Valen Privacy Policy
Last updated: October 28, 2026
Valen is an AI shopping assistant that merchants install on their Shopify store. This policy explains what data Valen processes, why, for how long, and how shoppers and merchants can exercise their rights. Contact: [email protected].
Roles: who controls what
The merchant who installs Valen is the data controller for their shoppers' data. Valen acts as a processor, handling that data only to provide the service the merchant configured — product recommendations, chat, and the features described below. Valen does not sell shopper or merchant data to anyone, and does not use it for advertising.
Data Valen reads from Shopify
Valen requests only the Shopify Admin API scopes a live feature actually uses, kept to the minimum needed:
| Scope | Why |
|---|---|
| Products | Search, compare, recommend and add products to cart in chat. |
| Shipping & markets | Answer shipping and delivery-threshold questions correctly per country/currency. |
| Locales | Reply in the store's primary language. |
| Legal policies | Answer shipping/returns/privacy questions using the merchant's own published policies, never invented ones. |
| Themes (read-only) | Suggest widget colors that match the store's live theme during setup; never edits the theme. |
| Orders | Count orders that followed a Valen chat session, and their value, for the merchant's results dashboard. Valen stores only the Shopify order id, the order display name (e.g. "#1001"), the paid amount, the currency, and Valen's own internal session id — never the shopper's name, email, phone number, or address, and Valen never reads order line items for customer-identifying fields. |
Data Valen collects from shoppers
- Chat sessions and messages. Anonymous by default — a random session id, no name or email required to chat.
- Shopping behaviour used to power the assistant (products viewed or clicked, cart changes, checkout started). Passive behavioural tracking (e.g. time spent on a product, proactive suggestions) only starts if the store's cookie consent banner records statistical consent; chat and explicit actions (clicks, cart, checkout) do not depend on that consent.
- Optional features the shopper actively starts: virtual try-on photos (kept locally in the shopper's browser for 24 hours, or on Valen's server only if the shopper explicitly saves them, for a limited retention window with immediate deletion on request), saved products/preferences for logged-in, consenting customers, and files the shopper uploads in chat (read in memory to answer the question, not stored as files).
How long Valen keeps data
| Data | Retention |
|---|---|
| Anonymous chat sessions | 90 days from the last message, then deleted |
| Chat linked to a logged-in, consenting account | Up to 12 months from the last activity |
| Saved products / preferences | Up to 12 months of inactivity, or deleted on request |
| Behavioural analytics events | Up to 13 months |
| Attributed orders (minimized) | Up to 24 months from the order date |
| Virtual try-on photos | 24 hours (browser only) by default; up to 90 days if explicitly saved by a verified account, deletable any time |
| Uploaded documents/files in chat | Not stored as files; extracted text used to answer kept up to 30 days |
| Security and debug logs | Up to 6 months / 30 days |
Deletion runs automatically on a schedule, and immediately on a verified request or when a merchant uninstalls Valen (see below).
Your rights, and Shopify's mandatory privacy webhooks
Valen implements Shopify's required compliance webhooks:
- Customer data request — Valen prepares a record of what it holds for that customer so the merchant, as data controller, can provide it.
- Customer redact — Valen deletes that customer's sessions, messages, events, cart, saved products, photos and consent records for that merchant. Minimized order-attribution rows (amount and currency only, for accounting) are kept without any session or customer link.
- Shop redact — on uninstall, Valen deletes the merchant's data in the same way, keeping only the minimum needed for accounting and legal records.
A shopper or merchant can also request access to or deletion of their data by writing to [email protected].
Security
Data is encrypted in transit (TLS) and at rest. Access to merchant and shopper data is limited to what Valen's own systems need to run the service; Valen does not sell data and does not share it for advertising purposes.
Sub-processors
Valen uses a small number of providers to run the service, each bound by a data processing agreement: cloud hosting and database providers (Railway, Fly.io), object storage for saved photos (Cloudflare R2), and AI model providers used to generate chat replies and virtual try-on images (OpenAI and Google, with OpenRouter as an emergency fallback only). None of these providers use Valen's data to train their own models.
Children
Valen is not directed at children, and the virtual try-on feature is limited to adults.
Changes to this policy
This policy may be updated as Valen's features change. Material changes will be reflected here with a new "last updated" date.
Contact
Questions about this policy or a privacy request: [email protected].