KeptByAI Privacy Policy

Who we are

KeptByAI is run by Gabriele Carieri, Via Beniamino Gigli 4, 20865 Usmate Velate (MB), Italy ("we", "us"). Contact for anything about your data: hello@keptbyai.com.

KeptByAI checks whether the promises an AI customer-service agent makes to shoppers (refunds, cancellations, returns, subscription changes, discount codes) actually happened in the store's systems.

Two kinds of data, two roles

1. Data about you, the store that contacts us or signs up: your name, work email, store website, and what you tell us. For this data we are the controller.

2. Data about your shoppers, which we read from your Gorgias, Shopify and Stripe accounts to run the checks. For this data you are the controller and we act as your processor, under our Data Processing Agreement.

This website

keptbyai.com sets no cookies and runs no analytics or advertising trackers. Our hosting provider, Cloudflare, processes your IP address and browser details to deliver the site and protect it from attacks.

If you use the "free audit" form we receive your work email, your store's address and whether you use Gorgias AI Agent. We store them encrypted and use them only to reply to you and set up your audit.

If you use the free promise checker at keptbyai.com/check, the text you paste is sent to Google's Gemini API, on its paid tier, to find the promises in it. We do not store the text. To keep a daily limit of checks we store a counter under a one-way hash of your IP address and the date, deleted automatically after 24 hours. Please remove customer names and emails before pasting.

When you connect your store

• Gorgias: you give us a REST API key. We use it only to read tickets.
• Shopify: you install our app, which can only read orders, refunds and returns.
• Stripe (optional): a restricted, read-only key.

Keys are encrypted the moment they reach our server, with a key that only our own audit computer can decrypt. The server that receives them cannot read them back.

All connections are read-only. We never reply to customers, close tickets, refund, cancel or change anything.

What we read from your systems

• Gorgias: tickets answered by your AI agent: message text, timestamps, the shopper's email address, ticket tags.
• Shopify: orders in the period being checked: order number, shopper email, totals, refunds, cancellations, returns.
• Stripe, if connected: subscription pauses and cancellations, with the shopper email on the subscription.

We do not read payment card numbers, passwords or shipping addresses.

What we do with it

We use shopper data only to produce your audit: an AI model reads each AI-agent reply to find the promises in it, and we look for the matching action in Shopify or Stripe. A person then reviews every flagged case before the report reaches you.

We do not sell this data, use it for advertising, or use it to train AI models.

AI processing

Promises are extracted by Google's Gemini API on its paid tier, whose terms forbid Google from using our inputs to improve its products.

How long we keep it

• Shopper data: the AI model's answers about each ticket, which contain message text, are deleted automatically 90 days after they were created. Ticket and order data are read fresh at each audit and not stored otherwise.
• Your keys: until you disconnect, or within 30 days of you asking us to stop.
• Audit reports: sent to you by email. We keep a copy while you are a customer and delete it within 30 days of you leaving.
• Free audit requests and our emails with you: up to 12 months after our last contact, unless you become a customer.

You can disconnect at any time: delete the API key in Gorgias, uninstall the app in Shopify, or write to us and we delete everything we hold within 30 days.

Who else processes the data

• Cloudflare, Inc.: hosting of keptbyai.com and storage of encrypted keys and form requests.
• Google LLC: the Gemini API (promise extraction) and Gmail (our email with you).
• Resend, Inc.: delivery of the emails we send, from its EU region (Ireland).

We will tell customers at least 14 days before adding a new one.

Transfers outside the EU

Cloudflare, Google and Resend are US companies. Transfers rely on the EU-US Data Privacy Framework where the company is certified, and otherwise on the European Commission's Standard Contractual Clauses.

Legal basis

• Replying to your request and running your audit: steps you asked for before a contract, and the contract itself (Art. 6(1)(b) GDPR).
• Contacting stores we think could use KeptByAI, at their business address: our legitimate interest (Art. 6(1)(f)). Every such email says how to stop further emails, and we stop at the first request.
• Shopper data: processed only on the store's instructions, as its processor (Art. 28).

Your rights

Under the GDPR you can ask to access, correct, delete or export your data, to restrict its use, or object to it. Write to hello@keptbyai.com and we answer within 30 days. Shoppers whose data we process for a store should contact that store; we help the store answer.

You can also complain to your data protection authority. In Italy it is the Garante per la protezione dei dati personali (garanteprivacy.it).

Security

• Keys encrypted at rest with public-key encryption, never written to logs.
• All traffic over TLS.
• Read-only scopes only.
• Access limited to the person who runs the service.

If a breach affects your data we tell you without undue delay, and within 48 hours of finding it.

Changes

We email customers at least 14 days before any material change, and update the date at the top.