Floorwalk AI privacy policy
Last updated 12 October 2026
In short: Floorwalk AI answers a store's customers by chat and email, using the store's own orders, products and policies. To find a customer's order it reads their name, email, phone and delivery address from Shopify, only for that conversation. Conversations are kept for a year after the last message, are deleted on request, and everything is deleted when the store uninstalls the app. We never sell data or use it for advertising.
Who we are
Floorwalk AI is an AI customer service app for online retailers, run by Ben Buck, a sole trader in the United Kingdom trading as Floorwalk AI ("we", "us"), and installed through Shopify. For the store's data and its customers' data we are a processor, acting only on the store's instructions; the store is the controller. For our own merchant accounts we are the controller. Contact us at hello@crosstownhq.com.
What we read from the store
| Data | Why |
|---|---|
| Orders: number, date, items, sizes, prices, payment and delivery status, delivery method, tracking numbers, returns and refunds | To tell customers where their order or return is, when a refund was made, and whether an order can still be changed. |
| Customer name, email address, phone number and delivery address on an order | To check that the person asking is the customer on the order (they must give two matching details), to greet them, and to change a delivery address when they ask and the store approves. |
| Products, variants, sizes and stock | To answer product and size questions and offer an exchange size that's in stock. |
| The store's public policies and help pages, and the rules the store writes in the app | So answers follow the store's own policies. |
| Shop details (domain, currency, plan) and the access token Shopify issues | To connect to the store and bill through Shopify. |
Floorwalk AI can cancel an order, change a delivery address or raise a return request only when the customer confirms it in the conversation, and cancellations and address changes also need the store's team to approve them. It never issues refunds itself.
What we collect from customers who contact a store
| Data | Why |
|---|---|
| Messages in the website chat and emails sent to the store's customer service address, including the sender's email address and name | To answer the customer, to keep the conversation together, and so the store's team can see it and take over. |
| Details the customer gives to find an order: order number, email, postcode or tracking number | To find their order. Nothing is shown until two details match the same order. |
| A random chat ID kept in the browser tab's session storage, and the page the chat was opened on | To keep the chat going while the tab is open. It's removed when the tab closes. The chat sets no cookies. |
| If the customer is signed in to the store: their customer ID, stored only as a one-way scrambled code | So a signed-in customer doesn't have to prove who they are again. |
We don't ask for or store payment card details. Customers should not type card numbers or passwords into the chat; the AI never asks for them.
AI processing
Customer messages, and the order and product details needed to answer them, are sent to Anthropic's Claude models to write each reply. Anthropic processes this data on our behalf and does not use it to train its models. The AI only sees the data for the conversation it is answering.
Where data is stored and who processes it
- Supabase: database, London (UK).
- Railway: application hosting.
- Anthropic: AI processing (United States), under standard contractual clauses and the UK addendum.
- Postmark: sending and receiving email, only for stores that switch on the email channel.
- Ship24: parcel tracking. Only the tracking number is sent, never names or addresses.
- Shopify: installation, billing and the source of store data.
All data is encrypted in transit (TLS) and at rest.
How long we keep it
- Conversations: one year after the last message, then deleted automatically.
- Test conversations the store's team runs: 30 days.
- Order and customer details are read from Shopify when needed; we don't keep a separate copy beyond what appears in a conversation.
- When a store uninstalls the app, the AI stops at once, and Shopify's shop deletion request (sent 48 hours later) deletes everything we hold for that store.
Shopify privacy requests
We handle Shopify's mandatory privacy webhooks automatically. A customer deletion request deletes every conversation involving that customer (matched by their email, their orders or their signed-in ID). A customer data request finds those conversations and records them for the store, so the store can send them to the customer. A shop deletion request deletes all of the store's Floorwalk AI data.
Your rights
Under UK GDPR you can ask for access to, correction of or deletion of your personal data, object to or restrict processing, and complain to the Information Commissioner's Office (ico.org.uk). Customers of a store should contact that store, which will pass requests to us where needed. Contact us at hello@crosstownhq.com and we will reply within one month.
Changes
If we change this policy in a way that matters, we will tell stores in the app and by email before the change takes effect.