Privacy policy — what we collect, and why

1. Who we are

The Comver platform, the comver.io website and the “Comver OS” Shopify app are operated by Comver sp. z o.o. (“Comver”, “we”, “us”), a limited liability company established in Poland. Where this policy says “you” it means whoever is reading it: a visitor to our website, a merchant or team member using the Comver workspace, or a shopper whose data reaches Comver through a store that uses our product.

Legal entity

Comver sp. z o.o.

Registered office

Złota 59, 00-011 Warsaw, Poland

US office

3739 Balboa St, San Francisco, CA 94121, United States

Tax identification

VAT ID 747488490399 · [KRS / NIP to be confirmed]

Privacy contact

privacy@comver.io

Data protection officer

[Name / “not appointed” — to be confirmed by counsel]

This policy was last updated on 16 August 2026. It applies to comver.io (including its Polish version), the Comver workspace on the Comver domain, the embedded Shopify app, the theme app extension that renders Comver widgets on a merchant’s storefront, and the calls, SMS and emails Callio sends. It should be read together with our Terms of service and Cookie policy.

2. Scope and our roles

Comver processes personal data in three situations, and our role differs in each. Under the EU General Data Protection Regulation (GDPR) and equivalent laws, a controller decides why and how data is processed; a processor processes it on the controller’s documented instructions.

2.1 Visitors to comver.io

When you browse comver.io, request a demo, subscribe to our notes or sign in from the site, Comver is the controller. The data involved is described in sections 3.1 and 3.2.

2.2 Merchants and their teams

When you create a Comver account, name a workspace, connect a Shopify store or invite teammates, Comver is the controller for your account and workspace data (section 3.2). Access to a store is shared with everyone in your organization; roles are owner, admin and member.

2.3 Shoppers and customers of a connected store

When a merchant connects a store, Comver reads store records through the Shopify Admin API, records storefront behaviour through the “Comver Behaviour” app embed and, where the merchant switches Callio on, contacts shoppers by phone, SMS and email. For all of this the merchant is the controller and Comver acts as its processor. The merchant decides which modules run, which campaigns are switched on and whether marketing consent is required before a message goes out. We offer a data processing agreement (DPA) with standard contractual clauses to every merchant on request at privacy@comver.io.

3. What we process

Below is the data that reaches Comver, grouped by where it comes from. We list the categories the product actually reads and stores; if a source is not connected in your workspace, nothing from it is processed — Comver only reasons over connected sources.

3.1 Website visitors (comver.io)

• Consent choice — the comver_consent cookie and a matching browser-storage entry record which cookie categories you accepted and when (180 days). See the Cookie policy.
• Demo request — name, work email, organization, phone number with country code, an optional message, whether you asked to be called now or later, and the site language you used. We use it to run the session you asked for and to call the number you left.
• Newsletter — the work email you subscribe with.
• Server and security logs — request metadata (URL, timestamp, user agent, truncated or hashed IP) kept by our hosting provider to run and secure the site.

Analytics cookies are switched off until you accept them, and comver.io sets no advertising or retargeting cookies.

3.2 Comver accounts and workspaces

• Sign-in — your email address and, depending on how you sign in, an identifier from Shopify, Google or Apple, or a password we store only as a salted hash. Signing in from the Shopify app uses the store’s Shopify identity — no password.
• Profile — full name, optional photo (uploads are cropped square and stored at 256×256, or a photo URL filled in from Google or Apple), and up to five optional social links (website, LinkedIn, X, Instagram, GitHub).
• Organization and team — the workspace name, who belongs to it and in which role, and pending invitations (work email, role, an invite link that expires after 7 days).
• Billing status — the plan identifier and billing status for each store, the Shopify charge reference and the last synchronization time. Charges themselves are handled by Shopify Billing; on the public audit funnel card payments are handled by Stripe. Comver never receives full card numbers.

3.3 Store data read from Shopify

When you install Comver we request only the Shopify permissions required to run the modules you activate. The granted scopes are listed in Settings › Shopify integration. Through them Comver reads and, where the module needs it, writes:

• Store facts — store name, domain, contact email, Shopify plan, currency, country and the live theme.
• Products and collections, including product images and files Comver publishes on your behalf (for example a product page template — default templates are never overwritten).
• Orders — line items, totals, discount codes and cart tokens (used to count which module or campaign an order came from), refunds.
• Customers — name, email, phone, marketing consent status, tags, order history and lifetime value. Customers are synchronized into Comver so the Customers pipeline, personas and Callio can work with them; products and orders are read live from Shopify.
• Themes, discounts and purchase options — to render widgets, create the real discount codes a module or Callio offers, and (where approved by Shopify) subscription contracts.

Comver also registers Shopify’s privacy webhooks — customers/data_request, customers/redact and shop/redact — so that requests you receive as a merchant flow through to us automatically, and app/uninstalled so we know when to start the deletion clock (section 9).

