Privacy policy

1. Who we are and what this policy covers

Zhara Labs (“we”, “us”, “our”) is a partnership firm based in India, with its communication address at C01, The First, B/H ITC Narmada, Nr. Shivalik High Street, Vastrapur, Ahmedabad, Gujarat 380015, India. We build and operate Zhara AI Search & Discovery (the “App”), an app for Shopify merchants that provides AI search, predictive search suggestions, trending products and product recommendations on the merchant's online store, along with analytics in the Shopify admin.

This policy explains what information we collect, why we collect it, how long we keep it, who we share it with and the choices available to you. It applies to three groups of people:

• Merchants: Shopify store owners and their staff who install and use the App.
• Shoppers: visitors to online stores that use the App.
• Website visitors: people who visit our website at https://www.zhara.io or contact us.

If you have questions at any time, contact us at support@zhara.io.

2. Our role: merchant data and shopper data

We handle two kinds of personal information, and our role is different for each.

Merchant information. For information about merchants and their staff, such as account contact details, we decide how and why it is used. We are the controller of this information under data protection laws such as the EU and UK General Data Protection Regulation (GDPR).

Shopper information. When the App runs on a merchant's store, we process shopper information on behalf of that merchant and only to provide the App's features to that merchant. The merchant is the controller of this information and we act as its processor (called a “service provider” under California law). The merchant's own privacy policy governs how the merchant uses shopper information.

If you are a shopper and want to access, correct or delete your information, the fastest route is to contact the store you visited. You can also contact us and we will pass your request to the right merchant and help them respond.

3. Information we collect

3.1 Information from merchants and from Shopify

When a merchant installs the App, Shopify gives us access to store data through its APIs, limited to the permissions the merchant approves. We collect:

• Store and account details: store name, store domain, Shopify store ID, the access token and permissions Shopify grants the App, install and uninstall dates, store owner name and email address, store currency, languages, markets and time zone.
• Catalog data: products, variants, collections, product types, tags, descriptions, images, prices, inventory levels and publication status. We use this to build the search index that powers the App.
• Theme data: the active theme and whether the App's embed and blocks are installed, so we can show installation status and help with setup.
• Order data: order ID, line items, product and variant IDs, order value, currency and time of purchase. We use this only to measure how search and recommendations contribute to sales. We do not store shopper names, email addresses, phone numbers or postal addresses from orders.
• App settings: synonyms, product boosts, exclusions, redirects, recommendation placements, appearance settings and other configuration you create in the App.
• Billing status: your plan and charge status. Payments are handled by Shopify and we never receive card details.
• Support communications: messages you send us and our replies.

3.2 Information from shoppers, collected on the merchant's behalf

When a shopper uses a store that runs the App, we collect the following through the App's storefront components and its Shopify web pixel:

• Search activity: the search terms entered, the number of results returned, and whether the results came from AI (semantic) matching.
• Interactions with products and recommendations: which products and recommendation carousels were shown, which were clicked, their position on the page, products added to cart, checkouts started and purchases completed.
• Device type: whether the visit is from a mobile, tablet or desktop device, derived from the browser’s user agent. We do not store the IP address, browser version or location.
• Identifiers: a random anonymous identifier stored on the shopper’s device. If the shopper is signed in to the store and has given the relevant consent, we also receive and store their Shopify customer ID, so personalization works across their devices on that store.

We do not collect payment card details, passwords or special categories of personal data (such as health, religion or ethnicity) through the App. We do not ask shoppers for their name, email address, phone number or postal address.

3.3 Information from website visitors

When you visit https://www.zhara.io, book a demo or contact us, we collect the details you give us, such as your name, email address and company. We also use Google Analytics to understand how visitors find and use our website, such as pages viewed and referring sites. Google Analytics sets cookies on your device. If you are in the European Economic Area, the United Kingdom or Switzerland, we set these cookies only after you accept them in our cookie banner. You can change your choice at any time using the Cookie settings link at the bottom of every page. We do not use advertising cookies, and this does not apply to the App or to shoppers on merchant stores. You can opt out with the Google Analytics opt-out add-on.

