Privacy Policy

6. Google User Data

Businesses that use Wilmo ("merchants") can connect a Gmail or Google Workspace mailbox to Wilmo. This section explains which Google user data we access, how we use it, and how to remove it.

6.1 Data We Access

When a merchant connects a mailbox, we ask Google for:

• Email address and basic identity (openid, email): To know which account is connected
• Read access (gmail.readonly): To read the mailbox's messages
• Send access (gmail.send): To send email from the mailbox

6.2 How We Use It

We use Google user data only to provide these features to the merchant who connected the mailbox:

• Importing past conversations: We import the merchant's past customer conversations (sent mail and the threads it replies to, up to 2 years back) as resolved support tickets in the merchant's own Wilmo workspace, so the merchant's own AI support agent answers the way the shop already does.
• Receiving new email: New customer emails that arrive in the mailbox become tickets in the merchant's Wilmo workspace.
• Sending replies: Replies sent from Wilmo, by the merchant or by the merchant's AI agent under rules the merchant configures, are sent from the merchant's own address and appear in the mailbox's Sent folder.

Wilmo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6.3 Storage and Security

Google user data is stored in the EU (Supabase, Stockholm, Sweden). Google refresh tokens are encrypted at rest. Access is limited to the merchant's own Wilmo workspace.

6.4 Sharing

We do not sell Google user data, use it for advertising, or use it for credit or lending decisions. We do not share it with anyone except the sub-processors that run the features above, listed at wilmo.ai/legal/sub-processors, except as necessary to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining the merchant's explicit prior consent. Section 4 does not widen this for Google user data. AI inference providers process it under zero data retention and never use it to train models. We do not use Google user data to develop, improve, or train generalized or non-personalized AI or machine learning models.

6.5 Human Access

Wilmo staff do not read Google user data, except with the merchant's explicit consent (for example, a support request), for security purposes (for example, investigating abuse), to comply with applicable law, or when the data is aggregated and anonymized for internal operations.

6.6 Retention and Deletion

• History imports: Wilmo's Google access for a history import ends when the import finishes, and the token is revoked.
• Connected mailboxes: A merchant can disconnect a mailbox in Wilmo at any time (Channels → Email → Settings → Disconnect). This deletes Wilmo's stored Google tokens and asks Google to revoke Wilmo's access. Tickets already in Wilmo stay.
• Undoing an import: A merchant can undo a mailbox history import in Wilmo, which permanently deletes the imported conversations and the stored copies of the imported emails.
• Deleting the data: A merchant deletes its Google user data in Wilmo by deleting the team (Settings → Team → General → Delete Team). For anything the app cannot do yet, email privacy@wilmo.ai or use the details in section 15. See section 11, Data Deletion.
• Your Google account: You can also remove Wilmo's access at any time at myaccount.google.com/permissions.

7. Shopify

Merchants can connect a Shopify store to Wilmo. For data from the store, the merchant is the controller and Wilmo is the merchant's processor under our Data Processing Agreement. This section explains which Shopify data we process, why, how long we keep it, and how to have it deleted.

7.1 Data We Process and Why

• Customer data (name, email address, phone number, address): To match a shopper who contacts the merchant to the right Shopify customer and orders, to show the merchant's support agent who they are helping, and to answer delivery questions or correct an address when the shopper asks
• Order data (orders, fulfilment and shipping status, refunds, cancellations, draft orders): To answer questions about an order and, when the merchant allows it, to refund, cancel, or edit an order on the merchant's behalf
• Product and inventory data: To answer product and stock questions
• Discounts and gift cards: To look up or create a discount code or check a gift card when the merchant's support process calls for it
• Store connection: The store's domain and Wilmo's Shopify access token (and, for the public Wilmo app, the refresh token that renews it every hour), encrypted at rest

Wilmo reads Shopify data on demand, for the conversation in front of the support agent (a person or Wilmo's AI agent). We do not copy a store's customer list or order history in bulk. What a lookup returned is stored with that conversation (section 10).