3.4 Storefront behaviour

Once the “Comver Behaviour” app embed is switched on in your theme, Comver records:

• Sessions — visit, device type, referrer and traffic source, pages viewed, time on page.
• Page events — clicks, scroll depth, add-to-cart, checkout started, rage clicks and form interactions (which field was touched — never the values typed).
• Heatmaps, funnels and session replays — built from the events above; replays are sanitised so text inputs are not captured.
• Identity — when a shopper is logged in to the store, the session is joined to that customer’s name and email so the Customers pipeline and Visitors can show who was here. Anonymous sessions stay anonymous.

Behaviour is collected anonymized where the visitor is not a known customer, and the raw IP address of a storefront visitor is never stored. Details are in section 7.

3.5 Callio calls, texts and email

• Phone numbers and email addresses of the shoppers a campaign reaches, together with the Shopify marketing-consent flags Callio checks before sending.
• Call recordings and transcripts produced by the voice provider (ElevenLabs), the outcome of each call, and what Callio said and offered — including any discount code it named and the checkout link it texted.
• SMS and email content and delivery events (sent, delivered, opened, clicked, bounced, unsubscribed, STOP), the store’s own sender numbers and verified sending domains, and a suppression list of destinations that must not be contacted again.
• Storefront chat — messages a shopper types to Callio on the storefront and the answers it gives.

Section 5 explains how these channels are governed. Checkout, payment and shipping always remain in Shopify — Callio never takes card details on a call.

3.6 Data you give us directly

Support requests, security reports, feedback and anything you upload (for example a competitor URL for Competition, a CSV of reviews for Trust AI, or a product brief for Creator).

4. Why we process it, and on what legal basis

Where Comver is the controller, each purpose rests on one of the legal bases in Article 6 GDPR. Where Comver is a processor, the legal basis is the merchant’s and is set out in the merchant’s own privacy notice.

We do not use your data for automated decisions that produce legal or similarly significant effects on you. Where Comver scores or segments shoppers (intent scores, personas, pipeline stages), it does so as a processor to help the merchant decide what to do next; those scores are explainable and every action they suggest is taken by the merchant or by a policy the merchant configured.

5. Callio: calls, texts and email

Callio is Comver’s voice and chat commerce agent. On a connected store it runs campaigns that call first, text when the call cannot connect and email when the phone cannot reach the shopper at all; it also answers and takes orders in storefront chat. Because a call is a more direct thing than a banner, we hold Callio to explicit rules, and give merchants controls for the rest.

5.1 What the merchant controls

• Consent gates — “Require Shopify email marketing consent” and “Require Shopify SMS marketing consent” stop a step from going to anyone who has not opted in in Shopify. “Include signed unsubscribe link in marketing emails” and “Include STOP instructions in SMS” add the opt-out to every message.
• Suppression list — a destination that unsubscribes, replies STOP or is added by the merchant is never contacted again.
• Own senders — Callio calls and texts from numbers the store owns (up to 10 per store) and emails from a sending domain the store verified with DKIM, SPF and DMARC (up to 5), so a shopper can see who is writing and reply to them. New numbers are warmed up with hourly and daily caps.
• Which campaigns run, the wait before the first call, the discount Callio may name and its cap.

5.2 What Callio will not do

• It never fabricates product facts, ingredients, reviews or medical claims; discount limits are enforced.
• It never takes payment. Mid-call it can look up the catalogue and send a Shopify checkout link by SMS; checkout, payment and shipping stay in Shopify.
• Where it cannot help it hands the conversation to a human at the store.

5.3 Recording and notice

Calls placed through the voice provider may be recorded and transcribed so the merchant can review what was said and so attribution can be checked. Laws on call recording, automated calling and marketing messages differ by country and US state (for example GDPR and national ePrivacy rules in the EU, and the TCPA and state two-party-consent laws in the US). The merchant is responsible for having a lawful basis, giving any required notice at the start of a call and honouring quiet hours; Comver provides the consent gates, opt-outs, suppression list and audit trail that make that possible, and Callio identifies the store it is calling for. Merchant obligations are set out in the Terms of service.

6. AI features

Several parts of Comver use large language models: Copilot’s storefront scan, daily brief and “Ask Copilot” chat, Callio’s conversations, AI-written persona summaries, Creator’s product-page drafts and Trust AI’s review drafts, translations and summaries. To do this Comver sends the relevant context — a page’s content, a shopper’s cart, a customer’s order history, a review — to a model provider (OpenAI or Anthropic) through their business APIs, and for voice to ElevenLabs.

• We send the minimum context the feature needs and, where the feature works with a template instead, we do not send it at all (personas fall back to template summaries without a model key; storefront chat runs a deterministic playbook without one).
• We use these providers under business terms; we do not permit our customers’ content to be used to train the providers’ models where the provider offers that control, and we do not train our own models on a merchant’s customer data.
• AI output is probabilistic. Comver labels estimates as estimates (the ≈ mark), shows missing inputs explicitly instead of filling them with assumptions, keeps high-risk areas manual, keeps a complete audit trail of AI, user and Autopilot activity, and lets you pause or revert changes at any time. Anything Comver publishes on your storefront or sends to a shopper remains your responsibility to review — see the Terms.

