Tillie Privacy Policy

Version 1.4, 8 October 2026
Operator: Clarity Insights Imaging Pty Ltd (ABN 92 696 493 740, ACN 696 493 740), 8/10 Lower River Terrace, South Brisbane QLD 4101 ("Tillie", "we", "us")
Contact: support@hellotillie.com
Privacy officer: Mark Bekhit, privacy@hellotillie.com
Effective date: 8 October 2026

Tillie is a Shopify app. It answers a store's phone calls with an AI assistant, and it drafts and sends replies to the store's customer emails and help-desk tickets. This policy explains what information we handle, why, who receives it, how long we keep it, and your rights.

1. Who this policy covers

• Merchants. Shopify store owners and their staff who install and use Tillie.
• Callers. People who phone a store that uses Tillie.
• Emailers. People who email a store, or open a help-desk ticket, where the store has connected Tillie.
• Website visitors to hellotillie.com.

2. Our role

For merchant account data (section 3.1), we decide how the information is used. We are the "controller" (or "agency" in New Zealand, "APP entity" in Australia).

For caller and emailer data (sections 3.2 and 3.3), the merchant decides why and how it is used. We handle it only on the merchant's behalf, under our Data Processing Agreement. The merchant is the controller and we are the processor (or "service provider" under California law). If you are a caller or emailer, the store you contacted is your main contact for privacy questions. We will help the store answer you. You can also contact us directly (section 16).

3. What we collect

3.1 From merchants

• Store details from Shopify: store name, domain, country, time zone, currency, store policies, locations and the product catalogue.
• Staff details: name and email of the person who installs the app or sets up alerts, and the Shopify staff account ID of people who open call records.
• Settings: greeting, agent name, voice, business hours, FAQ answers, spend budget, alert email, help-desk connection details.
• Help-desk credentials (API keys or tokens). We store them encrypted.
• Phone number registration details. Australian and New Zealand phone numbers need a regulatory registration. The merchant gives business name, business number (ABN, ACN or NZBN), address and the details of an authorised person, and uploads supporting documents (for example a company register extract, proof of address and the authorised person's ID), in the registration form inside the app. We pass the details and documents straight to Twilio for its review. We do not keep a copy of the documents: they are held only in memory while the upload is sent, and are never saved to our database, file storage or logs. Twilio holds the details and documents. We keep Twilio's references for them, the registration status and Twilio's reasons if it rejects the registration.
• Billing records: plan, trial dates, minutes used and charges. Shopify handles payment. We never see card details.
• An access log of who viewed call transcripts, played recordings, looked up orders, or exported or deleted data.

3.2 From callers

• The caller's phone number (caller ID), and the number they dialled.
• Call audio. When the store has turned recording on, we record the call. The caller hears "This call is recorded" at the start.
• Transcript. A written record of what the caller and the assistant said.
• Details the caller gives: name, order number, postcode, surname, the products they ask about, a message, or a request for a callback.
• Order information from the store's Shopify account, only when the caller asks about an order and passes an identity check (section 6). This can include order number, items, status, shipping and tracking details, delivery city, and the name, phone, email and address on the order. The assistant speaks only the delivery city, not the full address. It never asks for or reads out an email address.
• A short summary of the call and its outcome.
• If the caller asks for a text message: their mobile number and the link we sent.

3.3 From emailers

• The email or ticket text, subject, sender name and email address, and the thread history, read from the store's help desk (such as Gorgias, Zendesk, Re:amaze, Freshdesk, Help Scout or Intercom) or mailbox.
• Order information for orders whose email or phone matches the sender.
• The draft reply, review results, whether it was sent automatically or by a staff member, and an audit record.

We remove links, hidden text and attachments before any AI model sees an email. We do not open links or attachments.

Tillie reads a store's emails only while the store has email replies switched on. When a store switches email replies off, Tillie stops reading new emails from its help desk or mailbox, and email forwarded to Tillie is accepted and deleted unread. Nothing from those emails is stored. Copies stored before the switch was turned off are deleted on the normal schedule in section 10. When the store switches email replies back on, Tillie reads only emails that arrive from then on.