7.2 Protected Customer Data

• Shopify customer data is used only to provide support in that merchant's own Wilmo workspace. Each merchant's data is isolated from every other merchant's by row-level security in our database.
• We do not sell or share Shopify data, use it for advertising, or use it to send marketing to the merchant's customers.
• No AI model is trained or fine-tuned on Shopify data, by us or by our AI providers (section 8).
• Data is encrypted in transit (TLS) and at rest (AES-256 at our database provider). Access tokens and other credentials are additionally encrypted by Wilmo with AES-256.
• Wilmo staff open a merchant's data only to help that merchant, fix a problem affecting it, or handle a security incident.
• Shopify-sourced conversations are kept out of the internal evaluation sets we use to improve Wilmo for all merchants, unless the merchant agrees.
• Every time Wilmo staff open a merchant's workspace, it is recorded in an access log, kept for 1 year.

7.3 Uninstalling the App

• When a merchant uninstalls Wilmo from Shopify, Wilmo wipes its Shopify access and refresh tokens for that store straight away and can no longer read the store. The store connection stays in the merchant's Wilmo team, marked as no longer working, so the team can see what happened. A store connected through an older custom app made for that one store has that connection deleted when the custom app is uninstalled.
• If the store installs Wilmo again, Wilmo does not serve the new installation to the earlier Wilmo teams on its own: an admin of the Wilmo organization the store was connected to must reconnect it first, because the store may have a new owner.
• Tickets and conversations already in the merchant's Wilmo team stay until the merchant deletes the team in Wilmo (section 11.1) or asks us to erase them.
• Shopify sends a shop redaction request 48 hours after uninstall. Wilmo verifies it and erases the store's data automatically. For a workspace that was created through Shopify and has no other channel or contract, the whole workspace is erased; otherwise the data that came from the Shopify store is erased. If the owner of the data cannot be proven automatically, a person at Wilmo finishes the erasure. The merchant can also delete its team in Wilmo at any time (section 11.1).

7.4 Customer Data Requests and Redaction

When a shopper asks a merchant for a copy of their data or for its deletion, Shopify forwards the request to Wilmo (customers/data_request and customers/redact).

• Wilmo verifies each request Shopify sends and carries it out automatically within 30 days: an export file the merchant downloads for the shopper in Settings → Privacy requests (available for 30 days), or erasure of that shopper's personal data across tickets, messages, and stored files. The tickets stay as empty shells so the merchant's statistics remain, and the shopper's contact is anonymised. Credit notes issued in the merchant's name are kept for 5 years as Danish bookkeeping law requires.
• A merchant cannot yet erase a single shopper in the Wilmo app for requests that do not come through Shopify. A merchant or shopper who emails privacy@wilmo.ai gets the export or deletion completed within 30 days (section 11).

8. AI Processing and Automated Decisions

8.1 AI Providers

Wilmo's AI features (drafting and sending replies, classifying and translating tickets, Wilbot, the chatbot) send ticket content and the data the AI agent looked up to AI model providers, listed at wilmo.ai/legal/sub-processors. Every AI model request we send through Vercel AI Gateway requires zero data retention, so the provider that serves it deletes prompts and outputs after processing. Two features are outside that rule: phone-call transcription sends call audio directly to OpenAI, which may keep it for up to 30 days for abuse monitoring; and spoken input to Wilbot is transcribed by OpenAI through the AI Gateway without a zero-data-retention requirement. In every case, no AI provider uses this data to train models, and we do not train or fine-tune AI models on it (section 19 of our Data Processing Agreement).

8.2 Automated Replies and Decisions

• In email, live chat, and social messaging channels, Wilmo's AI agent by default only drafts replies, and a person on the merchant's team approves them before they are sent.
• A merchant can choose, per category of request and per channel, to let the AI send replies on its own ("Autopilot").
• In those channels, actions that change an order, such as refunds, cancellations, and order edits, wait for a person's approval unless the merchant has turned on Autopilot for that category.
• If the merchant turns on Wilmo's website chatbot, it answers shoppers live without a person approving each reply, and it can carry out some order actions, such as cancelling an order, for a shopper who has verified their email address. Conversations that need a person are passed to the merchant's team.
• The merchant's team sees every conversation in its Wilmo inbox and can take over any conversation at any time. A shopper can always ask to speak to a person.

Opting out of automated decisions: when a shopper asks for a human in an email or social message, their conversations go to the merchant's team on every channel, and no automated reply or decision, such as an automatic refusal of a refund or cancellation, is applied to that shopper again. In the website chatbot, a shopper who has opted out cannot have any order action carried out.

