Privacy Policy

This Privacy Policy explains how AgoraCrew (operating under Optimise Inbox, hereinafter referred to as "we", "us", or "our") collects, processes, stores, and protects personal data in connection with our customer support services and our Shopify application, AgoraCrew's AI.

This policy applies to all end customers ("you" or "data subjects") whose data is processed when a merchant installs and uses our application on their Shopify store, as well as any individual who interacts with our AI-powered or human-operated customer support services on behalf of a merchant's brand.

We are committed to full compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK Data Protection Act 2018, and Shopify's App Store Developer Guidelines.

For the purposes of GDPR, AgoraCrew (Optimise Inbox) acts as a data processor on behalf of the Shopify merchant who has installed our application. The merchant remains the data controller and is responsible for ensuring they have a lawful basis for sharing their customers' data with us.

For any data we process independently (such as merchant account information or website enquiries), we act as the data controller. Our registered contact for data protection matters is:

When a merchant uses AgoraCrew's AI to handle customer support queries, we access and process only the minimum data required to fulfil the specific support request. The following table outlines exactly what is collected:

We adhere strictly to the GDPR principle of data minimization (Article 5(1)(c)). This means:

• We only process customer names, email addresses, and order numbers — strictly to fulfil WISMO (Where Is My Order) lookup requests and resolve related customer support queries.
• No additional data is requested, scraped, inferred, or collected beyond what is explicitly required for the stated purpose.
• We do not build customer profiles, track behaviour, or aggregate personal data for analytics or marketing purposes.

In accordance with transparency requirements under GDPR (Articles 13–14) and Shopify's App Store guidelines, we inform all users of the following:

The AI system operates under the following principles:

• No autonomous decision-making: The AI does not make decisions that produce legal effects or similarly significantly affect data subjects. Its sole function is to draft and suggest support replies.
• Human oversight: Merchants may configure escalation rules so that complex or sensitive queries are routed to supervised human agents for review and response.
• Brand-aligned responses: The AI is configured to match the merchant's specific brand voice, tone, and support policies. It does not generate unsolicited content or engage beyond the scope of the customer's enquiry.
• Right to human intervention: Under Article 22 of the GDPR, you have the right to request human intervention at any stage of the support interaction. Contact the merchant directly or reach out to us at the email address provided in this policy.

In addition to our AI-powered automation, AgoraCrew provides professionally supervised human customer support agents who may also handle your enquiry. When a human agent processes your support request:

• Same data scope applies: Human agents access only the same minimal data categories outlined in Section 3 — customer name, email address, and order information — strictly to resolve your support ticket.
• Professional supervision: All human agents operate under strict internal governance, including signed data processing agreements, non-disclosure obligations, and ongoing training on data protection requirements.
• Quality assurance: Interactions handled by human agents are subject to regular quality audits by our management team to ensure compliance with both the merchant's brand standards and our data protection obligations.
• No data export: Human agents are prohibited from downloading, copying, or exporting any personal data outside of the authorised CRM and ticketing systems provided by the merchant.

Whether your support request is handled by our AI system, a human agent, or a combination of both, the same data protection standards, minimization principles, and retention policies described in this Privacy Policy apply equally.

To deliver our AI-powered support capabilities, we securely pass limited customer data to a third-party Large Language Model (LLM) provider for the purpose of drafting customer support replies.

We disclose the following regarding our subprocessor relationship:

• Data transmitted: Only the customer's name, email address, order number, and the content of their support inquiry are passed to the LLM provider.
• Purpose: Solely to generate a contextually appropriate response to the customer's query.
• No model training: Your data is never used to train, fine-tune, or improve the LLM provider's artificial intelligence models. We maintain contractual agreements that explicitly prohibit this.
• Data in transit: All data transmitted to and from our LLM provider is encrypted using industry-standard TLS 1.2+ encryption.
• No data persistence: The LLM provider does not retain, cache, or store customer data beyond the time required to process the individual API request.

We apply strict data retention practices to ensure your information is not kept longer than necessary:

• Active cache deletion: Customer data processed during a support interaction is deleted from our active caches immediately following ticket resolution. We do not maintain long-term databases of customer personal data.
• Erasure requests: We honour all official data erasure requests in full compliance with GDPR Article 17 (Right to Erasure). All erasure requests are processed within 30 calendar days of receipt.
• Merchant uninstallation: When a merchant uninstalls AgoraCrew's AI from their Shopify store, all associated customer data is purged from our systems within 48 hours of receiving the uninstallation webhook.
• Anonymised logs: We may retain fully anonymised and aggregated usage logs (containing no personal data) for service improvement and performance monitoring purposes.

Our processing of personal data is based on the following lawful grounds under GDPR Article 6:

• Legitimate Interests (Article 6(1)(f)): Processing customer support inquiries on behalf of the merchant to maintain and improve the customer relationship.
• Performance of a Contract (Article 6(1)(b)): Where processing is necessary for the performance of the merchant's contractual obligations to their customers (e.g., providing order status updates).
• Consent (Article 6(1)(a)): Where applicable, the merchant is responsible for obtaining and managing end-customer consent in accordance with their own privacy policy.

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights regarding your personal data:

• Right of Access — Request a copy of the personal data we hold about you.
• Right to Rectification — Request correction of inaccurate or incomplete data.
• Right to Erasure — Request deletion of your personal data ("Right to Be Forgotten").
• Right to Restriction of Processing — Request limitation of processing under certain conditions.
• Right to Data Portability — Receive your data in a structured, machine-readable format.
• Right to Object — Object to processing based on legitimate interests.
• Right to Human Intervention — Request that automated decisions (including AI-generated responses) be reviewed by a human.

To exercise any of these rights, please contact us at anne@agoracrew.com. We will respond to all valid requests within 30 calendar days. If your request is complex, we will inform you of any extension (up to a maximum of 90 days total) as permitted under GDPR.

You also have the right to lodge a complaint with your local supervisory authority. For Hungary, this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest
• Access controls based on the principle of least privilege
• Regular security audits and vulnerability assessments
• Mandatory data protection training for all personnel with data access
• Secure API authentication using OAuth 2.0 for Shopify integrations

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

You also have the option to opt out of the collection of your personal data in compliance with GDPR by visiting https://www.rb2b.com/rb2b-gdpr-opt-out.

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes that affect how we process personal data, we will provide notice through our application dashboard or via email to active merchants.

We encourage you to review this page periodically to stay informed about our data practices.

If you have any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us: