Zefyr

Privacy Policy

Last updated: 9 October 2026

How we protect and process data, in line with the GDPR.

This policy explains which data Zefyr processes, why, for how long, and what your rights are. We comply with the General Data Protection Regulation (EU 2016/679, “GDPR”).

1. Roles

For your shop’s data (account, catalogue, visitors’ conversations) the controller is the owner of the shop, and Zefyr acts as a processor on their behalf. For your own account data as a customer of the service, the controller is Zefyr.

2. Data we process

  • Account details: email, name or company name, encrypted password, plan.
  • Shop details: domain, public key, licence status, appearance settings.
  • Catalogue content: products, prices, stock, variations, pages and notes the plugin sends us.
  • Conversations: visitors’ messages and the assistant’s answers, the page they came from, 👍/👎 ratings.
  • Visit details, only for those who write in the chat: where they came from (referring site, UTM campaign tags), which pages of the shop they viewed, how many times they visited, device type and language. Until then these stay only in the visitor’s browser; we do not store IP addresses or advertising click identifiers.
  • Usage: token counts per day, for operating the service and billing the plan.

3. Purpose and legal basis

We process the data to perform the contract (providing the service), for our legitimate interest in improving and securing the service, and to comply with legal obligations.

4. Artificial intelligence

To write an answer, the question and the strictly necessary excerpts from your catalogue or pages are sent to an AI model provider (Groq). We do not send visitors’ names, emails or payment details. The data is not used to train models.

5. Retention

  • Conversations and messages: 90 days.
  • Usage records (tokens): 400 days.
  • Account and shop details: for as long as the account exists and a reasonable period afterwards.

6. Recipients and sub-processors

Database and function hosting: Supabase. AI provider: Groq. Payment provider (in the future): Lemon Squeezy. We hand them only what the service needs, under contractual confidentiality commitments.

7. Your rights

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You can delete your data from the dashboard or write to support@zefyr.gr. You also have the right to lodge a complaint with your supervisory authority.

8. Security

Encryption in transit (TLS), access keys per shop, rate limiting, and separation of data per account with row-level security rules.

If you have any questions, contact us.