Counterhand · Privacy · Terms
Counterhand Privacy Policy
Last updated November 5, 2026
Counterhand ("the App") is operated by Rune Works LLC ("we", "us"). The App provides an AI store manager to Shopify merchants that answers customer questions about orders by email, text message, phone and social-media direct messages. This policy explains what information we collect when you install the App, how we use it, and how it is shared.
Information we collect from merchants
When you install the App we access your store through the Shopify API with the permissions you grant at install: orders (including cancellations and refunds), fulfillments, customers, products, discounts, store credit and shipping settings. We store your shop domain, store name, owner email, time zone, and the policies and settings you enter in the App. We store the credentials of any communication channel you connect (for example an email forwarding address, a phone number we provision for you, or a Facebook Page token), encrypted at rest.
Information we process about your customers
To answer a customer's question we read the order they ask about (items, status, tracking, refunds), and the customer's name, email address and phone number as needed to verify them and reply. We store the conversation (the customer's messages and the replies sent) so you can review it in the App. We do not read customer payment card details; Shopify never exposes those to apps.
How we use it
- To look up the order a customer asks about and decide, under the policies you configured, what the store can offer.
- To draft and, when you enable automatic mode, send replies on your behalf.
- To notify you (the merchant) when a case needs a human decision.
- To meter usage against your plan.
We do not sell personal information and we do not use merchant or customer data to advertise to anyone.
Artificial intelligence
Drafting replies uses large language models provided by Anthropic, PBC, reached through Vercel's AI Gateway. Order details and the conversation text are sent to the model to produce a reply. Customer email addresses and phone numbers are masked before they reach the model. These providers process the data to return a response and are contractually prohibited from training on it.
Subprocessors
| Provider | Purpose |
|---|---|
| Vercel Inc. | Hosting, database (Prisma Postgres), AI Gateway |
| Anthropic, PBC | Language model that drafts replies |
| Resend, Inc. | Sending and receiving email |
| Twilio Inc. | Text messages and phone numbers |
| Retell AI | Voice assistant for phone calls (if you enable Phone) |
| Meta Platforms, Inc. | Facebook Messenger and Instagram direct messages (if you enable Social DMs) |
| Shopify Inc. | Store data, billing |
Retention and deletion
Conversations are retained while the App is installed. When you uninstall, channel connections are paused immediately and all your data is deleted within 48 hours of Shopify's shop/redact request. When Shopify sends a customers/redact request for one of your customers we delete that customer's contact details and the content of their conversations. When Shopify sends a customers/data_request we record the request so you can export that customer's conversations from the App.
Security
Data is transmitted over TLS and stored in an encrypted database. Channel secrets are encrypted with a key held only by the App. Every inbound webhook from Shopify, Twilio, Resend, Retell and Meta is signature-verified before it is processed. Refunds, cancellations and store credit are performed only when the policies you configured allow them, only for a customer the App has verified as the order's buyer, and only through the App's own audited, idempotent Shopify calls (an action can never run twice for the same order). You choose in Settings whether those approved actions run automatically or only when a member of your staff approves the draft; anything outside your policies is never performed — it is sent to the owner to decide.
Your rights
Merchants can export or delete their data at any time by contacting us. Customers should direct requests to the merchant they purchased from, who can relay them to us. If you are in the EU/EEA, the UK or California you have rights of access, correction, deletion and portability; we honour them through the merchant.
Contact
Rune Works LLC, Sand Springs, Oklahoma, USA · support@counterhand.io