Lolipop is a customer-support helpdesk for Shopify stores. It is operated by Yummy, MB (yummygrow.com), which runs it for its clients. This policy explains what Lolipop processes, why, and how it is deleted.
Who is responsible
For the support emails and order data of a store's customers, the store (our client) decides how that data is used, and Yummy, MB processes it on the store's behalf to provide the helpdesk. For the accounts of people who log in to Lolipop, and for messages sent to us through our contact form, Yummy, MB is responsible.
What we process
- Support emails. Messages that a store forwards into Lolipop and the replies sent from it: customer names, email addresses, message contents, and attachment metadata (file name, type, size).
- Shopify data. Read through the Lolipop Shopify app the store installs: the customer's orders, fulfillment and tracking details, and product availability. Used to draft replies and to show the order next to each ticket.
- Shopify actions. When a person on the store's team approves an action (cancel, refund, shipping address change, discount code, replacement order, order note), Lolipop sends that change to Shopify and records who proposed, edited, approved and ran it.
- Store settings. The policies, tone, signature and support categories the store gives the AI.
- Team accounts. Names and email addresses of the client's team members, used for log-in links, invitations and the daily digest.
- Contact form. What you send us on the contact page: name, email, company or store, and your message.
How we use it
- To sort incoming messages, draft replies, and propose Shopify actions for the store's team to review.
- To send the replies the team approves, and replies in categories the store has put on autopilot.
- To send log-in links, invitations, notices and the daily digest.
- To keep the service running and fix errors.
We do not sell data, we do not use it for advertising, and we do not use one store's data to answer another store's customers. The AI only discusses orders placed with the email address a message came from.
Who helps us process it
- Anthropic (Claude): sorts messages and drafts replies. Anthropic does not train its models on data sent through its commercial API (details).
- Postmark: receives the forwarded support emails and delivers ticket replies to customers.
- Resend: delivers Lolipop's own emails (log-in links, invitations, the daily digest).
- Railway: hosting and database.
- Sentry: error monitoring. Error reports can include technical details of the request that failed.
- Shopify: the platform the store runs on; Lolipop reads and changes data there only as described above.
How we protect it
- All traffic is encrypted in transit (TLS).
- Shopify access tokens are encrypted before they are stored.
- Each store's tickets are visible only to that client's team and to Yummy staff working on the account.
- Shopify actions need a person's approval, pass per-store limits, and can be switched off for a client at once.
Deletion and data requests
- A customer asks to be deleted. When Shopify sends the
customers/redactrequest, Lolipop deletes that customer's tickets for that store. - A store uninstalls the app. Shopify sends
shop/redactabout 48 hours later, and Lolipop deletes that store's data, including its tickets. - A customer asks for their data. When Shopify sends
customers/data_request, Yummy is notified, exports what Lolipop holds for that customer, and sends it to the store within 30 days. - Anything else. Clients and their team members can ask for access, correction or deletion by email (below). Store customers should contact the store first; the store will forward the request to us.
Otherwise we keep data while the client uses Lolipop, and delete it when the client leaves or asks us to.
Your rights
Under GDPR, UK GDPR and similar laws you can ask for access to your data, correction, deletion, a portable copy, or a restriction of processing. AI drafts are reviewed by people unless a store has turned on autopilot for a category; no decision with legal effect on you is made by the AI alone. If you think we have not handled your data lawfully, you can complain to your local supervisory authority (in the EU, see edpb.europa.eu; in the UK, the ICO).
Changes
If we change this policy in a material way, we will tell our clients by email before the change takes effect.
Contact
Privacy questions and requests: juras@yummygrow.com
Operator: Yummy, MB (operator of Lolipop)