Responding to a customer data request¶
Under GDPR, UK GDPR, CCPA and similar laws, a customer can ask you for a copy of the personal data you hold about them, or ask you to erase it. Shopify passes those requests to every app connected to your store, including Brilio Concierge.
You are the data controller for conversations on your storefront, and Brilio is your processor. So the request is yours to answer — but everything you need to answer it is in the app.
If a customer asks to SEE their data¶
Shopify sends us a customers/data_request webhook and we record it. There is
nothing to wait for: you can answer immediately.
- Open Brilio Concierge → Conversations in your Shopify admin.
- Search for the customer's email address.
- Any conversation where they typed that address will match. Open each one to read the full exchange.
- Copy the exchanges into your reply to the customer.
Search their order number too
A shopper chasing an order often gives the order number rather than the email, or gives both. Searching for each catches conversations the other misses.
If you would rather we produced the extract for you, email privacy@brilio.ai with your store domain and the customer's email address, and we will send it to you.
What Brilio holds about that customer¶
Only what the customer typed into the chat, and the assistant's replies. We do not receive your Shopify customer records, and we do not link a conversation to a Shopify customer account — conversations are anonymous unless the shopper identifies themselves in the message text.
If a customer asks you to ERASE their data¶
This one is automatic. When you or Shopify triggers a customer redaction,
Shopify sends us customers/redact and we act on it without you doing anything:
- their email address and phone number are removed from the stored text of that store's conversations;
- the same identifiers are removed from the record of any order lookup the assistant performed;
- any address they left when asking to speak to a person is deleted.
The conversation itself remains, with the identifiers replaced by [redacted].
That is deliberate: it erases the personal data while leaving you an accurate
record that a conversation happened, which you may need for your own accounting.
If you want a conversation deleted outright rather than redacted, email privacy@brilio.ai.
If you uninstall the app¶
Shopify sends shop/redact about 48 hours after an uninstall, and we then
erase the stored conversation content for your store and scrub the stored
Shopify credential.
Reinstalling afterwards gives you a working, empty concierge — the erased conversations do not come back.
Timelines¶
| Request | Who answers it | How long |
|---|---|---|
| Customer wants to see their data | You, from the Conversations page | Immediately |
| ...with Brilio's help | Brilio | Within 5 working days |
| Customer wants erasure | Automatic on Shopify's webhook | On receipt |
| Uninstall erasure | Automatic | ~48 hours after uninstall, per Shopify |
Statutory deadlines are usually one month from the customer's request, so answering from the Conversations page the same day leaves you comfortable room.
What to put in your own privacy policy¶
Because the conversations are yours, your storefront's privacy policy should say that they happen. Something of this shape is usually enough — check it with your own adviser:
We provide an AI chat assistant on our website, operated on our behalf by Brilio (Innovatica Technologies FZ-LLC). Messages you send to the assistant, including any personal information you choose to provide such as your email address or order number, are stored so we can respond to you and review the quality of the answers. You can ask us to access or erase this data at any time using the contact details in this policy.