Privacy policy

1. Scope and identity

This policy explains how AfterSales Shield AI processes information about merchants, team members, and people connected to chargeback cases. For customer data supplied by a merchant, the merchant generally determines the purposes of processing and we provide the service on its instructions.

The processing entity is Zhou Gaili, at No. 116, Tangbulang Village, Youyouban Town, Huimin District, Hohhot, Inner Mongolia Autonomous Region, China (中国内蒙古自治区呼和浩特市回民区攸攸板镇倘不浪村116号). The privacy contact is 776797738@qq.com.

2. Data we process

• Store and installation data: shop domain, Shopify identifiers, granted scopes, and installation status.
• Team and security data: member identifiers, hashed email references, roles, locale preferences, sessions, two-factor status, and audit events.
• Case evidence: Shopify Payments disputes, orders, payments, fulfillment, delivery, refunds, store policies, and merchant-provided communications and attachments.
• Service and billing data: plan, trial, usage events, billing state, email delivery state, errors, and performance telemetry.
• We do not intentionally collect information unrelated to dispute operations and do not sell personal information.

3. Purposes and legal grounds

We process data to perform the service contract, secure the service, comply with legal obligations, and support legitimate business purposes requested by merchants. This includes dispute synchronization, evidence preparation, human-reviewed drafts, deadline reminders, support, billing, fraud prevention, and auditing.

AI output supports human review. We do not use it to make solely automated decisions producing legal or similarly significant effects, and we do not guarantee dispute outcomes.

4. Providers, transfers, and disclosures

We use Shopify, Cloudflare, DeepSeek, and Resend to provide the service and may disclose other necessary monitoring or support providers before enabling them. DeepSeek processes minimized model inputs in China and uses default disk context caching that normally lasts from several hours to several days. The app does not send full payment-card numbers, passwords, or identity fields unrelated to a case, and we do not claim zero retention.

Data may be processed across borders where merchants, we, or providers operate. We limit processing through input minimization, non-personal isolation identifiers, access controls, service terms, and applicable transfer mechanisms. By enabling AI drafting, a merchant instructs us to send the minimum evidence needed for the current case to DeepSeek under this policy.

5. Security, retention, and deletion

Controls include encryption in transit, application-layer key encryption, private object storage, least privilege, role controls, two-factor authentication, audit logs, tenant isolation, and monitoring. No system can guarantee absolute security.

Case evidence is retained by default for 365 days after closure, with a shorter merchant-configurable period. Privacy export files are removed after 30 days. Billing and necessary audit records may be retained separately as required by law. After uninstall, data is deleted or irreversibly de-identified under Shopify requirements and the applicable retention policy.

6. Rights and requests

Merchants and eligible individuals may request access, correction, export, restriction, or deletion. Consumers should generally contact the merchant they purchased from; we assist merchants with mandatory privacy requests Shopify forwards to us.

Send requests to 776797738@qq.com. We may verify identity and authority before responding.

7. Changes and contact

Material changes will be communicated in the app, by email, or on this page. The operator, contact address, contact details, and effective date shown in this policy are the current official information; we will update this page and give advance notice where appropriate if they change.