10. Data Retention

This table says how long we keep data. Wilmo deletes support data on a schedule that each merchant can set; a merchant can also delete it sooner in Wilmo or ask us to (section 11).

A shorter period always wins: when a merchant deletes its team in Wilmo, or a deletion request is completed, the data is removed before its retention period ends. Data kept for a legal reason is used only for that reason.

11. Data Deletion

Businesses that use Wilmo delete their data themselves, in the Wilmo app, without writing to us. Email toprivacy@wilmo.ai is the fallback for what the app cannot do yet, and the direct route for people who contacted a business that uses Wilmo.

11.1 Businesses Using Wilmo: Delete It Yourself

• Delete a team (permanent): An admin opens Settings → Team → General and, under Danger Zone, chooses Delete Team, reviews what will be erased, and approves it. Wilmo then permanently erases the team's tickets, messages, contacts, channels, integrations and the credentials stored with them, knowledge documents, settings, and stored files, checks that nothing is left, and shows a deletion receipt in Wilmo. A usage record of each AI request (model, token counts and cost) is kept for billing; the stored request and response content is erased. The Shopify app's own tokens belong to the store's installation and are wiped when the app is uninstalled (section 7.3). If the erasure cannot finish safely, the receipt says so; email us and we finish it.
• Delete a channel: Under Channels, open the channel, then Settings → Danger Zone → Delete Channel. This deletes the channel and its stored access token (for Messenger and Instagram, the Page access token). Conversations the channel already received stay in the inbox until the team is deleted.
• Disconnect an integration: Under Integrations, open the integration and choose Disconnect. This deletes the connection and its stored credentials. Tickets stay. For Shopify, Disconnect on the last team using a store uninstalls Wilmo from that store and wipes Wilmo's Shopify tokens; if other teams in your organization still use the store, only this team is disconnected. If Shopify does not confirm the uninstall, Wilmo still wipes its tokens and tells you to finish in the Shopify admin (Settings → Apps) (section 7.3).
• Disconnect a mailbox: Under Channels → Email, open Settings and choose Disconnect. This deletes Wilmo's stored mailbox tokens, and for Gmail Wilmo also asks Google to revoke its access. Tickets stay.
• Remove a ticket from the inbox: In a ticket, open More and choose Delete ticket. This removes the ticket from the inbox; its content is erased when the team's retention period passes (section 10). To erase it sooner, delete the team or email us.
• Remove a member: Settings → Organization → Members → Remove member ends that person's access. Their Wilmo login is not deleted.

Not yet possible in the app: erasing a single contact, a single ticket, a whole organization, or a user's login. For these, email privacy@wilmo.ai from an admin address of the account and we complete it within 30 days. Deleting data in Wilmo does not remove Wilmo from the services you connected; use the steps in section 11.3 for that.

11.2 People Who Contacted a Business That Uses Wilmo

The business you contacted is the controller of your conversation, and Wilmo processes it on that business's behalf, so ask that business first: it decides what happens to your data, can remove your conversation from its Wilmo inbox, and can have it erased. For a Shopify store, your request also reaches Wilmo through Shopify (section 7.4). You can also email privacy@wilmo.ai directly with the name of the business, the channel you used (email, chat, phone, Facebook, Instagram), and the email address or name you used. We will delete the data, or send you a copy, together with that business, within 30 days.

11.3 Platform-Specific Steps

• Facebook and Instagram: Delete the channel in Wilmo (section 11.1), then remove Wilmo in Facebook or Instagram; see how to remove Wilmo's access in Facebook or Instagram.
• Google: Disconnect the mailbox in Wilmo (section 11.1), or remove Wilmo's access at myaccount.google.com/permissions (section 6.6).
• Shopify: Uninstall Wilmo in the Shopify admin under Settings → Apps (section 7.3).

11.4 Timing and What We Keep

Deleting a team in Wilmo starts the erasure at once; it runs in the background and its receipt in Wilmo shows when it is verified. We complete verified deletion and access requests sent to privacy@wilmo.ai within 30 days and confirm by email when they are done. We keep only what the law requires us to keep, such as billing records and credit notes, and deleted data leaves our encrypted database backups within 7 days (section 10).