Zefyr
Security and data

Your data, on your own terms

The service needs your catalogue and your pages to answer correctly. It doesn't need your customers. Here we write exactly what is sent, when, and what never leaves the shop.

Privacy

Names and addresses stay in the shop

To answer “where is my order”, the assistant needs the order's status, not the person behind it. That's why the plugin sends the number, the status and the shipment, and leaves the personal details where they are.

  • No customer name, no address
  • Email and phone only as a SHA-256 hash
  • No payment details
What the shop sharesSentProducts, prices, stockPages and articlesOrder statusNever sentCustomer namesAddressesPayment detailsEmail and phone leave only as a hash.
Access

One key per shop

Every shop has its own key, and behind it only its own data. The key is accepted only when the request comes from the domain it was issued for, so a copy of the plugin on another site gets nothing.

  • Tied to the shop's domain
  • Domain change up to once every 7 days
  • A new key with one tap from the dashboard
Shopshop.grConnectedSite keyzf_sk_••••••••only for shop.grA request from shop.gr with its key: acceptedThe same key from another domain: rejected

What is sent, and when

Nothing leaves before you connect the shop. After that, only the following.

Products

Name, descriptions, address, image, prices, stock, categories, brand, attributes, variations, average rating and the text of the three newest reviews, never who wrote them.

Pages and articles

The text of your published pages and articles. Not the cart, the checkout or the account page.

Orders

Number, status, date, total, products, shipping method and tracking number. Without names and without addresses.

Chat messages

Whatever the visitor writes, together with a random identifier, the page they're on, where they came from and the pages they saw. Only if they write a message.

Setup details

The site address, the versions of the plugin, WordPress, WooCommerce and PHP, the language and the currency.

When you ask for AI copy

The product's details and your notes, or the topic and keywords of an article.

What protects you and your customers

Six things that apply to every plan.

Checks on every request

The key, the domain, the plan and the tokens are checked on the server every time, not inside the plugin.

The key isn't stored

The service keeps only a hash of the site key. If you lose it, you issue a new one.

Rate limits

The chat has a message limit per visitor and per shop, so no one can spend your tokens.

Deletion over time

Conversations and messages are deleted automatically after 90 days.

You decide what is shared

Products, pages, orders and the chat itself turn off separately from the plugin settings.

Leave whenever you want

Disconnecting stops every sending. Deleting the site from the dashboard erases what the service keeps.

Questions about the data

How does the assistant know that whoever asks about an order is its owner?

It asks for the email or phone the order was placed with and compares it with the hash the shop has sent. The email and phone themselves never reach the service.

Who sees the conversations?

You, from your dashboard. To produce an answer, the message and the relevant parts of your catalogue go through an AI model provider acting on behalf of the service.

Where is the service hosted?

On Supabase and Netlify infrastructure. The details are in the Privacy Policy and the Data Processing Agreement (DPA).

What does the service learn about a visitor who doesn't write in the chat?

Only what loading a file reveals: the chat loads from our server, like an image or a font. The visitor's path stays in their browser and is sent only together with a message they write themselves.

Do I need to update my shop's privacy policy?

It's a good idea. The plugin adds suggested text about the chat to WordPress's privacy policy guide (Settings → Privacy), and you decide whether to use it.

See it in your own shop

The free plan includes one shop.

Start for free