Privacy Policy

Effective: July 8, 2026 · Last updated: July 8, 2026

This Privacy Policy explains how MySupportAgent, LLC (“MySupportAgent,” “we,” “us”) collects, uses, and shares personal information in connection with our AI customer-support service for ecommerce stores (the “Services”) and our website.

Our two roles. For information about the merchants who buy and configure the Services and their team members, we act as a controller. For information about a merchant’s own customers (“Shoppers”) that flows through the agent, we act as a processor on the merchant’s behalf — the merchant is the controller, and a Shopper with a question or request should contact the store they interacted with. Our processing on a merchant’s behalf is also governed by our Data Processing Addendum.

1. Whose information we collect

• Merchants and their authorized users — the store owners and team members who register for and use the Services.
• Shoppers / end users — a merchant’s customers who interact with the agent (processed on the merchant’s behalf).
• Website visitors — people who visit our website.

2. What information we collect

From merchants (as controller):

• Account and contact information — name, business name, email, and account credentials.
• Billing information — plan and transaction details processed by our payment processor. We do not store full payment-card numbers.
• Merchant configuration and content — the facts, policies, knowledge sources, instructions, brand assets, settings, and any past support records you choose to use with the Services.

From Shoppers, through the agent (as processor for the merchant):

• Conversation data — the messages exchanged with the agent and conversation records, including records saved to the merchant’s systems.
• Order-verification data — the order number and the email or postal/ZIP code used to verify an order lookup, checked by server-side code.

What we deliberately do NOT store. By design, we do not store Shoppers’ physical/mailing addresses, government identifiers, or payment-card details. Order and product lookups happen in real time against the merchant’s store.

From website visitors / automatically:

• Usage and device information — such as IP address, browser and device type, pages viewed, and similar analytics, collected via cookies and similar technologies (Section 7).

3. How we collect information

• Directly from you — when you register, configure the agent, contact support, or communicate with us.
• Through the store connection — in real time via the ecommerce platform’s API to answer order and product questions; these real-time lookups are not stored beyond what this Policy describes.
• Automatically — through cookies and similar technologies on our website (Section 7).

4. Why we use information

We use personal information to: provide and operate the Services (including verified order lookups, product answers, handoffs, conversation records, and any measurement or promotional features a merchant enables and controls); authenticate and secure accounts; process billing; provide support; communicate with you; comply with law; and maintain, protect, and improve the Services. We may also create and use aggregated or de-identified data that does not identify you, any user, or any Shopper — including for product development and improvement.

5. When we share information

We do not sell personal information, and we do not “share” it for cross-context behavioral advertising. We disclose it to:

• Service providers / sub-processors who help us run the Services, under contract and only as needed. Our current key sub-processors include Vercel (hosting), Supabase (database and authentication), Anthropic (the AI provider that generates agent responses), Stripe (payment processing), and PostHog (product analytics). Our current sub-processor list is maintained in the DPA and available on request.
• Legal and safety — when required by law or to protect rights, safety, or the integrity of the Services.
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction or consent — including data we process on a merchant’s behalf.

6. AI processing

Agent responses are generated by our AI provider, Anthropic. To answer a Shopper, relevant conversation content and store context are sent to Anthropic to generate a response. By default the Services use our managed access to Anthropic; a merchant may optionally supply its own credentials. Consistent with Anthropic’s commercial terms, inputs and outputs processed through the Services are not used to train Anthropic’s models.

7. Cookies and similar technologies

Our website uses cookies and similar technologies for essential functionality, preferences, and analytics. You can control cookies through your browser and, where offered, through our cookie controls. Where required, we present a cookie banner and honor recognized opt-out preference signals.

8. Marketing communications

If we send marketing emails, you can opt out at any time using the unsubscribe link or by contacting us. We will still send necessary service and transactional messages.

9. Children

The Services are intended for business use and are not directed to children. We do not knowingly collect personal information from children under 16. Merchants are responsible for their own compliance regarding Shoppers who may be minors.

10. How we protect information

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption of sensitive secrets at rest, encryption in transit, multi-tenant isolation so one merchant cannot access another’s data, and server-side verification for order lookups (order number plus the email or postal/ZIP code on the order) so a Shopper only ever sees their own order. No method of transmission or storage is completely secure.

11. How long we keep information

We keep personal information for as long as needed to provide the Services and for legitimate business and legal purposes. In general: account and configuration data are retained while your account is active; on termination, exportable data is made available for 30 days and then deleted or de-identified within a further 90 days; conversation records are retained according to the merchant’s settings; and billing and tax records are retained for as long as required by law. Aggregated or de-identified data may be retained indefinitely.

12. Your choices and rights

• Merchants can access and update account information and much of their configuration and records from the dashboard, and can request access, correction, export, or deletion by contacting us.
• Shoppers should direct access or deletion requests to the store they interacted with (the merchant/controller); we will assist the merchant in honoring valid requests.
• Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal information, and to appeal a decision. We will not discriminate against you for exercising these rights.

13. International data transfers

We are based in the United States and may process and store information there and in other countries. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we use an appropriate transfer mechanism, such as the Standard Contractual Clauses, as described in the DPA.

14. Third-party links

Our website and the Services may link to third-party sites or services we do not control; their privacy practices are their own.

15. Changes to this Policy

We may update this Policy; we will change the “Last updated” date and, for material changes, provide additional notice. Continued use after the effective date means acceptance.

16. U.S. state privacy rights

Residents of certain U.S. states (including California, Colorado, Connecticut, Utah, and Virginia) have rights to know or access, correct, delete, and obtain a portable copy of their personal information, and to appeal our decision on a request. We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use personal information for decisions producing legal or similarly significant effects without a lawful basis. To exercise these rights, contact privacy@mysupportagent.ai; we will verify your request and may ask for information to do so, and you may use an authorized agent. For personal information we process on a merchant’s behalf (Shopper data), please contact the merchant, and we will assist them as their processor.

17. Contact us

Privacy questions or requests: privacy@mysupportagent.ai.

MySupportAgent, LLC — North Carolina, USA.

If you are a Shopper and are not sure which store to contact, we can help route your request.