4. How we use information

We use information only for the following purposes:

• To provide search and recommendations: indexing the catalog, returning search results and suggestions, correcting misspelled searches, and choosing which products to show in each recommendation placement.
• To personalize results, where the merchant has turned personalization on and the shopper's consent choices allow it. Personalization is limited to the store the shopper is visiting.
• To give merchants analytics: search and recommendation reports, funnels, revenue attribution and suggested improvements shown in the App's dashboard.
• To operate and protect the App: monitoring performance and uptime, diagnosing errors, preventing abuse and keeping the App secure.
• To support merchants: onboarding, answering questions and sending service messages about the App, such as setup reminders, changes to features or terms, and security notices.
• To market to merchants: telling merchants about new App features, where the law allows. You can unsubscribe at any time using the link in the email.
• To meet legal obligations: complying with laws, responding to lawful requests and enforcing our terms.

4.1 Limits we place on ourselves

• We use each merchant's data only to provide the App to that merchant. We do not combine shopper data from different stores to build cross-store profiles.
• We do not sell personal information, and we do not share it for cross-context behavioral advertising.
• We do not use shopper information to contact shoppers or to advertise to them.
• We do not use merchant or shopper data to train, fine-tune or improve AI or machine learning models that serve other merchants or third parties. A model may be tuned for a single store only if that merchant has agreed to it in writing, and only with that store's data.
• We may use operational metrics that do not identify anyone, such as response times and error rates, to keep the App reliable.

4.2 Automated ranking

The App uses automated systems to decide which products appear and in what order. This affects only how products are displayed. It does not make decisions about shoppers that have legal or similarly significant effects, such as pricing, credit or eligibility decisions.

4.3 Legal bases (EEA and UK)

For merchant information, we rely on performance of our contract with the merchant, our legitimate interests in running, securing and improving the App, compliance with legal obligations, and consent where required (for example, for certain marketing). For shopper information, the merchant determines the legal basis as controller. Behavioral features such as analytics and personalization run only when the shopper's consent choices permit them.

5. How we use third-party AI services

The App uses Azure OpenAI Service, provided by Microsoft, to turn search terms and product details into numerical representations (embeddings), so the App can find products that match what a shopper means even when the exact words differ. To do this, we send Microsoft:

• search terms entered by shoppers; and
• product catalog content, namely product titles, product types and descriptions.

We do not send shopper identifiers, customer IDs, order details or merchant account details to Microsoft. Under Microsoft’s terms for Azure OpenAI Service, Microsoft does not use this data to train or improve models. Microsoft may keep inputs and outputs for up to 30 days to detect and prevent abuse, then deletes them unless the law requires longer retention. Microsoft Azure is listed as a subprocessor in section 7.

Search terms can occasionally contain personal information if a shopper types it into the search box. We treat search terms as personal information and apply the same retention and deletion rules to them.

6. Cookies, local storage and shopper consent

On a merchant's storefront, the App stores a small amount of information on the shopper's device using browser local storage:

How consent works. The App uses Shopify's Customer Privacy API to read the choices a shopper makes in the store's cookie banner. Our behavioral tracking runs through a Shopify web pixel, and Shopify loads it only after the shopper has granted the consent purposes the pixel declares (analytics). Recent searches and personalization run only when the shopper has allowed preferences. If a shopper declines, search and non-personalized recommendations keep working, but we do not store identifiers on their device, record their behavior or personalize their results.

We respect opt-outs of the sale or sharing of personal information, including signals such as Global Privacy Control that Shopify passes to us. Because we do not sell or share personal information, these opt-outs do not reduce the App's core features.

Merchants are responsible for showing a consent banner where the law requires one. Shopify provides a built-in banner for this.

7. How we share information

We share information only in these situations:

• Subprocessors that help us run the App, under contracts that require them to protect the data and use it only to provide services to us. They are listed below.
• Shopify, as needed to operate the App on the Shopify platform, for example when responding to privacy requests.
• Legal reasons, when we believe disclosure is required by law, a court order or a valid request from a public authority, or is needed to protect the rights, safety or property of merchants, shoppers, us or others.
• Business transfers, if we are involved in a merger, acquisition or sale of assets. We will notify affected merchants before their information becomes subject to a different privacy policy.

7.1 Subprocessors

We keep an up-to-date list at https://www.zhara.io/legal/subprocessors and will notify merchants at least 30 days before adding a new subprocessor that processes shopper information.

