Prompted

Privacy policy

Last updated 15 October 2026

Prompted is a Shopify app that asks AI assistants the kinds of questions shoppers ask, and records whether those assistants recommend the merchant’s store. This policy explains what information Prompted handles, why, where it is processed, and how to have it deleted.

Who is responsible

Prompted is operated by Norman Dobschal, Schleibogen 27, 24857 Fahrdorf, Deutschland. Full provider details are in the Impressum. For any question about this policy or your data, contact support@prompted-app.com.

What Prompted stores

When a merchant installs Prompted, it stores:

• the store’s Shopify domain and its public storefront domain;
• the brand name the merchant confirms, and the merchant’s plan and scan settings;
• the shopper-style questions the merchant chooses to track;
• the answers AI assistants give to those questions, including the brands they name and the web pages they cite;
• changes in those answers over time, and when the merchant last viewed the dashboard;
• the result of the store check, which reads the store’s public pages the way any visitor or search crawler does, and which action-plan tasks the merchant has marked done;
• for orders whose shopper arrived from an AI assistant: the order number, total, currency and date, which assistant it was, and the website the visit came from;
• product FAQs the merchant writes or has drafted, and which of them are published to the store;
• the store owner’s email address as Shopify provides it, used only to send the weekly summary email, which the merchant can turn off at any time;
• the access token Shopify issues to the app, which is required to operate it for that store.

What Prompted does not collect

Prompted does not access or store information that identifies a store’s customers: no names, email addresses, phone numbers, postal addresses or payment details, and no customer accounts. To find orders that came from AI assistants, it reads the store’s recent orders with permission the merchant grants in Shopify, but only each order’s number, total, currency, date and how the shopper arrived (the referring website and campaign tags). Nothing is kept about orders that did not come from an AI assistant. Prompted does not request access to customers. For product FAQs it reads the store’s public product pages, as any visitor can; only when a storefront is password-protected does it offer to read product titles and descriptions from Shopify instead, with read-only access the merchant grants. It uses store-level access only: apart from the store owner’s email address, it does not receive the names or email addresses of the store’s staff.

Why it is used

The information above is used only to provide the app: to run scans, show results and changes, explain why an assistant answered as it did, suggest what to do about it, show which orders came from AI assistants, publish the product FAQs the merchant approves, send the weekly summary email, operate billing through Shopify, and answer questions in the in-app support assistant. It is not sold, and it is not used for advertising.

Service providers

Prompted relies on these providers to operate:

• Fly.io — application hosting, in Frankfurt, Germany.
• Neon — database hosting, on Amazon Web Services in Frankfurt, Germany.
• OpenAI — receives the tracked questions to produce answers, receives those answers to identify the brands they name, receives messages typed into the in-app support assistant to reply to them, and, when the merchant asks for a draft, the question, the brand name and the address of the page the draft is about; for a product FAQ draft, the product’s public title and description.
• Perplexity — receives the tracked questions to produce answers.
• Google — receives the tracked questions to produce Gemini answers, only for stores where that assistant is switched on.
• Shopify — installation, authentication and billing, and storing the published product FAQs.
• Resend — delivers the weekly summary email; receives the store owner’s email address and the content of that email.

What is sent to the AI providers is the question text and, for reading the answer, the brand name. Messages to the support assistant are sent to OpenAI to generate a reply and are not stored by Prompted. Each provider processes data under its own terms.

How long it is kept

Records of AI-referred orders are deleted automatically after 90 days. Other store data is kept while Prompted is installed. When a merchant uninstalls the app, Shopify sends a deletion request, and Prompted then permanently deletes all data it holds for that store. A merchant can ask for deletion sooner by contacting us at the address above.

Your rights

Depending on where you are, you may have the right to access, correct, delete or export your data, to object to or restrict its processing, and to lodge a complaint with your data protection authority. To use any of these rights, contact us at the address above.

Security

All connections to Prompted are encrypted in transit, and the database is encrypted at rest. Access to stored data is limited to what is needed to run and support the app.

Changes

If this policy changes, the date at the top of this page changes with it.