Privacy Policy

1. Introduction

Bookbag Inc. ("Bookbag," "we," "us," or "our") operates the website at bookbag.ai and the Bookbag platform, an AI customer support platform built for Shopify and ecommerce. Merchants use Bookbag to run an AI agent that answers customer questions, looks up and tracks orders, processes returns, exchanges and refunds within the rules the merchant sets, recommends products, and hands a conversation to a human with full context when it should. The agent runs across a website chat widget, email, WhatsApp, Instagram DM, Facebook Messenger and Slack, and — on higher plans — voice.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you visit our website, use our platform, submit a form, or otherwise interact with our services. By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy.

Two different roles. Bookbag acts in two capacities, and they are treated differently throughout this policy:

• As a controller for our own relationship with our customers and website visitors — account registration, billing, support correspondence, and the forms you submit on bookbag.ai.
• As a processor (service provider)for the conversations that take place between a merchant's customers and that merchant's agent. Those conversations belong to the merchant, who decides what the agent does and what data it handles; Bookbag processes them on the merchant's instructions in order to run the service. If you are a shopper who chatted with an agent on a merchant's website, direct your privacy requests to that merchant in the first instance — see Section 8.

This Privacy Policy is effective as of 21 July 2026.

2. Information We Collect

Information You Provide Directly

When you request a demo, contact us, or create an account, we may collect the following information that you voluntarily provide:

• Full name
• Business email address
• Company or store name
• Job title or role
• The ecommerce platform your store runs on (for example Shopify, WooCommerce, or BigCommerce)
• Approximate monthly support ticket volume
• Your primary customer support challenge or use case
• A phone number, if you provide one and opt in to SMS
• Any optional messages or context you include in form submissions

Content You Bring Into the Platform

When you set up an agent, you or your organization provide the material the agent needs in order to answer customers. This typically includes:

• Knowledge sources: help center articles, website pages, uploaded documents, and answers you write yourself, which we process to train and retrain your agent.
• Store data, when you connect a store: if you connect Shopify, WooCommerce, BigCommerce, or your own systems through our API or SDK, the agent retrieves the records it needs to answer a specific customer — orders and their status, shipping and tracking details, returns and exchanges, subscriptions, product and inventory data, and the customer details attached to those records.
• Team accounts: the names, email addresses, and permissions of the people in your workspace who use the help desk and shared inbox.

Conversation Data We Process for Merchants

When a shopper talks to a merchant's agent, we process that conversation on the merchant's behalf. Depending on the channel and how the merchant has configured the agent, this can include:

• The messages the shopper sends and the replies the agent generates
• A conversation identifier and a conversation token that authorizes that visitor to continue the conversation
• Anything the shopper enters into a lead form or an in-chat form, such as a name, email address, or order number
• Ratings or feedback the shopper leaves on a reply
• The order, return, or account records the agent looked up in order to answer
• Where the merchant uses identity verification, a signed user ID and any user metadata the merchant chose to pass in
• Where the merchant has enabled voice, audio from the visitor's microphone and a transcript of the call
• The IP address and browser user-agent transmitted with each request, as a technical necessity of any HTTP request

The merchant decides what their agent does, which channels it runs on, whether it collects leads, whether voice is enabled, and how long they keep their records. We do not use merchant conversation data for our own purposes.

Information Collected Automatically

When you visit our website, we automatically collect certain technical information, including:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent on each page
• Referral source (e.g., search engine, link from another site)
• Date and time of your visit

Cookies and Tracking Technologies on bookbag.ai

We use cookies and similar technologies on our own website, bookbag.ai, for the following purposes:

• Essential cookies: These are necessary for the website to function properly, such as maintaining session state and security features.
• Analytics cookies: We may use analytics services to understand how visitors interact with our website, which pages are most visited, and how we can improve the user experience. These cookies collect information in an aggregated form.

You can control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of our website.

Storage Used by the Bookbag Chat Widget

The Bookbag chat widget sets no cookies. It never writes to document.cookie, and no widget response sets a cookie. It does use a small number of browser storage entries, which serve functional purposes only — they are not advertising or cross-site tracking identifiers:

• bb_cfg_<agentId>(localStorage, written on the merchant's domain) — caches the widget's last-known appearance so the chat bubble renders immediately on a repeat visit. Configuration only; no visitor data. Persistent until overwritten or until site data is cleared.
• bb_widget_opened_<agentId>(sessionStorage, merchant's domain) — records that the visitor already opened the chat this session, so an auto-opening agent does not reopen on every page. Cleared when the tab closes.
• bb_widget_opened_<agentId>_teaser(sessionStorage, merchant's domain) — records that the proactive popup message has already been shown this session. Cleared when the tab closes.
• bb_chat_<agentId>(localStorage, on the Bookbag chat origin, or on the merchant's domain if they use a custom domain) — chat continuity. Holds the conversation ID, the conversation token, the ID of the last message received from a human agent, and up to the last 60 messages of the transcript, so the conversation survives a page navigation. Only written when persist chat is enabled on the agent, which is the default. Deleted when the visitor starts a new chat or clears the conversation from the widget menu.
• bb_chat_<agentId>_nx (sessionStorage, Bookbag chat origin) — records that the visitor dismissed the notice banner at the top of the chat panel. Cleared when the tab closes.

