Privacy Policy

Last updated: 10 September 2026

Obelisk is a customer-support assistant for Shopify stores. It reads the emails your customers send you, matches them against your orders, and drafts replies for you to approve. This page explains exactly what it touches and what it keeps.

Who we are

Obelisk is operated by the developer of the Obelisk Shopify app. For any question about this policy, or to ask for your data to be deleted, write to soporte@getyourobelisk.com. We answer within 30 days.

What we read from your Shopify store

When you install Obelisk you grant it read-only access. It cannot create, edit or delete anything in your store. We request:

• Orders and fulfilments — order number, date, status, items, totals and tracking, so a reply can say where a parcel actually is.
• Customers — name, email address and order history, to match an incoming email to the person who wrote it.
• Products — the description of the items in an order, so a reply can answer questions about what was bought.
• Store policies and languages — your refund, shipping and return policies, so replies follow your own rules and your language.

What we read from your Gmail account

Connecting Gmail is optional and only enables Obelisk to send replies from your address. We request a single Google permission, gmail.send, plus your email address so we can show you which account is connected.

Obelisk cannot read your inbox. It has no permission to list, open, search or delete any message in your Gmail account. Customer emails reach Obelisk only because you set up a forwarding rule that sends copies to your Obelisk address — and only the messages that rule matches.

Obelisk's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and no human reads it except when you ask us to solve a specific problem you report.

What we store

• The forwarded customer emails: sender, subject, body, and the headers that keep a conversation threaded.
• What Obelisk concluded about each one: the type of request, its confidence, the reply it proposed, and the reply that was actually sent.
• Your settings and the rules you teach it, plus your Google token, so it can send on your behalf. That token is encrypted with AES-256-GCM before it is written, and the disk it lives on is encrypted too.

Data is stored on servers in the European Union (Paris). We keep it while your store has Obelisk installed.

Who else sees it

To draft a reply, the text of the customer email and the relevant order details are sent to Anthropic, the provider of the Claude models, which processes them and returns the draft. Anthropic does not use data submitted through its API to train its models.

Email delivery runs through Cloudflare (inbound forwarding) and Google (outbound sending). Hosting is provided by Fly.io.

We never sell your data, and we never share it for advertising.

Deleting your data

Uninstalling Obelisk from your store deletes every case, message, setting and stored Google token belonging to that store. We also honour Shopify's privacy requests automatically: when a customer asks a merchant to delete their data, Shopify notifies us and the emails and cases of that customer are erased.

You can also disconnect Google at any time from Obelisk's settings screen, or revoke it yourself at myaccount.google.com/permissions. Either one deletes the stored token immediately.

Security

Everything travels over TLS. The database sits on an encrypted volume in the European Union, backed up daily with five days of retention, and the Google token that lets Obelisk send on your behalf is encrypted again at the application level before it is stored. Only the developer of Obelisk has access to production, protected by two-factor authentication.

Every access to protected customer data is logged: what was done, on which case or order, and whether it was triggered by the merchant or by Obelisk itself. That log holds no personal data and is kept for 90 days.

If something goes wrong

This is what we do if customer data held by Obelisk is exposed, lost or accessed by someone who should not have it.

1. Contain it, within hours. Whatever is leaking gets shut off first — a key rotated, a token revoked, the affected part of the service stopped — before anything else, including finding out how it happened.
2. Work out what was reached. Which stores, which customers, which fields, and over what window.
3. Tell the merchants affected within 72 hours of becoming aware, by email, in plain language: what happened, what data was involved, what we have done, and what they should do. If we do not know everything yet, we say what we know and follow up.
4. Notify Shopify and the authorities where the rules require it, including supervisory authorities under the GDPR.
5. Fix the cause and write it down. Every incident ends with the change that stops it happening again.

If you think you have found a security problem in Obelisk, write to soporte@getyourobelisk.com with the subject SECURITY. We reply within one working day. Please give us a reasonable window to fix it before making it public, and we will credit you if you want to be credited.

Changes

If this policy changes in a way that affects what we collect or who sees it, we will tell you inside the app before the change takes effect.

Terms of Service

Last updated: 10 September 2026

The service

Obelisk reads the customer emails you forward to it and drafts replies. You choose whether each reply is sent by you after reviewing it, or automatically by Obelisk. Automatic sending is off until you turn it on in the settings screen.

Your responsibility

Obelisk writes drafts; the words that leave your address are yours. Replies are generated by a language model and can be wrong. You are responsible for what is sent from your account, especially if you turn automatic sending on. Obelisk deliberately refuses to answer on its own anything involving money, chargebacks, cancellations or complaints, and hands those to you.

You must have the right to forward the emails you send to Obelisk, and to grant it access to the Shopify store you install it on.

Plans and billing

Billing is handled by Shopify and charged to your Shopify invoice. Each plan includes a monthly number of conversations; conversations beyond that are billed at the per-conversation rate shown on the plans screen. A conversation counts once, the first time Obelisk analyses it — rewriting a reply costs nothing extra.

You can change or cancel your plan at any time from the plans screen or by uninstalling the app. Cancellation stops future charges; we do not refund the period already started.

Availability

We aim to keep Obelisk running continuously, but we do not guarantee uninterrupted service. Obelisk depends on Shopify, Google, Cloudflare and Anthropic, and an outage in any of them can stop it working.

Limits

To the extent permitted by law, our total liability for any claim related to Obelisk is limited to the amount you paid for it in the three months before the claim.

Contact

soporte@getyourobelisk.com