Legal review required. This draft describes how the app works today. Complete every placeholder and have it reviewed before relying on it.
1. Who provides Wunder Manager
Wunder Manager is provided by Wunder AI Limited (“Wunder”, “we”, “us” or “our”), with its registered address at Flat/Rm 811, 8/F, New Tech Plaza, 34 Tai Yau Street, San Po Kong, Kowloon, Hong Kong (Business Registration number 75966621). Privacy enquiries can be sent to [email protected].
2. Our role and commitments
Our role depends on the information involved:
- Processor. For store data and for the details of a merchant’s customers handled on the merchant’s behalf, Wunder acts as a processor. The merchant remains the controller of that information and decides how it is used.
- Controller. For merchant contact details, support communications and website usage information, Wunder acts as a controller.
We also commit to the following:
- Wunder Manager does not sell personal information.
- Wunder Manager does not use merchant or customer data for advertising.
- Information is used to provide the features the merchant has turned on, and for the purposes in section 4.
3. Information we receive
Shopify and merchant account information
When a merchant installs the app, Shopify may provide store identity, domain, plan and contact details, staff identity, installation status and the access credentials required to operate authorised app features.
Store information
To provide its features, the app may access products, variants, collections, inventory, photos and files, pages, blog articles, translations and related store content within the permissions approved by the merchant.
Order and customer information
Where the merchant uses the phone or chat assistant, the app may read order and customer details from the store to answer a question about an existing order, and may create a draft order with the details a customer gives.
Conversations with a merchant’s customers
When the assistant answers a phone call or a chat message for a merchant, we process the caller’s phone number, the name they give, what was said or written, a summary of the conversation, and any message left for the merchant.
Connected accounts
If a merchant connects an account such as Facebook, Instagram, Google Business Profile or WhatsApp, we receive the access needed to act for that account, the account’s name and identifiers, and the content the merchant chooses to publish through it.
Content the assistant prepares
We store the drafts the assistant writes, such as descriptions, alt text, social posts and articles, the merchant’s writing rules and brand voice, and the merchant’s decisions on them.
Technical, usage and support information
We may process IP address, browser and device details, request timestamps, diagnostic events, feature interactions, error reports and information a user sends in a support or contact request.
4. Why we process information
We use information to authenticate stores; prepare and save the work the merchant asks for; answer the merchant’s customers and pass on their messages; publish approved content to connected accounts; operate support and, where it applies, billing; secure and troubleshoot the service; prevent abuse; comply with law; and improve reliability and usability. We do not use this information for advertising, and we do not sell it.
5. Artificial intelligence
Wunder Manager uses AI models from third-party providers to write drafts and to hold conversations. The content needed for a task, such as a product’s details and photo, or what a caller says, is sent to the provider to produce the result. AI output can contain mistakes, and the merchant remains responsible for the work done for its store.
6. Legal bases
Where UK or EEA data-protection law applies, processing may be based on performance of a contract, legitimate interests in operating and securing the service, compliance with legal obligations, or consent where required. The applicable basis depends on the information and the context in which it is processed. Merchants are responsible for telling their own customers how calls and messages are handled, including that an automated assistant may answer.
7. Shopify APIs and platform data
Wunder Manager uses Shopify APIs only to provide documented app functionality. Shopify independently processes data under its own terms and policies. Information received from Meta, Google and other connected platforms is used only to provide the features the merchant connected them for, in line with each platform’s terms.
8. Service providers and subprocessors
We use the following service providers to operate Wunder Manager:
- Shopify: app installation, authentication and Shopify API access.
- Cloudflare, Inc.: application and website hosting, database, file storage, network security and related technical logs.
- Twilio Inc.: telephone numbers, call audio and message delivery.
- Google LLC: AI models, including for voice conversations, and Google Business Profile publishing.
- Anthropic, PBC and OpenAI, L.L.C.: AI models used to write drafts.
- Meta Platforms, Inc.: Facebook, Instagram and WhatsApp publishing and messaging.
- Email service provider: receiving and responding to support enquiries.
TODO: confirm this list against the providers in use at launch. These providers may use their own subprocessors and may process data in countries including the United States, subject to their contractual and legal safeguards.
9. Storage and security
We use HTTPS encryption in transit, encrypted storage of account credentials, restricted administrative access and the security controls provided by our hosting and infrastructure providers. Within the app, sensitive settings are limited to the store owner. Access to production data is limited to authorised personnel who require it to operate or support the service. No method of storage or transmission is completely secure.
10. International transfers
Information may be processed outside the merchant’s country, including in Hong Kong, Japan and the United States. Where required, we rely on contractual protections, recognised adequacy mechanisms or other lawful safeguards for international transfers.
11. Retention
Store data, conversations, generated content and stored account connections are kept while Wunder Manager is installed and are deleted within 30 days of uninstallation or of a verified deletion request, unless a longer period is required by law. TODO: confirm retention periods for operational logs, support communications and backups.
See the data deletion page for uninstall and request procedures.
12. Rights and choices
Depending on location, individuals may have rights to access, correct, delete, restrict or object to processing, receive portable information, withdraw consent and complain to a supervisory authority. We may need to verify identity. Requests from a merchant’s customers are passed to the responsible merchant, who decides how that information is used.
13. Cookies and analytics
The Wunder Manager website does not currently use advertising cookies. Necessary technologies may be used for security, network delivery and essential site operation. Cloudflare may process limited technical information, such as IP addresses and request metadata, to provide these services. If optional analytics or advertising technologies are introduced, this policy and any required consent controls will be updated first.
14. App uninstallation and deletion
When the app is uninstalled, Shopify revokes access and tells us the app was removed. We stop using the store’s access and apply the documented deletion process. Shopify mandatory privacy webhooks are handled as described on our data deletion page.
15. Children
Wunder Manager is a business service for authorised Shopify merchants and is not directed to children.
16. Changes
We may update this policy to reflect product, legal or operational changes. We will update the “Last updated” date and provide additional notice where required.
17. Contact and complaints
Contact [email protected] with privacy questions or requests. Where applicable, you may also complain to the data-protection authority responsible for your location. In Hong Kong, this is the Office of the Privacy Commissioner for Personal Data.