3.4 From website visitors

Standard server logs: IP address, browser type and pages requested. We use Cloudflare Web Analytics to count page views and measure page speed. It sets no cookies and does not follow you across other websites. We do not use advertising cookies. One cookie, tillie_region, remembers which country version of the website you chose.

If you try the live demo call on our website, your voice goes to our AI provider (OpenAI) to run the call, and we keep the call's transcript for 90 days to improve Tillie. We also keep a scrambled code made from your IP address for one day, to limit how many demo calls one visitor can make. The demo sends no texts and books no real callbacks.

4. Why we use it

We do not:

• sell personal information or share it for advertising;
• use caller or emailer data, or store data, to train or improve AI models;
• use caller or emailer data for our own marketing;
• use one store's data to serve another store.

Shopify's API terms and Partner Program Agreement also forbid these uses.

5. How we use AI

• Phone. An AI voice model from OpenAI listens to the caller and speaks the replies. It uses tools that read the store's Shopify data. It cannot change orders, issue refunds or take payments.
• Email and help desk. AI models draft replies. A separate check reviews every draft against the store's order records and policies before it can be sent. Both the drafting and the check use OpenAI models.
• Summaries. An AI model writes a short summary after each call.

We tell our AI provider not to store our requests (store: false), and OpenAI does not train its models on business API data. OpenAI may keep inputs and outputs for up to 30 days to detect abuse, and then deletes them.

Does the assistant say it is an AI? Each store chooses. Under the default setting the assistant does not open by saying it is an AI, but it always answers truthfully if asked. A store can choose to have it say so at the start of every call. Where a law requires the assistant to say at the start of a call that it is an AI (for example Colorado's law on consumer-facing AI, or Utah's law for regulated services), the store must choose that setting. Emails sent by Tillie go out in the store's name.

6. Automated decisions

Some steps are decided by software without a person. We list them here, as the Australian Privacy Principles require from 10 December 2026 (APP 1.7) and as GDPR Article 22 and Shopify's data rules expect.

None of these decisions has a legal effect. None decides price, credit, refunds, eligibility or access to goods. Refunds, cancellations and order changes are always left to store staff.

7. Call recording notice

When a store has recording on, recording starts when the call connects, and the assistant's opening words include "This call is recorded". Recording cannot be on without this notice. Every caller hears it, in every country, including the US states where everyone on a call must agree to a recording, and Canada. If recording is off, we still keep a written transcript so the store can see what was said. Callers who do not want to be recorded can end the call and contact the store another way.

We record and transcribe calls only to provide the service to the store. We do not use recordings or transcripts for our own purposes, and we do not sell or share them.

Text messages. The assistant sends a text only when the caller asks for one during the call, and only about the caller's request (for example a checkout link). In the United States and Canada, each store texts from its own toll-free number, verified in the store's name, and the store is the sender. Reply STOP to stop texts and HELP for help. Store owners can also choose to get alert texts from Tillie; they agree to these in the app with an unticked box and a code. Details: hellotillie.com/sms.

Stores are responsible for any further notice their local law needs. See our Terms of Service.

8. Who receives the information (subprocessors)

We use these companies to run the service. Each has a written data processing agreement with us.

Help desks the merchant chooses (Gorgias, Zendesk, Re:amaze, Freshdesk, Help Scout, Intercom, or a mailbox) are the merchant's own providers, not ours. When a merchant connects one, we read and write tickets there on the merchant's instruction.

We may also disclose information when the law requires it, to protect people from serious harm, or as part of a sale of our business (the buyer must keep this policy's promises).

We give merchants at least 30 days' notice before adding or replacing a subprocessor. The current list is always the one in this section.

9. International transfers

Our providers process data outside the caller's country, mainly in the United States. We take these steps:

• New Zealand (IPP 12) and Australia (APP 8). We choose providers bound by contract to protect information to a standard like our own law. We stay responsible for how they handle it.
• EU, UK and Swiss data. We rely on the EU Standard Contractual Clauses (Commission Decision 2021/914), the UK Addendum, and, where a provider is certified, the EU-US Data Privacy Framework. Our Data Processing Agreement sets out the modules and options that apply.
• Canada. Information about people in Canada is processed in the United States and other countries where our providers work. While it is there, courts and authorities in those countries may be able to access it under their law. Before information about people in Quebec leaves Quebec, we assess whether it will be protected properly, as Quebec law requires.
• United States. Information about US callers and emailers is processed mainly in the United States.