8. How long we keep information

We keep information only as long as we need it for the purposes in this policy. Our standard retention periods are:

We may keep information longer where the law requires it, for example billing records needed for tax purposes. In that case we keep only what is required and delete it when the obligation ends.

9. Privacy requests and deletion

The App is subscribed to Shopify's mandatory privacy webhooks and handles them as follows:

• Customer data request: when a shopper asks a merchant for their data, Shopify notifies us and we provide the merchant with the information we hold about that shopper within 30 days.
• Customer deletion request: when a shopper asks a merchant to delete their data, Shopify notifies us and we delete that shopper's information within 30 days.
• Store deletion: 48 hours after a merchant uninstalls the App, Shopify notifies us and we delete all of that store’s data, including shopper information, so that it is deleted within 30 days of the uninstall.

We only keep information after one of these requests where the law requires it. Merchants can also ask us for a copy of their store's data in a machine-readable format, or ask us to correct it, by contacting support@zhara.io.

10. Security

We protect information with measures appropriate to its sensitivity, including:

• encryption in transit (TLS) and at rest, including backups;
• access limited to staff who need it for their role, with strong passwords, multi-factor authentication and access logging;
• separate test and production environments, with no real shopper data used for testing;
• regular security updates and review of our systems; and
• a documented security incident response plan.

If we become aware of a security incident affecting personal information, we will notify affected merchants and Shopify without undue delay, and in any case within the time required by law and by our agreements. No method of transmission or storage is completely secure, but we work to protect information and to fix issues quickly.

11. International data transfers

We are based in India and host the App on Microsoft Azure in the Central India region, with AI processing in the South India region. Our subprocessors may process information in other countries as listed in section 7. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we will rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and, where relevant, the UK International Data Transfer Addendum, where required.

12. Your privacy rights

Depending on where you live, you may have some or all of the following rights over your personal information:

• to access it and receive a copy;
• to correct it if it is inaccurate;
• to delete it;
• to restrict or object to how it is used;
• to receive it in a portable format;
• to withdraw consent at any time, where we rely on consent; and
• to complain to a data protection authority.

12.1 California residents

Under the California Consumer Privacy Act, as amended, California residents have the right to know what personal information is collected about them, to delete it, to correct it and to opt out of its sale or sharing. We do not sell or share personal information, and we do not use or disclose sensitive personal information. The categories we collect are described in section 3, and we collect them for the purposes in section 4. We will not discriminate against anyone for exercising these rights.

12.2 Residents of India

Under India's Digital Personal Data Protection Act, 2023 and its rules, you may have the right to obtain a summary of the personal data we process about you, to have it corrected, completed, updated or erased, to withdraw consent where processing is based on consent, to nominate another person to exercise your rights in the event of death or incapacity, and to have your grievances addressed. For shopper data, the merchant is responsible for these requests as the data fiduciary, and we help the merchant respond. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Grievance Officer: Prashant Ramani, support@zhara.io. We will acknowledge grievances promptly and resolve them within the time required by law.

12.3 How to make a request

Shoppers should contact the store they visited first, because the merchant controls their information. Merchants, website visitors and shoppers who cannot reach the store can email us at support@zhara.io. We may need to verify your identity before acting on a request. We respond within one month in the EEA and UK, within 45 days in California, within the time required by Indian law for requests made in India, and within the time required by law elsewhere.

13. Merchant responsibilities

Merchants who use the App agree to tell their shoppers about it in their own store privacy policy, to collect shopper consent where the law requires it (for example, by using Shopify's cookie banner), and to pass shopper privacy requests to us through Shopify's standard process. We provide suggested wording for store privacy policies at https://www.zhara.io/help/store-privacy-policy.

14. Children

The App and our website are intended for businesses and are not directed at children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and update the “Last updated” date. If we make a material change, we will notify merchants by email or in the App at least 30 days before it takes effect.

16. Contact us

For any question about this policy or your personal information, contact us at:

Zhara Labs

C01, The First, B/H ITC Narmada, Nr. Shivalik High Street

Vastrapur, Ahmedabad, Gujarat 380015, India

Website: https://www.zhara.io

Email: support@zhara.io

Data Protection Officer: Akshil Shah, techsupport@zhara.io