Privacy Policy
How we handle merchant and shopper data.
This page is a plain-language summary of current practice and has not yet been reviewed by counsel. It must be replaced with a reviewed policy before launch.
What we collect
For merchants: account details, catalog data you connect, and usage of your console.
For shoppers on a merchant’s site: conversation content and interaction events, stored on that merchant’s instance so the merchant can review their own sessions.
PII masking
Personally identifying information appearing in transcripts — names, emails, phone numbers — is masked by default in the merchant console. Revealing it is a deliberate action and is recorded in an audit log.
What the platform sees
HOLLOU’s own platform console holds aggregate counts only: sessions, tokens, cost and instance health. It holds no message content, and raw transcripts are never visible across merchants.
Model training
Your data, and your shoppers’ data, are never used to train external models.
Security and compliance
Data is encrypted in transit on every connection. Encryption at rest is not yet enabled on the merchant instance disk, and we will update this page when it is.
Any shopper’s data can be erased on request. Personal details are masked in transcripts by default, and every reveal is audit-logged. Your data is never used to train external models. Your instance runs on AWS, in the region chosen for your store: Sydney (ap-southeast-2) or N. Virginia (us-east-1). Our sub-processors are AWS, Anthropic, NVIDIA and Microsoft (Azure OpenAI Service). Each reply is generated by Anthropic (Claude) or by Microsoft’s Azure OpenAI Service: one is the primary for your instance, and the other is the automatic backup if the primary is unavailable. We do not publish a data processing agreement yet — one is included with Enterprise.
We never take a payment and never ask for card details — checkout stays on your platform — so we sit outside PCI-DSS cardholder-data scope. If a shopper types a card number into the chat anyway, it is masked in the console. We are working toward SOC 2 Type II and do not hold a report today.
Contact
Questions about data handling: contact@hollou.ai