Security & Trust

How BOBBI protects merchant and shopper data in BOBBI Smart Store: access control, encryption and careful handling of store data.

BOBBI turns online stores into AI-powered Smart Stores. Merchants trust us with their catalog and their customers' shopping sessions — this page explains, in plain language, how we protect that data.

We never touch payment data

Every purchase made through a BOBBI Smart Store is completed in the store's native platform checkout (Shopify or SHOPLINE). Card numbers and payment credentials never pass through, and are never stored on, BOBBI systems. This keeps the strictest payment-security requirements (PCI DSS) where they belong: with the platform's certified checkout.

Where data is processed

Some service providers we use, such as Cloudflare (security and content delivery), Clerk (portal sign-in) and, with your consent, Google Analytics, may process data outside the EU. See our Privacy policy for details and safeguards.

Encryption & access control

• All traffic is encrypted with TLS (HTTPS everywhere, including custom storefront domains).
• Each published merchant storefront runs in its own dedicated containers.
• Webhooks are verified with platform HMAC signatures before processing.
• Session and handover tokens are cryptographically signed and short-lived.
• Secrets are kept in environment configuration.

Minimal platform permissions

The BOBBI app requests read-only store scopes (products, inventory, content, analytics). We do not request write access to orders, customers, or payment settings, and we do not access protected customer data beyond what powers the shopping experience.

GDPR & data lifecycle

• BOBBI Oy (Finland) acts as data processor for shopper data on behalf of the merchant, and as controller for merchant account data.
• Platform data-erasure webhooks (customer redact and store redact) are implemented for both Shopify and SHOPLINE and honored automatically.
• When the app is uninstalled, associated personal data is deleted or anonymized within 30–90 days.
• We maintain a record of processing activities.

Full details are in our Privacy Policy .

Sub-processors

• Hetzner Online GmbH (Germany) — cloud hosting;
• Shopify and SHOPLINE — store platforms and APIs;
• AI model providers (xAI, OpenAI, Anthropic) — assistant responses and search embeddings;
• Cloudflare — network routing and SSL for published storefront domains;
• Clerk — merchant authentication;
• Analytics — Umami (self-hosted, cookieless page analytics). See our Cookie policy .

Company scale, honestly

BOBBI Oy is an early-stage Finnish company. We do not hold a formal security certification — at our size, we invest in the practices above rather than audit paperwork. If your organization needs a security questionnaire filled in or a data processing agreement signed, contact us and we will respond quickly.

Reporting a vulnerability

Found a security issue? Please email founder.chatbob@gmail.com with the details. We appreciate responsible disclosure and will acknowledge reports promptly.