Skip to content

Privacy Policy

Last updated: July 22, 2026

Scope

This policy covers the Suvenna product, the customer support application merchants install on their store, and suvenna.com, the marketing website, including the early-access waitlist. Both are operated by Dorothy Thomas, doing business as Suvenna ("Suvenna", "we", "us"). The first part describes the product; the second part describes the website and waitlist.

The Suvenna product

Suvenna provides AI-assisted customer support software to merchants. When a merchant's customer (a shopper) contacts support through the storefront chat widget or by email, Suvenna helps the merchant answer using the merchant's own policies and, when the shopper asks about their own order, the order's status.

For a merchant's own account data (login, workspace settings, billing), Suvenna is the data controller. For a merchant's shoppers' personal data processed to deliver support, Suvenna acts as a processor on the merchant's behalf, under our Data Processing Addendum.

Data we process for merchants

  • Account data: email, authentication credentials (hashed), optional two-factor secret, workspace name, and team memberships.
  • Configuration: support policies, automation rules, connected mailbox tokens (encrypted), and Shopify credentials (encrypted).
  • Billing: plan and status, via Stripe for direct customers or Shopify billing for App Store installs. We do not store card numbers.

Shopper data we process on the merchant's behalf

  • Order data, read live from Shopify when a shopper asks an order question: order number, fulfillment and financial status, line items, carrier tracking, order total, and dates. Order records are not stored; they are fetched per request to answer the question.
  • Email, used solely for identity binding: to confirm a shopper can only see their own order, and to resolve a logged-in shopper to the correct customer.
  • Support content: the messages a shopper sends (chat or email, including anything they choose to type or attach) and the replies generated, stored as the merchant's support records.

We do not request or read shopper name, phone, or address fields from Shopify. A shopper may type such details into a message; that content is handled as support content, as described below.

AI processing and service providers

To draft support replies, support content is sent to our AI sub-processor, Anthropic, transiently. This can include the message the shopper wrote and the order details needed to answer. We send only what is needed to answer the ticket, never full customer profiles. Anthropic processes this data under commercial terms that do not use it to train models and apply zero or short-term data retention.

Our sub-processors for the product:

  • Anthropic: AI reply drafting (shopper messages, order details, transient).
  • Supabase: data storage and authentication (support records, encrypted tokens).
  • Vercel: hosting and compute (data in transit).
  • Mailgun: email transport (inbound and outbound email content).
  • Google and Microsoft: connected merchant mailboxes (email content in mailboxes the merchant owns and connects).
  • Stripe: billing for direct customers (merchant billing only, no shopper data).

We do not sell personal data, and we do not use shopper data for advertising.

Product data retention

  • Support records (conversations, messages, attachments, and related working data): closed tickets are automatically deleted after 180 days on paid plans and 90 days on the free plan or after a plan lapses. Open tickets are retained until closed.
  • Encrypted credentials: deleted when the merchant disconnects the integration or uninstalls the app.
  • Compliance request logs: retained as an audit trail, with personal identifiers scrubbed after 90 days.
  • On uninstall, Shopify's shop redaction request (about 48 hours after uninstall) triggers erasure of the shop's shopper data.

Deletion and requests for the product

Shoppers should direct privacy requests to the merchant they contacted, who is the controller of their data. Suvenna honors Shopify's customer data request, customer redaction, and shop redaction webhooks: a redaction erases the shopper's personal data across our records. Merchants can also delete their workspace, which removes their data.

Product security

Data is encrypted in transit (HTTPS) and at rest (platform disk encryption; OAuth tokens are additionally encrypted at the application layer with AES-256-GCM). Access is least privilege and tenant isolated with row-level security, and two-factor authentication is available on every account.

The website and waitlist

Data we collect on suvenna.com

We collect only what you give us directly:

  • Your email address, when you join the waitlist.
  • Your store URL and approximate support volume, if you choose to provide them on the waitlist form. Both are optional.
  • UTM parameters attached to the link you arrived from, so we know which channel brought you here.
  • The contents of messages you send us through the contact page.

We do not collect payment information on this site. The waitlist requires no card and no payment.

How we use it

  • To notify you about your waitlist position and when your onboarding wave opens.
  • To send launch-related communications, such as founding-member pricing details. You can unsubscribe from these at any time.
  • To respond to inquiries you send through the contact page.
  • To understand, in aggregate, which channels bring visitors to the site.

What we do not do

  • We do not sell your data. Not to anyone, not in any form.
  • We do not run third-party advertising trackers or ad pixels on this site today.
  • We do not share your information with third parties for their own marketing.

Cookies

This site uses essential cookies only, the minimum needed for the site to function. We do not set analytics or advertising cookies today. If we add analytics or ad pixels in the future, we will update this policy first and, where required, ask for your consent.

Website data retention

We keep waitlist information until you are onboarded as a customer, you ask us to delete it, or we retire the waitlist, whichever comes first. Contact messages are kept as long as needed to resolve your inquiry and for a reasonable period afterward for our records. You can request deletion at any time, as described below.

Your rights

You can request a copy of the information we hold about you, ask us to correct it, or ask us to delete it. Send any of these requests through our contact page and we will respond within the timelines the law requires. If you are a shopper whose data is handled by a merchant using Suvenna, contact that merchant; we assist merchants in fulfilling these requests.

If you are in the EU or UK (GDPR)

You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection. Our legal basis for processing waitlist data is your consent, which you may withdraw at any time. For the product, we process shopper data on the merchant's instructions as a processor. You also have the right to lodge a complaint with your local supervisory authority.

If you are a California resident (CCPA)

You have the right to know what personal information we collect, to request its deletion, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined by the CCPA, so there is nothing to opt out of. To exercise any right, use the contact page.

Children

Neither the product nor this site is directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

Changes

We may update this policy as the site and the product evolve. When we do, we will change the date at the top of this page. Material changes affecting how we use waitlist data will be announced to the waitlist by email; material changes affecting product data will be announced to merchants.

Contact

Questions about this policy or your data go to Suvenna at admin@suvenna.com or through our contact page.