1. Who we are
QORVILO OS is operated by AI Chat Hub ("we", "us"), an AI commerce operating system that connects to your commerce platforms (such as Shopify) to provide analytics, inventory intelligence, and AI-powered recommendations. AI Chat Hub is the data controller for your account data. For store customer data imported from your platform, you (the merchant) are the controller and we process it on your behalf.
2. What data we collect
When you connect a commerce platform, we import the following data from that platform:
- Products — title, description, price, category, image URL, variants, and inventory levels.
- Orders — order number, totals (subtotal, tax, shipping, discounts, refunds), financial and fulfilment status, line items, and the date placed.
- Customers — name, email, phone number, marketing consent, total spent, and order count. We do not store payment card details — we never receive them.
- Store information — your store domain and the connection status.
We also collect your account email and workspace name when you sign up. Authentication is handled by our identity provider; we never see your password.
3. How we use your data
- To display analytics, charts, and business insights in your dashboard.
- To power the AI Copilot and Growth Engine — these send summarised, anonymised context to our AI provider, never raw customer PII.
- To detect inventory risks, growth opportunities, and customer segments.
- To generate marketing campaign drafts (which you review and approve before anything is published).
4. Data retention
We retain your data for as long as your account is active and your commerce platform is connected. When you disconnect a platform, we retain historical data for 30 days, after which it is automatically deleted. If you delete your QORviLo account, all data is permanently deleted within 30 days.
5. GDPR and data erasure rights
We support Shopify's mandatory compliance webhooks for GDPR and CCPA:
- Customer data request — when a merchant requests a customer's data, we log the request and make the data available within 30 days.
- Customer redact — when a merchant requests erasure of a customer's data, we permanently remove all personally identifiable information (name, email, phone) from our systems. Order records remain for accounting purposes but no longer reference the customer's identity.
- Shop redact — when a shop owner requests full erasure, we permanently delete all products, orders, customers, inventory, credentials, and sync records associated with that shop.
You can also request data export or deletion by contacting qorviloos@gmail.com.
6. Security
All platform access tokens are encrypted at rest using AES-256-GCM encryption. Tokens are never exposed to the browser or sent to third parties. All API communication uses HTTPS/TLS. Data is isolated per workspace — one merchant can never access another's data, enforced at the database level by row-level security policies.
7. Who we share data with
- Paddle (Merchant of Record) — Paddle.com sells QORVILO subscriptions on our behalf and processes payments, subscription management, tax compliance and invoicing. Card details go directly to Paddle; we never receive them.
- Hosting and AI service providers — to run the Service; AI receives summarised business context, not raw customer PII.
- Commerce platforms (e.g. Shopify) — we connect only with your OAuth approval and the scopes you grant.
- Professional advisers and authorities — where needed for legal, accounting or legal-obligation reasons.
8. Legal basis and your rights
We process data to perform our contract with you, for our legitimate interests (security, fraud prevention, improving the Service), and where required by law. You can request access, correction, deletion, restriction or export of your data, object to processing, or complain to your local privacy regulator. We respond within one month. We use only essential cookies needed to keep you signed in.