Privacy Policy

This Privacy Policy governs the Resayil AI service delivered as a per-store Shopify Custom App to merchants on a direct, invite-only basis ("Service"), operated by Alphia Ventures Sdn Bhd, a company incorporated in Malaysia ("we", "our", or "Alphia").

The Service is provided exclusively to direct, invited merchants under a private agreement with Alphia Ventures Sdn Bhd. Billing is handled exclusively through PayPal. Please review this policy before activating your subscription.

1. Who We Are

Data controller: Alphia Ventures Sdn Bhd, Kota Damansara, Petaling Jaya, Selangor, Malaysia (Company Registration No. 1392457-T).
Authorised signatory: Soud Shoja, Founder & General Manager.
Privacy contact: privacy@alphia.net  /  soud@alphia.net

Governing law: Malaysia (Personal Data Protection Act 2010) as the primary governing law. The GDPR applies to the extent that a merchant is established in, or directs their activities at individuals in, the European Economic Area (EEA) or United Kingdom.

2. Scope and Roles

Resayil AI acts as a data processor on behalf of Shopify merchants when processing store data (products, orders, customers) on their instruction. The merchant (Shopify store owner) remains the data controller for their customers' data.

For data that Alphia collects directly about merchants — account credentials, subscription records, billing history, conversation content sent to the AI agent — Alphia Ventures Sdn Bhd is the data controller.

3. Data We Collect and How We Use It

4. How the AI Agent Uses Your Store Data

When you instruct the AI agent to perform a task — for example, "what were my orders today?" or "reduce the price of the blue hoodie by 10%" — the agent fetches the relevant data from your Shopify store via the Shopify Admin API and passes it, together with your instruction, to our AI inference service to formulate a response.

• Store data (products, orders, customer records) is accessed only to answer the specific query you direct the agent to handle. The conversation in which it appears is retained to run the service; we are introducing automated rolling deletion of that history (target ~30 days).
• Store data is never used for training AI models, advertising, analytics sold to third parties, or any purpose other than operating the service.
• All destructive or irreversible operations (price changes, deletions, order updates, storefront edits) are held for your explicit approval before the agent executes them. The agent cannot silently modify your store.
• Data from one merchant's store is never accessible to another merchant's agent session. Per-tenant isolation is enforced at every database query layer via a client_id scope.

5. AI Inference Processing

Merchant instructions, relevant store context, and conversation history are transmitted over TLS to the Resayil AI Gateway, our access layer for AI processing, operated by Alphia. The gateway routes each request to a cloud-hosted large language model provider that generates the response. We do not use a public consumer AI product.

The model processes your prompt solely to produce a response for your agent session. We do not use your data to train AI models, and we contractually require our model provider not to train on it either. We are finalising the written no-training and limited-retention commitment from our model provider; until then we minimise the personal data we send.

Customer data from your Shopify store (such as customer names, email addresses, or order histories) is included in a prompt only when your instruction requires the agent to act on that data. We are rolling out automated tokenisation that replaces these identifiers with opaque tokens before a prompt leaves our systems.

6. Sub-processors

The following sub-processors may process personal data in connection with the service. We execute a Data Processing Agreement (or equivalent) with each sub-processor.

We do not use any public consumer AI product (such as a consumer chatbot) as a sub-processor. All AI inference is routed through the Resayil AI Gateway operated by Alphia to our cloud model provider under contract.

7. Data Storage and Geography

• Primary database and application servers: Contabo VPS, United States. All sensitive data (access tokens, credentials) is encrypted at rest using AES-256.
• Encrypted off-site backups: stored as AES-256 / GPG-encrypted snapshots, encrypted before upload with the passphrase held offline by Alphia, so the storage provider cannot read backup contents. We are migrating these backups to object-lock storage with a fixed retention window.
• Cache and queue layer (Redis): Same Contabo VPS. Session tokens have a short time-to-live; no personal data is durably stored in Redis.
• AI observability (Langfuse, self-hosted): Same Contabo VPS. Trace data is scrubbed of personal data (names, emails, phone numbers) before storage.
• Error tracking (Sentry SaaS): United States. Our Sentry client strips personal data fields before transmitting error events.

8. International Data Transfers (EEA / UK)

If you are a merchant located in the European Economic Area (EEA) or United Kingdom, data processed on your behalf may be transferred to the United States and other countries outside those regions, where our hosting infrastructure and sub-processors operate.

Transfer mechanism: for transfers outside the EEA/UK we rely on Standard Contractual Clauses (SCCs) under GDPR Article 46(2)(c), together with supplementary measures (notably tokenisation of customer identifiers before transmission). We are completing the SCCs and the transfer impact assessment for the cloud model provider; onboarding of EEA/UK merchants is gated on that being in place.

A copy of the relevant SCCs or transfer impact assessments is available on written request to our privacy contact address.

9. Your Rights as a Data Subject

Depending on your jurisdiction, you may have the following rights in relation to personal data we hold about you as a merchant:

• Right of access — request a copy of the personal data we hold about your account.
• Right to rectification — ask us to correct inaccurate personal data.
• Right to erasure — request deletion of your personal data (subject to legal retention obligations).
• Right to data portability — request your account data in a machine-readable format.
• Right to restriction — ask us to restrict processing in certain circumstances.
• Right to object — object to processing based on legitimate interests.

To exercise any of the above rights, contact us at the privacy address in Section 12. We will respond within 30 days of receiving your request. EEA/UK merchants may also lodge a complaint with their local data protection authority.

10. Security Measures

• Encryption at rest: Shopify Admin access tokens and account credentials are stored using AES-256 encryption. The raw token is never written to disk in plaintext.
• Transport security: All connections between the merchant, our servers, Shopify, messaging channels, and the AI gateway use TLS 1.2 or higher.
• Per-tenant isolation: Every database query is scoped to a client_id. No merchant's data can be accessed by another merchant's agent session.
• Access controls: The merchant dashboard requires a password and supports TOTP two-factor authentication. Internal admin access requires TOTP 2FA.
• Approval gates: Destructive or irreversible Shopify operations (price changes, deletions, order updates, live storefront edits) are always held for your explicit approval before execution. The agent cannot silently modify your store.
• Breach notification: In the event of a confirmed personal data breach affecting your account, we will notify you and, where required by law, the relevant supervisory authority, within 72 hours of becoming aware of the breach.

11. Children's Privacy

Resayil AI is a business tool intended solely for Shopify store owners and their authorised team members. We do not knowingly collect personal data from anyone under 18 years of age. If you believe we have inadvertently collected such data, contact us immediately and we will erase it.

12. Changes to This Policy

We will notify active merchants of material changes to this policy via dashboard notification and, where applicable, email, at least 14 days before the change takes effect. The "Effective" date above always reflects the current version. Continued use of the service after the effective date constitutes acceptance of the updated policy.

13. Contact