10. How long we keep it

These are the default periods. A merchant can set shorter periods (and some longer ones, within the limits shown) in the app's Settings.

A daily job deletes expired data. A storage rule deletes any call files older than 800 days as a backstop. Twilio's copy of a recording is deleted once our encrypted copy is saved.

When a merchant uninstalls: the assistant stops answering at once. For 14 days the store's number plays a short message telling callers how to reach the store (not recorded). Shopify then sends us a deletion request 48 hours after uninstall. We delete the store's call, email and settings data, and destroy the store's encryption key so any remaining copies cannot be read. We complete this within 30 days of uninstall. We keep only billing records.

11. Security

• All connections use encryption (TLS).
• Call recordings, transcripts, caller numbers, help-desk keys and Shopify access tokens are encrypted with a separate key for each store.
• Phone numbers used for lookups are stored as one-way codes (hashes).
• Our system logs do not record call content, phone numbers or emails.
• Our staff have no standing access to call content. Emergency access needs a written reason, approval and expires after 24 hours. Every access is logged.
• Staff accounts use multi-factor sign-in or passkeys.
• Test systems use made-up data only.
• We have a written incident response plan. If a breach affects a store's data, we tell the store within 48 hours and Shopify within 24 hours.

No system is perfectly secure. Tell us at support@hellotillie.com if you find a security problem.

12. Your rights

You can ask to see, correct or delete personal information about you. Where GDPR or UK GDPR applies you can also object, ask us to restrict use, and ask for a copy in a portable form. California residents have rights to know, delete and correct, and not to be discriminated against for using them. We do not sell or "share" personal information as California law defines it, and we do not use sensitive personal information to infer things about people. You can make a request yourself or through an authorised agent. People in Canada can see and correct their information under PIPEDA, and people in Quebec also have the rights that Quebec's privacy law gives them, including to ask how an automated decision about them was made.

Callers and emailers. Please contact the store first. The store can send your request through Shopify. Shopify then sends us a formal request:

• Copy of your data (Shopify's customers/data_request): we find calls, messages and emails linked to you, and give the store an export within 30 days. The store sends it to you.
• Deletion (Shopify's customers/redact): we delete recordings, transcripts, messages and email copies linked to you within 30 days. We keep only non-personal billing facts (call length and minutes).

You can also contact us directly. We will pass your request to the store and help it answer you. We may need to check your identity first.

Merchants. Contact support@hellotillie.com, or use the export and delete tools in the app.

Complaints. Contact us first. If you are not satisfied, you can complain to:

• New Zealand: Office of the Privacy Commissioner, privacy.org.nz
• Australia: Office of the Australian Information Commissioner, oaic.gov.au
• EU/UK: your local data protection authority
• California: California Privacy Protection Agency, cppa.ca.gov
• Canada: Office of the Privacy Commissioner of Canada, priv.gc.ca
• Quebec: Commission d'accès à l'information, cai.gouv.qc.ca

We answer requests within 20 working days (New Zealand), 30 days (Australia), one month (GDPR), 45 days (California) or 30 days (Canada), or sooner.

13. Notice to people whose information we receive from others

Under New Zealand's IPP 3A (from 1 May 2026) and Australia's APP 5, we must tell people when we collect information about them from someone else. We receive order details from the store's Shopify account, and email text from the store's help desk. This policy is that notice. It tells you what we collect (section 3), why (section 4), who receives it (section 8), and how to see or correct it (section 12). The store you contacted is also responsible for telling you about its own use of your information.

14. Children

Tillie is for businesses. It is not aimed at children. We do not knowingly collect information from children under 16, other than what a child may say on a call to a store. If you believe a child's information is held, contact us and we will delete it.

15. Changes to this policy

We will post changes here with a new date. For material changes we will tell merchants in the app or by email at least 30 days before the change takes effect.

16. Contact

Clarity Insights Imaging Pty Ltd, 8/10 Lower River Terrace, South Brisbane QLD 4101 Privacy officer: Mark Bekhit, privacy@hellotillie.com Support: support@hellotillie.com