Mend

Privacy Policy

Last updated: July 12, 2026

Mend is an AI customer-support agent for Shopify stores, operated by Masas Technologies, LLC ("Mend", "we", "us"). This policy explains what personal data we process when a merchant installs Mend and when shoppers interact with a store that uses Mend, and the choices available to both.

For shopper data, the merchant running the store is the data controller and Mend acts as their processor. If you are a shopper, the store you contacted is your first point of contact for privacy requests; we support merchants in fulfilling them, as described in our Data Processing terms.

Data we process

  • Merchant account data. Your store domain, staff notification email address, plan and billing status (via Shopify), and the settings you configure in the dashboard (automation rules, widget appearance, knowledge documents).
  • Shopper conversations.Messages exchanged with the chat widget or by email, including photos a shopper chooses to attach, email subjects and addresses, and the AI's replies and reasoning traces.
  • Order and customer data from Shopify.When a verified shopper asks about an order, Mend reads the relevant order details through Shopify's APIs (order status, line items, fulfillment and tracking, refund eligibility) to answer accurately and to execute actions the merchant has allowed.
  • Store content. Product catalog, store policies and documents the merchant adds, indexed so the AI can answer from them.
  • Operational data. Usage counters, audit logs of sensitive access and decisions, rate-limit buckets, and technical logs needed to run and secure the service.

What we use it for

  • Answering shopper questions and resolving support requests.
  • Executing order actions (refunds, returns, cancellations, discount codes) strictly within merchant-configured rules, with anything beyond them held for explicit merchant approval.
  • Sending service emails (verification codes, merchant alerts, weekly summaries).
  • Billing, quota enforcement, abuse prevention and security auditing.

We do not sell personal data, we do not use it for advertising, and we do not use your data or your shoppers' data to train AI models.

AI processing

Conversations are processed by Anthropic's Claude models via API to generate replies, and store content is embedded via OpenAI's API for retrieval. Under both providers' API terms, this data is not used to train their models. Automated replies are drafted by AI; money-moving actions are constrained by merchant rules and, where configured, human approval.

Where data lives and how it is protected

Mend runs on servers in the United States (Hetzner, Ashburn, VA), with the database hosted by Neon (US) and shopper-uploaded images in Cloudflare R2. All traffic is encrypted in transit (TLS); storage providers encrypt data at rest. Shopify access tokens are additionally encrypted at the application layer (AES-256-GCM), every record is scoped to its store, and sensitive access is audit-logged. See the full subprocessor list.

Retention

  • Conversation transcripts and attachments: up to 24 months after the last activity.
  • Raw webhook payloads: 30 days.
  • Expired shopper widget sessions: 90 days.
  • Audit logs: 12 months.
  • Uploaded images never attached to a sent message: about 48 hours.

Deletion and privacy requests

Mend implements Shopify's mandatory privacy webhooks: when a shopper asks their store for their data, we compile an export for the merchant; when a shopper requests erasure, we redact their conversations, attachments and identifiers; and after a merchant uninstalls Mend, we honor Shopify's shop-redaction request and delete the store's data. Merchants can also contact us directly at support@mend.so for deletion.

Cookies and local storage

The chat widget stores a session token and a conversation pointer in the shopper's browser storage so a conversation can continue across page loads. The merchant dashboard uses a session cookie for sign-in. We use no advertising or cross-site tracking cookies.

Changes and contact

We will update this policy as the product evolves and revise the date above. Material changes affecting merchants are announced in the dashboard. Questions and requests: support@mend.so.