Your data at a glance
Arbling uses your product catalogue and basic store details to check and improve your product information. Optional order events help link sales to AI-assisted visits. We do not store customer payment details.
For data questions, access or deletion requests, email hi@arbling.com. Some billing records and shared account data are retained as explained in Data retention below.
Who we are
Arbling provides an AI-readiness layer for e-commerce catalogs. This policy explains what data we process when you install or use the Arbling app (including the Shopify embedded app) and how we protect it.
Data we access
When you connect a store, we access only what is needed to score and enrich your catalog:
- Product catalog data — titles, descriptions, images, prices, variants, product metadata.
- Store profile — shop domain and basic store settings.
- Order events (optional) — order id and value, used solely to attribute AI-assisted sales. We do not store customer payment details.
We request the minimum Shopify scopes required: read products; write products, only to write Arbling's own product facts into your store's metafields; write script tags, only to add Arbling's shopping-assistant widget to your storefront when you switch it on, and to remove it when you switch it off; and read orders, only to attribute AI-assisted sales.
How we use it
- Compute your AI Sales Readiness score and eligibility buckets.
- Extract and verify product facts, and (with your approval) publish verified data and JSON-LD back to your store.
- Power your AI Seller widget, WhatsApp assistant, and agent-readiness checks.
- Measure AI citation and revenue attribution for your store only.
We never sell your data and never use it to train third-party foundation models.
AI arrivals and adapted prices
- AI-arrival measurement: after consent, the store's Arbling script records whether a visit came from an AI assistant and which page it landed on. A random share of such visits is held out to measure results. This uses the same pseudonymous visit identifier as today, and no new identifier.
- Post-purchase question: if the store asks "Where did you first hear about us?", the answer is stored with the order for the store's reports.
- Adapted prices: see C-1 for what is used and what is never used.
C-1 · How this price was set
This store uses Arbling to offer prices to visitors who arrive from an AI assistant, such as ChatGPT or Perplexity. The price you see was set automatically by rules the store chose.
What the rules use:
- which AI assistant sent you to this store, when your browser tells us;
- which page you arrived on;
- the time of your visit.
What the rules never use:
- your name, email address, location or purchase history;
- any sensitive characteristic, such as age, sex, ethnicity, disability or health.
What we keep: a record that this price was offered for this visit, so the store can check it. We do not build a profile of you.
The adapted price is never higher than the store's normal price. You can always buy at the normal price instead.
Sub-processors
We use trusted processors strictly to deliver the service: cloud hosting and database providers, and LLM providers (e.g., OpenAI) for text extraction and the AI Seller. Data sent to LLM providers is limited to your catalog content needed for the request.
We use HubSpot (HubSpot, Inc., EU data centre) as a processor for account data (name, email address, company) and, after you accept analytics in the cookie banner, for the pages you visit on arbling.com and in the Arbling app, so that we can contact you about your account and understand which parts of the product you use. Until you give us an email address, those page views are tied only to a random cookie identifier and not to you.
When you are signed in to the Arbling app, we record how you use it — screen replays with all typed input masked, click heatmaps and page views — through PostHog (US) to fix problems and improve the product. Visitors who are not signed in are not recorded.
When you run a free scan of a website on arbling.com, we record that website's address and the scan's findings (score, platform, type of site, suggested fixes) in HubSpot as a record about that website, so that we can follow up on the scan. If you enter an email address to receive the report, we store it in HubSpot together with that record and may send you one follow-up email about the scan from founder@arbling.com; every such email contains an unsubscribe link, and you can also write to privacy@arbling.com.
If you reach arbling.com from an AI assistant, we record which assistant referred you and which page you landed on, in HubSpot, so that we can see which assistants send visitors to us. Without an email address from you, this record is not linked to you.
To understand which businesses use the free scan, we may look up the scanned website's domain in Apollo (Apollo.io, Inc., United States) and store the company-level facts it returns — industry, employee count, revenue band, country, city, LinkedIn page and a short description — on that website's record in HubSpot. We send Apollo only the website's domain, never your name or email address, and we rely on Apollo's data processing terms and standard contractual clauses for this transfer.
When a company's website is scanned, or when we review how AI assistants describe a company, we may write about the result to up to two people at that company who are responsible for its website, its marketing or its sales. We take their name, job title, work email address and LinkedIn profile from a business contact database (Apollo.io, Inc., United States), from a contact list provided to us by a third party, or from a page where the company itself publishes them. We send one message and, if there is no reply, at most one short follow-up within the following ten days, and nothing after that unless the person replies. We keep these details in HubSpot. If you received such a message and want us to delete your details or never write again, reply to it or write to us, and we will.
Data retention & deletion (GDPR)
We honor Shopify's mandatory GDPR webhooks. On shop/redact — triggered automatically ~48 hours after you uninstall the app — we immediately delete the records tied specifically to your store: connector state, score reports, webhook history, and any AI-attributed order that was never invoiced.
Two categories are retained rather than deleted — by design, not by delay:
- Invoiced orders. If an AI shopping agent purchased from your store and we attempted to bill (or already billed) the usage fee on that order, the order record is kept permanently for financial recordkeeping, dispute defense, and reconciliation of any charge attempt whose outcome is still being confirmed with our payment provider — the same reason any billing platform retains transaction history.
- Shared account data, if you have other connected stores. AI Seller widget settings and chat logs, WhatsApp bindings, semantic search vectors, and the store's AI-attribution trails (the records generated when an AI shopping agent visited your store) live at your Arbling account level, not per store. This includes the attribution/session record linking a visit to a specific order, which can outlive that same order's own record — even for a never-invoiced order deleted immediately on this shop's redact — until your last connected store is removed, at which point all of it is deleted automatically.
On customers/redact we delete any record we hold that identifies the named customer. Some traffic records — such as an anonymized visitor or session identifier logged before a purchase — carry no reversible link back to a specific person, so a customer-level request cannot selectively reach those rows; they are removed as part of your store's own shop/redact instead. On customers/data_request we provide the identifiable data we hold. You can also request deletion any time by emailing us.
Retention is not one number — storefront-visit data sits in three layers with different lifetimes, and a deletion request reaches them at different points:
- In the shopper's browser. The storefront continuity cookie lasts 24 hours, is partitioned to your store, and is deleted as soon as the browser reports that storage is denied, withheld, unknown or revoked — no request to us needed.
- On our servers, per visit. The matching continuity record expires 24 hours after it is issued. A visit that never gets past its first step is discarded after 5 minutes rather than kept for the full day, and a shopper whose browser reports storage denied or withheld has the server-side record deleted immediately as well.
- On our servers, per record type. Once a visit is recorded, different record types run on their own clocks, and no single figure covers them:
- Visit detail and chat trails — at least 180 days from the event. That is a floor we can raise, not a deletion date.
- The widget's own chat log, kept for rate-limiting and short-term audit — 25 hours.
- The link between a visit and an order — 180 days from the event; a link attached to an order is held until that order's own 180-day deadline, then released. The order record itself follows the billing retention above.
- Day-level totals used for season-over-season comparison — kept indefinitely, because they carry no identifiers.
- Our records that a deletion actually happened — kept indefinitely by design, so an erased visitor cannot be re-linked. They hold no raw identifier, only a one-way hash.
- On our servers, per store or account. Connector state, score reports and invoiced orders follow the Shopify redact rules described above, not the visit clocks.
Security
Access tokens are encrypted at rest. All traffic is over HTTPS. Webhooks are verified with Shopify HMAC signatures.
Contact
Questions or data requests: privacy@arbling.com.
