Security & privacy
You're trusting us with your customers' messages and your store credentials. Here's how we protect them.
Your credentials are encrypted
Store credentials (the Shopify App Store connection's access tokens, or a custom app's Client Secret) are encrypted before they're stored, and only decrypted to connect to your store on your behalf. We never display them back to you. If you uninstall LzyReply from Shopify, access is revoked right away and the store's data we hold is erased 48 hours later.
Your data is yours, and isolated
- Each account's conversations, knowledge base, and settings are strictly separated — one account can never see another's data.
- You can delete a customer's data on request, and we keep conversation history only as long as you need it.
The AI never acts behind your back
Replies are drafts until you approve them, unless you switch on an opt-in automation (like auto-replying to "where is my order?" or auto-updating shipping addresses), and those notify you every time they act. The AI treats customer emails as information to answer, not instructions to follow — so a cleverly-worded email can't make it send, refund, or change something behind your back. Address updates pass a server-side safety check (the order must be pre-fulfillment) every time.
Email & AI providers
We use trusted providers to send email and generate drafts. We send them only what's needed to do the job, and they don't train on your data. They're listed in our privacy policy as sub-processors.
If something goes wrong
Our Security Incident Response Policy explains how we handle a breach, including telling you within 72 hours if your customers' data is affected. Report a suspected issue to security@lzyreply.com.