A visitor can remove all of this at any time by selecting "New chat" in the widget menu or by clearing site data in their browser. Merchants installing the widget should note that bb_cfg_<agentId> is written on page load rather than on interaction; see Privacy, cookies & compliance for how to gate the embed script behind consent.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your inquiries: When you submit a demo request or contact form, we use your information to respond to your inquiry, schedule demonstrations, and provide you with relevant information about our services.
• To deliver our services: We use your information to operate the Bookbag platform — training your agent on the knowledge sources you provide, generating replies to your customers, retrieving the order, return, and account records the agent needs to answer a specific question, taking the actions you have authorized such as order tracking, returns, exchanges and refunds within your rules, routing conversations to your team with full context, and reporting on resolution rate, CSAT, and revenue influenced.
• To communicate with you: We may send you information about your account, service updates, security alerts, and support messages related to the services you use or have requested.
• To improve our platform: We analyze usage patterns and feedback to improve the functionality, reliability, and user experience of our website and platform.
• To comply with legal obligations: We may process your information when required to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

We do not sell your personal information. Bookbag does not sell, rent, or trade your personal information to third parties for their marketing purposes.

We do not use purchased or rented contact lists. We do not use purchased, rented, or third-party affiliate lead lists to contact individuals. We only contact people who have directly provided their information to us through our website or platform.

4. Communications and Consent

By submitting a form on our website (such as a demo request, contact form, or a request for a free walkthrough of your store), you consent to receiving communications from Bookbag related to your inquiry. These communications may include follow-up emails, information about our services, and scheduling correspondence.

We only initiate contact with individuals who have directly and voluntarily provided their information through our website. We do not send unsolicited messages to individuals who have not interacted with us.

SMS/Text Messaging

If you opt in to receive SMS or text messages from Bookbag Intelligence, the following terms apply:

• Consent: By checking the SMS consent checkbox on our contact form, you expressly consent to receive text messages from Bookbag Intelligence at the phone number you provide. Consent is not a condition of purchase or service.
• Message types: Messages may include responses to your inquiry, appointment confirmations, service updates, and relevant product information.
• Message frequency: Message frequency varies based on your interactions with us. We do not send more than 5 messages per month unless you initiate a conversation.
• Message and data rates: Standard message and data rates may apply depending on your mobile carrier and plan.
• Opt-out: You may opt out of SMS messages at any time by replying STOP to any message you receive from us. After opting out, you will receive one final confirmation message. You may also opt out by contacting legal@bookbag.ai.
• Help: For support, reply HELP to any SMS message or contact us at legal@bookbag.ai.

We do not share, sell, rent, or otherwise disclose your phone number or SMS opt-in consent information with any third parties or affiliates for their marketing purposes. Your SMS opt-in data will only be used by Bookbag Intelligence to send you messages you have consented to receive.

Email Communications

You may opt out of receiving email communications from us at any time by:

• Clicking the "unsubscribe" link included in any marketing email we send
• Contacting us at legal@bookbag.ai with your opt-out request
• Replying to any communication with a request to stop further contact

We will honor your opt-out request promptly. Please note that even after opting out of marketing communications, we may still send you transactional messages related to your active account or services (such as security notifications or billing information).

5. Data Sharing and Disclosure

We do not sell your personal information to third parties. We may share your information only in the following limited circumstances:

