Effective June 16, 2026
Aurai ("Aurai", "we", "us") provides an automated chargeback-defense app for Shopify merchants. This policy explains what data the app accesses, how we use and protect it, and your choices. It applies to the Aurai app installed from the Shopify App Store.
When you install Aurai and approve access, we access — through Shopify's APIs and only with the scopes you grant — the data needed to detect and contest chargebacks:
We do not access full payment card numbers, and we never move funds or change payouts.
We use a small number of vetted service providers to run Aurai: cloud hosting and an encrypted Postgres database for storage, and a large-language-model provider to draft rebuttal text from the dispute evidence. Subprocessors are bound by confidentiality and data-protection obligations and may only process data to provide their service to us. We do not sell your data or share it for advertising.
Dispute records, generated rebuttals, and assembled evidence are stored encrypted and scoped to your store. We retain them only as long as needed to contest the dispute and record its outcome, and then delete them in the ordinary course. When you uninstall the app, or when Shopify sends us a shop-redaction request, we delete your store's data. We honor Shopify's mandatory GDPR webhooks (customer data request, customer redaction, and shop redaction).
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access tokens are stored as encrypted secrets and used only server-side; access is scoped per merchant.
You can request access to, correction of, or deletion of your data at any time by emailing support@aurai.dev. Depending on your region (e.g., GDPR or CCPA), you may have additional rights; we will honor applicable requests.
We may update this policy; material changes will be reflected by the effective date above. Questions? Contact support@aurai.dev.