Privacy Policy

1. About this policy

This Privacy Policy explains how Frostleaf LLP (“we”, “us”, “our”) handles personal data in connection with Confirmly, our Shopify app, and this website (together, the “Service”). It is written to meet the Information Technology Act, 2000 and the rules made under it, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its rules as they come into force, and Shopify’s requirements for apps.

We handle personal data in two different roles:

As a Data Processor for merchants. When a Shopify merchant (“Merchant”) uses Confirmly, we process the personal data of the Merchant’s customers (“Customers”) only on the Merchant’s behalf and instructions. The Merchant is the Data Fiduciary for that data. Our commitments to Merchants are set out in the Data Processing Agreement.
As a Data Fiduciary. For the personal data of Merchants and their staff, and of visitors to this website, we decide how and why it is processed.

If you are a Customer who received a call from a store, that store is responsible for your data. Please contact the store first. See section 9.

2. The data we handle

2.1 Merchants

Store details: store name, myshopify.com domain, store contact email, country and currency, and the Shopify access token that lets the app work with your store.
Account and settings: the name and email of the staff member who installs or uses the app, your call settings, languages, timings and preferences.
Billing records: credit purchases, balances and usage, as reported by Shopify. Payments are handled by Shopify. We do not receive card or bank details.
Support: messages you send us and our replies.
Technical data: logs of how the app is used and how it performs, such as timestamps, errors and IP addresses, kept for security and troubleshooting.

2.2 Customers of a Merchant (processed for the Merchant)

From the Merchant’s Shopify store:

name, phone number and email address;
delivery address, including city, state, pincode and country;
order details: order number, items, quantities, prices, total, currency, payment method (for example, cash on delivery) and order and fulfilment status.

Created when a confirmation call happens:

call time, duration, number of attempts and whether it connected;
the outcome: whether the order was confirmed or cancelled, any address correction, delivery timing preference, cancellation reason and questions the Customer asked;
a transcript of the call; and
an audio recording, only if the Merchant switches recording on. Recording is off by default.

We do not collect Customers’ payment card or bank details, and the app does not run any script on the Merchant’s storefront.

2.3 Website visitors

Analytics: pages viewed, referring site, device and browser type, and approximate location, collected with Google Analytics on our live website. See our Cookie Policy.
Contact: your name, email and anything you tell us when you email us.

3. Why we use it

Merchants’ data, to:

install, run and secure the app for your store;
process credit purchases and show your usage;
provide support and send service messages, such as changes to prices or these policies;
prevent fraud, abuse and misuse of free credits; and
meet legal, tax and regulatory obligations.

We process this data to perform our contract with you, to comply with law, and for legitimate uses permitted under the DPDP Act. If we ever want to send you marketing emails, we will ask first, and you can opt out at any time.

Customers’ data, only to:

decide which orders to call and when, based on the Merchant’s settings;
place the call and tell the Customer their order and address details;
understand the Customer’s answers and record the outcome;
write the outcome to the order in the Merchant’s Shopify admin;
charge credits for connected calls; and
investigate problems the Merchant reports to us.

Website visitors’ data, to:

understand how the website is used and improve it; and
reply to your messages.

4. AI and automated processing

Confirmly’s calls are made by an AI voice agent. It converts the Customer’s speech to text, works out what they said and replies in speech. The agent tells the Customer at the start of every call that it is the store’s automated assistant.

What happens to an order after a call, such as tagging, cancelling or updating an address, follows the settings the Merchant chooses. A Merchant can require their own approval before an address is changed or an order is cancelled.
A Customer who disagrees with the outcome of a call can contact the store and ask for a person to review it.
We do not use Customers’ personal data, call transcripts or recordings to train AI models.

We do not sell personal data. We share it only with:

Shopify, to receive orders, write results back to the Merchant’s store and process billing.
Service providers who help us run the Service, under contracts that require them to protect the data and use it only to provide their services to us. They fall into these categories: cloud hosting and databases; telephony, to place calls; voice AI, for speech recognition and speech generation; language processing, to understand Customers’ answers; email; and website analytics. Merchants can ask us for the current list.
Authorities, where required by law or a valid legal order, or to protect the rights, safety and security of Customers, Merchants, the public or us.
A successor business, if all or part of our business is merged, acquired or reorganised, under the same protections as this policy.

6. Where data is processed

Data is processed in India and may also be processed in other countries where our service providers operate. When data is processed outside India, we do so only as permitted by Indian law, including any restrictions notified by the Government of India, and with safeguards in our contracts.

7. How long we keep data

Customers’ personal details and call content: 30 days after calling on an order has finished, we remove the Customer’s name, phone number, email, street address and pincode, the order’s items, the transcript and any recording. Orders still being called are not affected until calling finishes.
What stays after that: order number, totals, payment method, dates, call outcome and duration, and city, state and country. On their own these do not identify a person, and they keep a Merchant’s reports accurate.
When a Merchant uninstalls: we delete the store’s data, including its Customers’ data, within 30 days. We also act on Shopify’s privacy requests for a Customer’s data or a store’s data.
Billing and tax records: kept for as long as tax and accounting laws require.
Security logs: kept for at least one year, as Indian law requires, and then deleted.
Backups: deleted data may remain in encrypted backups for a short period until those backups are overwritten.

8. How we protect data

We use reasonable security practices and procedures to protect personal data, including:

encryption of data in transit and at rest;
access limited to staff who need it, with strong authentication;
access logs, monitoring and separate test and production environments;
verification of every request from Shopify and from our call provider;
call recordings stored privately and played only through links that expire; and
an incident response process.

No system is completely secure. If a personal data breach affects you, we will tell you without undue delay and report it to the authorities as the law requires. When we process data for a Merchant, we notify the Merchant so they can meet their obligations.

9. Your rights

If you are a Customer who received a call

The store you ordered from controls your data. You can ask the store to give you information about it, correct it, or delete it. Stores can send those requests to us through Shopify or by email, and we act on them within the time the law requires. If you cannot reach the store, you can contact our Grievance Officer and we will pass on your request and help where we can.

If you are a Merchant or a website visitor

Under Indian law, you can:

ask what personal data we hold about you and how we use it;
ask us to correct, complete or update it;
ask us to delete it, unless we must keep it by law;
withdraw any consent you have given, for the future;
nominate someone to exercise your rights if you die or become unable to; and
raise a grievance with us, as described below.

10. Grievance Officer

If you have a question or complaint about how we handle personal data, contact our Grievance Officer using the details below. We will acknowledge your complaint promptly and resolve it within the time required by law, and in any case within 30 days.

Frostleaf LLP
Email: business@frostleaf.co

If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is able to receive complaints.

11. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children as Merchants or website visitors.

12. Changes to this policy

We will update this policy when the Service or the law changes, and change the date at the top. We will tell Merchants about material changes by email or in the app before they take effect.