← Back to Saffron Concierge
Saffron Automations ("we," "us") operates Saffron Concierge, a business intelligence assistant that connects to your Shopify store, Stripe account, and messaging platforms (Telegram, Slack, Microsoft Teams) to deliver briefings, answer questions, and execute actions you authorize. This policy explains what data we collect, how we store and protect it, and how you can control or remove it.
1. What We Collect
- Account information: your name, company, and email address when you sign up.
- Connection credentials: Shopify store access tokens, Stripe API keys, Slack bot tokens and workspace/team IDs, Microsoft Teams webhook URLs, and Telegram chat IDs — only for the platforms you explicitly connect.
- Business data accessed through those connections: order/revenue summaries, inventory levels, dispute/refund events, and top-product lists, retrieved live from Shopify and Stripe each time you request a briefing or ask a question. We do not maintain a separate copy of your full order history — we query it on demand.
- Usage and interaction data: messages you send to the assistant (e.g. Slack slash commands, Telegram questions), and an audit log of account changes and actions taken (who did what, when).
2. How We Use It
- To generate briefings, answer your questions, and detect anomalies (e.g. unusual refund rates, low stock) using an AI model.
- To execute actions you or your teammates explicitly trigger (e.g. acknowledging an alert, issuing a refund, restocking an item) via signed, time-limited confirmation tokens.
- To bill for premium plan tiers via Stripe Checkout, where applicable.
- We do not sell your data. We do not use your business data to train AI models beyond the single request being processed.
3. How We Protect It
Encryption at rest: all connection credentials (Stripe keys, Slack tokens, webhook URLs, Shopify access tokens) are encrypted with AES-256-GCM before being written to our database. They are decrypted transiently, in memory, only when a request needs them.
- All traffic to and from Saffron Concierge is encrypted in transit via HTTPS/TLS.
- Slack requests are cryptographically verified (HMAC signature) to confirm they actually originate from your Slack workspace before we act on them.
- Action buttons (refunds, cancellations, restocking) use single-use, 10-minute signed tokens — they cannot be replayed or forged.
- Every account change and executed action is written to an audit log, visible to your account's administrators.
- Optional IP allowlisting (Enterprise plan) restricts API access to networks you specify.
4. Third Parties We Share Data With
- Shopify and Stripe: we query their APIs directly using the credentials you provide; we don't relay your data to any other third party.
- Slack and Microsoft: messages we send to your workspace/channel are delivered through their respective webhook/API infrastructure, as required for the product to function.
- AI providers: the text of your questions and relevant business summaries are sent to our AI provider to generate a response. No credentials or raw API keys are ever included in that request.
- We do not sell, rent, or share your data with advertisers or data brokers.
5. Data Retention & Deletion
We retain your account data for as long as your account is active. You can request deletion of your account and all associated data at any time by contacting us at the email below — we will remove your stored credentials, business data cache, and audit history within 30 days, except where retention is required by law (e.g. billing records).
6. Your Choices
- You can disconnect any platform (Slack, Teams, Telegram) at any time from your account settings — this immediately revokes our access.
- You can request an export of your account's audit log and configuration at any time.
- You control which alerts and anomaly types you receive via your account settings.
7. Changes to This Policy
We may update this policy as the product evolves. Material changes will be communicated to active account administrators by email or in-app notice. Continued use after a change constitutes acceptance of the updated policy.
8. Contact Us
Questions about this policy or your data? Reach us at privacy@saffronautomations.com.