7. Storefront behaviour data

The Behaviour embed is built to give a merchant a truthful picture of what happens on the storefront without collecting more than that picture needs:

• Never the raw IP. The visitor’s IP address is used transiently to derive coarse location and is not stored.
• Form interactions, not values. Comver records that a field was focused or a form submitted, never what was typed.
• Sanitised replays. Session replays reconstruct clicks and scrolls; text inputs are masked.
• Nothing until real visits arrive. Comver shows no behaviour data — and holds none — until the embed is switched on in the live theme and real visits are recorded.
• Known customers are named. When a shopper is signed in to the store, their session is joined to their customer record so the merchant can see who was here. This is personal data of the store’s customer, processed for the merchant.

Storage set by the embed on a merchant’s storefront is first-party to that store and is governed by the store’s own cookie notice; see the Cookie policy, section 5.

8. Sub-processors and sharing

Comver uses the following providers to run the product. Each receives only the data needed for its role and is bound by a data processing agreement. We will give merchants who hold a DPA with us [30] days’ notice before adding a sub-processor that will process their customers’ data.

Beyond sub-processors we share personal data only: with your organization’s other members (they see the same stores and reports you do); with a merchant, where we act as its processor; with professional advisers, insurers and auditors under confidentiality; with authorities where the law requires; and with a successor in a merger, acquisition or asset sale, on the same terms as this policy. We do not sell personal data and we do not share it for cross-context behavioural advertising.

9. How long we keep data

Where a legal hold, a dispute or a statutory duty requires it, we keep the affected records for as long as that requirement lasts and no longer.

10. International transfers

Comver is established in Poland and also operates from the United States. Several sub-processors in section 8 are in the United States. Where personal data protected by GDPR (or UK GDPR) leaves the EEA or the UK we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) with the recipient, on the recipient’s certification under the EU-US Data Privacy Framework where it holds one, and on supplementary measures such as encryption in transit and at rest and pseudonymisation of behaviour data. You can ask for a copy of the relevant safeguards at privacy@comver.io.

11. Your rights

Under GDPR, and similar laws elsewhere, you can ask us to:

Write to privacy@comver.io. We answer within one month (extendable by two months for complex requests, in which case we tell you). We may need to verify your identity first. You also have the right to lodge a complaint with a supervisory authority — in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw), or the authority of the EU country where you live or work.

11.1 If you are a merchant

The Export and Delete controls in Settings › App settings › Data & privacy are shown but not yet enabled in this release. Until they are, ask us at privacy@comver.io and we will export or delete your workspace and store data by hand. Requests that reach you from your own customers through Shopify (data request, redact) are forwarded to us automatically by Shopify’s privacy webhooks and acted on without you having to do anything else. Uninstalling the app removes the theme embed, stops all storefront tracking and modules, and starts the 30-day deletion clock.

11.2 California and other US states

If you are a resident of California (or another US state with a comprehensive privacy law) you have the right to know what personal information we collect, use and disclose, to access it, correct it and delete it, to opt out of its “sale” or “sharing”, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. Comver does not sell personal information or share it for cross-context behavioural advertising, and does not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. Section 3 is our notice at collection; section 9 states retention. To exercise these rights, or to appoint an authorised agent to do so, use the contact in section 14; we will verify the request against the account or contact details we hold. Where Comver processes personal information on behalf of a merchant it does so as a “service provider” and will refer consumer requests to that merchant.

12. Security

• All traffic between your browser, the storefront widgets, the Comver workspace and our providers is encrypted in transit; data at rest is encrypted by our database and hosting providers.
• Provider credentials for voice, SMS and email are set on the server by an operator and only reported as detected or missing — the product never stores, displays or accepts a secret in the UI.
• Access inside a workspace follows roles: only owners and admins invite; only the owner removes. Every action Comver takes on a storefront — by a person, by AI or by Autopilot — is written to an audit trail and can be reverted.
• Comver only requests the Shopify permissions the activated modules need, and the granted scopes are visible to you at all times.
• If we become aware of a personal-data breach affecting you, we will notify the affected merchants and, where required, the supervisory authority without undue delay and within the statutory deadline.

Security reports are welcome at security@comver.io [address to be confirmed].

13. Children

Comver is a business product for merchants and their teams. comver.io and the Comver workspace are not directed at children and we do not knowingly collect personal data from anyone under 16. Merchants who use Comver on stores that may be visited by children remain responsible for complying with the laws that apply to their audience. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes and contact

We will update this policy when the product changes in a way that matters for your privacy — for example a new sub-processor, a new data category or a new AI feature. The date at the top tells you when it last changed; for material changes we will notify workspace owners by email or in the workspace before they take effect, and we will keep the previous version available on request.

Privacy requests

privacy@comver.io

Data processing agreement

Available to every merchant on request — write to the same address

Post

Comver sp. z o.o., Złota 59, 00-011 Warsaw, Poland

US office

3739 Balboa St, San Francisco, CA 94121, United States

Terms of service Cookie policy Contact Last updated 16 August 2026