noorflows — Order & Support Agent

Last updated: June 14, 2026

Plain English: we use a store’s order and customer details only to answer that customer’s question, we never sell anyone’s data, and we delete it when asked. Here’s exactly how.

What we touchOrders, tracking, returns and products — to answer support questions.

Who we share withOnly the services that make it work (below). Never sold.

AI & trainingMessages go to our AI provider to write replies — and are not used to train AI models.

DeletionWe honor Shopify’s data-deletion requests automatically.

1.Who this covers

This policy explains how the noorflows Order & Support Agent app (“the app”, “we”) handles information when a Shopify merchant installs it and when their shoppers chat with it. The merchant is the owner (“controller”) of their customers’ data; we process it on the merchant’s behalf to provide the app.

2.What we collect

Store details — your store domain and settings you choose (brand voice, refund limits, return window, alert email, and — if you use it — your own AI key).
Order & product data — order numbers, status, tracking, line items, returns and product info, read from your store only when needed to answer a question.
Customer details for that order — the email on the order (to confirm identity) and the order contents, used solely to answer that shopper.
Conversation content — the messages a shopper sends the chat and the replies given.
Activity records — a log of what the agent did (question type, decision, time) so you have a record. Personal details in these logs are masked.

We request the minimum Shopify permissions needed: read access to orders, customers, fulfillments, returns and products, and write access only for the returns and refunds you approve.

3.How we use it

Answer shopper questions using your real order, product and policy data.
Verify a shopper’s identity (matching email) before revealing any order details.
Prepare refunds and returns for your one-click approval — we never move money on our own.
Email you when something needs a human, and confirm actions to your shopper.
Keep an activity record and protect against abuse and errors.

We do not use shopper or order data for advertising, and we do not sell it.

4.AI processing

To write helpful replies, the shopper’s message and the relevant order facts are sent to our AI provider (Anthropic, the maker of Claude). That data is used only to generate the reply for that conversation and is not used to train AI models. We minimize what’s sent and avoid including unnecessary personal details.

If you use the “own it” option with your own AI key, those requests run under your own AI provider account and its terms — we are not in the middle.

5.Who we share with

Shopify — we read/write your store data through Shopify’s official API.
Anthropic — to generate replies, as described above.
Email delivery — to send you alerts and shoppers their confirmations.
Hosting — secure servers that run the app.

That’s it. We never sell data or share it for anyone else’s marketing.

6.How long we keep it & deletion

We keep personal data only as long as it’s needed, then delete it automatically:

Conversation history — deleted after 30 days.
Notifications — deleted after 90 days.
Activity/audit records (already stripped of personal details) — deleted after 180 days.

We also automatically honor Shopify’s privacy requests, right away:

Customer data request — we report what we hold for that customer.
Customer redaction — we delete that customer’s conversations and records.
Shop redaction — when you uninstall, we delete your store’s data.

Shoppers can ask the store to access or delete their data; the store can trigger the deletion above.

7.Security

Data is encrypted in transit, access is restricted, secrets (like AI keys) are stored securely and never shown back in full, and personal details are masked in our activity logs. No system is perfect, but we design the app to share the least data necessary and to keep money actions behind your approval.

8.Your rights

Depending on where you live (for example under GDPR or CCPA), shoppers may have rights to access, correct, or delete their personal data, and merchants can act on those requests using the tools above or by contacting us. We don’t knowingly collect data from children.

9.Changes & contact

We’ll update this page if our practices change, with a new date at the top. Questions, or a privacy request? Email syed@noorflows.com.

noorflows · Peshawar, KPK, Pakistan