Octopus Privacy Policy

Octopus is operated by Delight OptoElectronics, trading as Delight Systems ("Delight", "we", "us", or "our"). This policy explains how Octopus processes information for Shopify merchants and people who use the shopping assistant on a merchant's storefront.

Our role

For shopper information submitted through a merchant's storefront, the merchant generally decides why that information is processed and Delight processes it to provide Octopus. Delight separately controls information needed to administer merchant accounts, provide support, secure the service, manage billing, and meet legal obligations.

Information we process

• Merchant information, including the Shopify shop domain and ID, installation and subscription status, plan usage, store locale and currency, app settings, and support communications.
• Store information made available through approved Shopify scopes, including product, variant, inventory, published policy, and online store page information needed to answer shopper questions.
• Shopper interactions, including chat messages, anonymous visitor and conversation identifiers, product and cart interactions, feedback, and optional email address or phone number supplied for a requested support handoff.
• Technical and security information, including IP address, request metadata, authentication and session records, rate-limit records, error information, and privacy-safe service analytics.

Octopus does not collect payment-card details. Checkout and payment are handled by Shopify. Please do not submit passwords, payment-card data, government identifiers, health information, or other sensitive data in chat.

Why we process information

We use information to authenticate merchants, synchronize their approved store information, answer shopper questions, provide product recommendations and verified cart actions, restore active conversations, deliver requested support handoffs, enforce plan limits, prevent abuse, diagnose errors, measure service quality, and comply with privacy and legal obligations.

Depending on the context and applicable law, processing is based on performance of our agreement with the merchant, the merchant or shopper's request or consent, our legitimate interests in operating and securing Octopus, and compliance with legal obligations.

AI processing and automated assistance

Relevant chat text and merchant-approved store context can be sent to AI providers to generate an answer. Catalog and product content can be converted into embeddings and stored in a tenant-filtered search index. Octopus is designed to ground commerce answers in current Shopify data, but AI output can be incomplete or incorrect and should not replace professional or safety-critical advice. Octopus does not make decisions that produce legal or similarly significant effects about shoppers.

Service providers

We disclose only the information each provider needs to perform its service. Our principal production providers are:

• Shopify — app installation, authentication, store APIs, hosted plan selection, billing, and checkout. Processing occurs in Shopify's service regions.
• Amazon Web Services — production application and database infrastructure. The exact production region is maintained in our deployment records.
• Groq — AI inference and, when enabled for a relevant product question, controlled public-web research. Relevant prompt and store context may be processed in Groq's service regions.
• Google Gemini — creation of search embeddings from catalog and approved knowledge content. Processing occurs in Google's service regions.
• Qdrant Cloud — tenant-filtered vector search. The currently configured cluster is in the AWS London region (eu-west-2).
• Resend — delivery of support-handoff email when that optional channel is configured by a merchant. The handoff contact and relevant conversation context are sent only after a shopper requests the handoff.

We may also disclose information when required by law, to protect the service or its users, or as part of a business transaction subject to appropriate confidentiality and data-protection obligations. We do not sell personal information.

International transfers

These providers may process information outside the merchant's or shopper's country. Where required, we rely on provider data-processing terms and lawful transfer safeguards, such as contractual protections or standard contractual clauses. Merchants remain responsible for any notices or consents required for their storefront use of Octopus.

Retention and deletion

• Conversations, associated handoff records, service analytics, and usage records are kept for no more than 30 days in active systems.
• Completed privacy-request records and their access logs are kept for up to 365 days to demonstrate compliance.
• Merchant settings, sessions, catalog mirrors, and search indexes are retained while the app is installed.
• When Shopify confirms uninstallation, Octopus disables the storefront widget and deletes the merchant's active application, session, catalog, conversation, analytics, and search-index data. Shopify's later shop-redact webhook is handled as an idempotent compliance safety net.

Octopus does not create a separate application-level backup archive. Residual copies created by an infrastructure provider for disaster recovery are isolated from normal use and expire through that provider's configured secure backup rotation.

Privacy requests and your rights

Depending on applicable law, you may request access, correction, deletion, restriction, objection, or portability, or withdraw consent. Shoppers should normally contact the merchant whose storefront they used. Merchants and shoppers may also contact us. We authenticate and process Shopify's mandatory customer-data and redact webhooks and will cooperate with merchants on valid requests.

Security and incidents

We use access controls, authenticated Shopify sessions, signed storefront sessions, restricted conversation-resume credentials, tenant-scoped data access, rate limits, encrypted transport, and the encryption and backup controls provided by our infrastructure providers. No internet service can guarantee absolute security. Report a suspected privacy or security incident immediately to cs@delight.systems.

Children

Octopus is a merchant shopping tool and is not directed to children under 16. We do not knowingly use the service to collect personal information directly from children under 16.

Policy changes

We may update this policy as Octopus or applicable requirements change. We will publish the revised policy here with a new effective date and, when a change is material, provide additional notice through the app or merchant contact details where appropriate.

Contact