Privacy policy of Cited Support

Last updated: 2026-10-13

Cited Support ("the app") is a Shopify app published by Elektraset, s.r.o. ("we", "us"). Contact: help@elektraset.com, https://elektraset.com/. This policy explains which data the app processes when a merchant installs it and when shoppers use its chat on the merchant's store.

Roles

For shopper data, the merchant is the controller and we act as the merchant's processor. For the merchant's account data, we are the controller.

Data we process

From the merchant's Shopify store (through the Shopify Admin API):

store name, store email, currency and Shopify plan name;
products and variants (title, description, brand, type, options, prices, SKUs, product URL);
store policies (refund, shipping, terms and others) and published online-store pages.

The app does not request access to orders or customers in Shopify.

Created by the merchant in the app: knowledge sources and their versions, Q&A entries, external documents (text of public web pages the merchant chooses, or pasted text), guardrail settings, saved test questions and test results, settings such as the escalation email address.

From shoppers who use the chat: the questions they type and the assistant's answers; the page address where the chat was used; the ID of the logged-in customer if Shopify passes it to the app proxy; and, only if the shopper asks for a person, the name, email address and message that the shopper enters.

Billing: the plan and the subscription status, from Shopify. We never receive payment card data.

Technical data: server logs (time, request path, status code) for up to 30 days for security and troubleshooting.

Why we process it

to answer shopper questions with quoted passages of the merchant's approved sources (performance of the contract with the merchant);
to send escalated conversations to the merchant's support email and show them in the app's inbox;
to let the merchant test, version and roll back the knowledge;
to bill the plan through Shopify and to enforce plan limits;
to count aggregated product metrics (number of stores that installed, activated or pay for the app). These counts contain no store names and no shopper data.

The app does not use a generative AI model, does not sell data and does not use shopper data for advertising or for training models.

Sharing

Shopify (platform, app proxy and billing).
Our hosting provider that runs the app and its database.
Our email delivery provider, which sends escalation emails to the merchant's support address.
Authorities when the law requires it.

Retention and deletion

Conversations are kept while the app is installed, until the merchant deletes them, or until Shopify sends a customer redaction request, whichever comes first.
Shopify's privacy webhooks are honoured: customers/data_request (we report the conversations that we hold about the customer to the merchant), customers/redact (we delete that customer's conversations) and shop/redact (48 hours after uninstall, we delete the store's knowledge, conversations, tests and settings). We keep only anonymous counts for product metrics.

Security

Traffic is encrypted with HTTPS. Storefront requests are verified with Shopify's app proxy signature, admin requests with Shopify session tokens, and webhooks with their HMAC signature. Access to the servers is limited to the publisher.

Your rights

Shoppers can ask the merchant, or us at help@elektraset.com, for access, correction or deletion of their data. People in the EU/EEA and the UK also have the rights of the GDPR (including objection, restriction, portability and a complaint to a supervisory authority; in the Czech Republic the Office for Personal Data Protection, uoou.cz). California residents have the rights of the CCPA/CPRA; we do not sell or share personal information.

Changes

We will post changes on this page with a new date. Material changes are announced to merchants in the app.

Contact

Elektraset, s.r.o. — help@elektraset.com — https://elektraset.com/