• Service providers: We may share information with trusted third-party service providers who assist us in operating our website, delivering our platform, processing payments, sending communications, or performing analytics. These providers are contractually obligated to use your information only for the purposes we specify and to protect it in accordance with this Privacy Policy.Merchants who need our current sub-processor list for their own record of processing activities can request it from legal@bookbag.ai.
• AI model providers: Generating a reply requires sending the relevant conversation content to the AI model provider that produces it. Voice is a direct connection.When a merchant enables voice and a visitor starts a call, the visitor's browser opens a realtime connection directly to OpenAI at api.openai.com/v1/realtime, using a short-lived session credential issued by Bookbag. Audio does not pass through Bookbag on its way to OpenAI. Merchants running voice should list OpenAI as a recipient in their own privacy notice. Text-only agents do not make this connection.
• Systems you connect: When you connect a store or a channel — Shopify, WooCommerce, BigCommerce, your own systems via our API or SDK, or a messaging channel such as WhatsApp, Instagram, Facebook Messenger, email, or Slack — data moves between Bookbag and that system so the agent can read the records it needs and deliver messages where your customers are. Those systems are governed by their own privacy policies and by the connection you authorized.
• Legal requirements: We may disclose your information if required to do so by law, or in response to valid requests by public authorities, including subpoenas, court orders, or government regulations.
• Business transfers: If Bookbag Inc. is involved in a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.
• Protection of rights: We may disclose information when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

6. Data Security

We take the security of your personal information seriously and implement industry-standard measures to protect it. Our security practices include:

• Encrypted credential storage: Store connector credentials, skill secrets, and provider API keys are encrypted at rest using AES-256-GCM.
• Encryption: All data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256 or equivalent encryption standards.
• Access controls: We employ strict access controls, including role-based permissions, multi-factor authentication, and the principle of least privilege to ensure only authorized personnel can access personal information.
• Monitoring and logging: We maintain comprehensive access and activity logging and monitoring systems to detect and respond to potential security incidents.

While we strive to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents in accordance with applicable laws.

7. Data Retention

We retain your personal information only for as long as is necessary to fulfill the purposes for which it was collected, including to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements.

Specifically:

• Account and service data: We retain your account information and service-related data for the duration of your active account or business relationship with us, and for a reasonable period thereafter as needed to comply with our legal obligations.
• Form submission data: Information submitted through demo requests or contact forms is retained for as long as necessary to respond to your inquiry and for legitimate business follow-up.
• Conversation and agent data: Conversations between your customers and your agent, the leads your agent captures, and the knowledge sources you upload are retained in accordance with your service agreement and applicable data retention schedules, and are deleted when you delete them from your dashboard.For the default retention period applied to conversation records, contact legal@bookbag.ai.
• Zero Data Retention (Enterprise): On Enterprise workspaces with HIPAA / Zero Data Retention enabled, conversations end automatically after 24 hours idle or 7 days of age and their content is irreversibly purged.

You may request deletion of your personal information at any time by contacting us at legal@bookbag.ai. We will process your request in accordance with applicable laws and respond within 30 days.

8. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal information:

If you chatted with an agent on a merchant's website,that merchant is the controller of your conversation and Bookbag processes it on their behalf. Send your request to the merchant, who can export or delete the conversation and any associated lead record from their Bookbag dashboard. You can also delete the local copy in your own browser at any time by selecting "New chat" in the widget menu or clearing site data. If you contact us directly about a conversation we hold for a merchant, we will refer you to that merchant and assist them in responding.

• Right to access: You may request a copy of the personal information we hold about you.
• Right to correction: You may request that we correct inaccurate or incomplete personal information.
• Right to deletion: You may request that we delete your personal information, subject to certain legal exceptions.
• Right to opt out: You may opt out of receiving marketing communications from us at any time.
• Right to data portability: Where applicable, you may request a copy of your data in a structured, commonly used, machine-readable format.

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect, use, disclose, and sell
• The right to request deletion of your personal information
• The right to opt out of the sale or sharing of your personal information (note: we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights

To exercise your CCPA/CPRA rights, contact us at legal@bookbag.ai. We will verify your identity before processing your request and respond within 45 days as required by law.

European Economic Area Residents (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR), including:

• The right to access, rectify, or erase your personal data
• The right to restrict or object to our processing of your personal data
• The right to data portability
• The right to withdraw consent at any time, where processing is based on consent
• The right to lodge a complaint with a supervisory authority

Our legal bases for processing personal data include your consent, the performance of a contract, our legitimate business interests, and compliance with legal obligations. To exercise your GDPR rights, contact us at legal@bookbag.ai.

For the hosting location of conversation data, the transfer mechanism relied on for transfers out of the EEA or UK, our standard Article 28 data processing addendum, and Article 27 EU representative details, contact legal@bookbag.ai.

9. Children's Privacy

Our platform is sold to and designed for businesses, and neither our website nor our platform is directed at children under the age of 13. We do not knowingly collect personal information from children under 13, and merchants deploying an agent are responsible for the audience of their own site. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information as quickly as possible. If you believe we may have collected information from a child under 13, please contact us immediately at legal@bookbag.ai.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

Your continued use of our website or services after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Company: Bookbag Inc.
• Website: bookbag.ai
• Email: legal@bookbag.ai

We will make every effort to respond to your inquiry within 30 days.