opting in, the merchant confirms that they have authority to authorize this processing and sharing and have provided the necessary shopper notices and obtained the necessary permissions. Without opt-in, AI answers, AI drafts and semantic grouping are paused, while published FAQs and merchant-approved answers remain available.
Withdrawing permission: Merchants can withdraw permission at any time in FAQHive Settings > AI data sharing. Withdrawal stops new requests to OpenAI but cannot recall data already shared with OpenAI.
FAQHive sends AI requests with response storage disabled. Disabling response storage does not opt out of production API input/output sharing, prevent model-improvement or training use under that sharing, or eliminate provider-side retention. Our limited filtering of email addresses and phone-like numbers does not guarantee anonymization; shared content may still contain personal information.
Limited personal-information filtering does not guarantee removal of personal information. Do not submit sensitive or confidential information for AI processing or sharing with OpenAI.
OpenAI’s retention and use of shared content are governed by the applicable OpenAI terms and data-sharing policies. Shared content is not subject to a blanket 30-day retention limit; standard abuse-monitoring retention is a separate matter. See OpenAI’s official data controls and OpenAI’s data-sharing explanation.
Answers visible to other shoppers: Shopper questions start unpublished. Public Q&A requires publication, and merchant replies through Slack can trigger publication. Published question-and-answer content may be visible to other shoppers. Personal-information filtering is limited, and publication does not guarantee complete anonymization or independent human review of every question. Merchants should check content for personal information before publishing or replying through workflows that publish it.
4. Who information is shared with
Information is exchanged with Shopify as needed for the app’s Shopify integration. If a merchant connects Slack, information routed to that workspace is accessible according to the merchant’s workspace permissions and Slack settings. Disconnecting Slack does not necessarily remove messages already delivered there.
| Provider | Role |
|---|---|
| OpenAI | AI-generated answers and content processing, as described above. |
| Render | Application hosting and SQLite database storage in Oregon, United States (US West). |
| Resend, if enabled | Delivery of email alerts to the configured notification address. |
| Slack, if connected | Unanswered-question alerts and merchant replies in the connected workspace and channel. |
Prisma is the software FAQHive uses to access its database; it is not being identified here as a separate hosted database service. Render’s hosting location is Oregon, United States.
Chillss does not sell personal information or share it for targeted or cross-context behavioral advertising. FAQHive does not use advertising trackers or transfer information to advertising networks.
5. Cookies and technical information
The current Chillss marketing website contains no custom analytics scripts, advertising pixels or cookie-setting code. Its hosting service may process technical information needed to deliver and protect the website.
FAQHive’s storefront widget does not set advertising cookies or persistent shopper-tracking identifiers. It uses temporary request identifiers to prevent duplicate submissions and validate feedback. Usage statistics and feedback are processed as described above; the absence of persistent tracking identifiers does not mean that the widget processes no information.
6. Retention and deletion
| Information | Retention and deletion |
|---|---|
| Unpublished questions and related activity | The default retention setting is 90 days. Merchants may choose another available retention period. Cleanup executes through relevant app maintenance and settings flows; records may remain beyond the selected period until one of these flows runs. Deletion is not guaranteed at an exact deadline. |
| Published answers and saved knowledge | Remain while the app is installed. |
| Certain answer-usage and privacy-request records | Remain while the app is installed. |
| AI data-sharing consent records | The notice version, exact authorization text, decision, timestamp and authenticated merchant actor are retained for audit while the app remains installed. Consent records are included in merchant exports and are deleted with the store’s records when FAQHive processes Shopify’s verified uninstall notification. |
| Store records on uninstall | When FAQHive processes Shopify’s verified uninstall notification, it deletes the store’s records from its active application database. This is triggered by processing the notification, not simply clicking uninstall. |
| Copies in connected services | Content already delivered to Slack or email, or published into Shopify, remains in those services under the merchant’s control and is subject to those services’ settings and policies. |
| Hosting backups | Render creates encrypted disk snapshots every 24 hours and retains them for seven days. Deleting records from the active database does not immediately remove existing snapshots. These snapshots are distinct from a separate database-backup service. |
OpenAI’s provider-side retention is described in Section 3. Contact us at contact@chillss.com about deletion requests or information that remains in connected services.
7. Legal bases and international transfers
Where applicable law requires a legal basis, we process merchant account information to provide our contracted service; support information and usage statistics for our legitimate interests in operating, supporting and improving FAQHive; and information needed to meet legal obligations, including applicable privacy requests. Where processing requires consent, we rely on that consent, which may be withdrawn. Shopper information processed on behalf of merchants is handled according to their lawful instructions; merchants are responsible for the legal basis for that processing.
Chillss’s mailing address is in the United States, and FAQHive’s application and database are hosted in Oregon, United States. Information may therefore be processed outside a shopper’s or merchant’s country. Service providers may also process information in other countries. International transfers are subject to applicable data-protection requirements. Contact contact@chillss.com for information about processing locations and safeguards relevant to your information.
8. Your privacy rights
Depending on where you live and the law that applies, you may have rights to access, correct or delete personal information, receive a portable copy, restrict or object to processing, and withdraw consent where processing relies on it. You may also have rights to opt out of certain uses, appeal a decision on a request, or complain to a data-protection authority.
If your information was submitted while shopping at a merchant’s store, contact that merchant first. It can identify the relevant records and direct its service providers. You may also contact contact@chillss.com, including the store domain and a brief description of your request. Do not include passwords or payment details.
Chillss monitors contact@chillss.com daily and is responsible for handling privacy requests. We may ask for information needed to verify your identity and locate relevant records, and coordinate requests involving merchant-controlled data with the merchant. We handle requests within applicable legal deadlines. Daily inbox monitoring is not a promise that every request will be completed that day. To ask us to reconsider a response or exercise an applicable appeal right, contact the same address and identify your original request.
9. Security and children’s information
FAQHive uses HTTPS, Shopify authentication, verification of Shopify webhook and app-proxy signatures, and store-scoped database queries. Shopify offline tokens expire and are handled through a refresh process. Slack requests are checked using signatures and timestamps, and stored Slack tokens are encrypted using AES-256-GCM. Additional safeguards include usage limits, basic personal-information filtering, uninstall/redaction handlers, automated tests and security checks. Render encrypts persistent disks and their snapshots at rest. No system can guarantee complete security.
FAQHive’s merchant-facing tools are intended for business users. If you believe a child has submitted personal information through a merchant’s widget, contact that merchant or contact@chillss.com so the information can be located and the request addressed under applicable law.
10. Changes to this policy
We may update this policy as our service or practices change. The updated policy will be posted on this page with a revised last-updated date. Where required by law, we will provide additional notice of material changes. Questions about this policy can be sent to contact@chillss.com.