This policy explains how Chooza collects, uses and protects personal data on chooza.io, in the merchant dashboard and through the Chooza assistant on our merchants' stores.
1. Who we are and our roles
Chooza ("we", "us") is an independent business based in Dubai, United Arab Emirates. For the purposes of data protection law, Chooza is the controller described below. Contact: hello@chooza.io.
Our role depends on whose data it is:
- Merchants (account holders): businesses that create a Chooza account. For account, store and billing data, we are the controller.
- Shoppers (visitors to a merchant's store): people who use the Chooza assistant on a merchant's website. For their conversations and form submissions, the merchant is the controller and we are a processor, acting on the merchant's instructions.
- Website visitors and demo users: people who visit chooza.io, try the demo or contact us. For this data, we are the controller.
2. What we collect and why
A. Merchants
| What | Why | Lawful basis |
|---|---|---|
| Email address, store name, website address, account settings | Sign-in, running your account, service emails | Contract |
Product feed, knowledge base, store policies, contact options, notification email addresses | Powering your assistant and forwarding shopper messages to you | Contract |
| Plan, billing status, renewal dates (from Paddle) | Applying your plan's features and limits | Contract; legal obligation |
| Usage data (conversation counts, AI cost per store) | Plan limits, fair use, improving the service | Contract; legitimate interests |
Payment card details, billing addresses and tax IDs are collected and processed by our Merchant of Record, Paddle.com Market Ltd. We never see or store card numbers.
B. Shoppers (we process this on the merchant's behalf)
- Chat messages: what the shopper types, the assistant's replies, and the products shown.
- Contact details in chat are masked: email addresses and phone numbers typed into the chat are masked before storage, unless the merchant has chosen to keep them unmasked.
- Contact form submissions: name, contact details and message entered in the assistant's contact form. These are emailed to the merchant's chosen addresses and kept in the merchant's dashboard. The form tells shoppers their details go to the store.
- Session ID: a random ID kept in the shopper's browser so the conversation continues across pages. It is not used to track shoppers across websites.
- Hashed IP address: IP addresses are turned into a one-way hash to limit abuse. We don't store raw IP addresses with conversations.
C. Website visitors and demo users
- Demo: the website or feed address you enter, product data we read from that public website, your test messages and a hashed IP address. Lawful basis: legitimate interests (showing you the product and preventing abuse).
- "Email me this demo": your email address, the demo it relates to, and whether you agreed to receive setup tips (with the time you agreed). We send you the link and may follow up once about your demo; tips are sent only if you tick the box. Every email has a one-click unsubscribe. Lawful basis: legitimate interests for the link and one follow-up; consent for tips.
- Contact and enquiries: name, email, company, website and message you send us. Lawful basis: legitimate interests (answering you).
- Bot protection: A bot-protection service checks that forms are used by people, not bots. It processes technical signals from your browser for this purpose only.
- Service logs: our hosting and error-tracking providers record technical data (such as IP address, browser and error details) to keep Chooza secure and working. Lawful basis: legitimate interests.
3. Who we share data with
We use trusted service providers to run Chooza, only for the purposes in this policy:
- hosting, database and sign-in;
- AI model and product search providers that generate the assistant's replies and search results;
- email delivery;
- background job processing;
- error monitoring;
- DNS and bot protection;
- Paddle, our Merchant of Record, for checkout, payment, tax and invoices.
Some of these providers are located outside your country, including in the European Union and the United States. We don't sell personal data.
4. How long we keep data
- Shopper conversations: 90 days by default. Merchants can choose 30, 90, 180 or 365 days in Settings; older conversations are deleted automatically.
- Demos: a demo store and its test chats are deleted 24 hours after creation, or 7 days after creation if you asked us to email you the demo.
- Demo email leads: kept until you ask us to delete them. After you unsubscribe, we don't email you again. If you start a trial, they become part of your account.
- Merchant accounts: kept while your account is active. When you delete your store or account, your products, knowledge base, conversations and settings are deleted from our systems; copies in backups are removed as those backups expire.
- Enquiries: kept as long as needed to answer you and follow up.
- Service and error logs: kept for a limited time for security and troubleshooting.
- Billing records: kept by Paddle as required by tax law.
5. Cookies and browser storage
We don't use advertising or tracking cookies, so we don't show a cookie banner.
- chooza.io and the dashboard: essential cookies keep you signed in and let your browser open demos you created. Your light or dark mode choice is stored in your browser (localStorage).
- The assistant on merchants' stores: sets no cookies. It uses the browser's sessionStorage and localStorage only to keep the random session ID and the conversation open as the shopper moves between pages.
- Checkout: When you pay, Paddle's checkout may set its own security cookies on Paddle's domains.
6. Your rights
Depending on where you live (for example the EU, UK, UAE or California), you may have the right to access, correct, delete, restrict or object to processing of your personal data, to receive a copy of it, and to withdraw consent at any time.
- Shoppers: the merchant controls your conversation data, so please contact the store first. We help merchants answer verified requests.
- Merchants and visitors: email hello@chooza.io. We respond within the time required by law.
If you are in the EEA or UK, you can also complain to your local data protection authority (in the UK, the ICO).
7. Security
We use encryption in transit, strict separation of each store's data, masking of contact details in chat, hashed IP addresses and limited access to production systems. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.
8. Children
Chooza is a business service and is not directed at children. We don't knowingly collect children's data on chooza.io. Merchants are responsible for how their own stores handle young shoppers.
9. Changes
We will post changes here and update the date above. For material changes affecting merchants, we will also email them.
10. Contact
Privacy questions and requests: hello@chooza.io