Privacy Policy

Amy exists to send email and SMS people actually consented to. That principle shapes everything here: we collect what the service needs, keep it isolated per store, and honor every opt-out and deletion — automatically, permanently.

Who we are

Hire Amy is operated by MissionCute, LLC, 109 Crowders Creek Rd, Gastonia, NC 28056, United States. Data is stored and processed in the United States (AWS us-east-1).

Who this covers

This policy covers two groups:

• Merchants — the store owners who install Amy. For your account data, Hire Amy is the data controller.
• Shoppers — your customers and subscribers. For their data, Amy acts as a processor on the merchant’s behalf: the merchant decides who is contacted; Amy enforces the consent rules.
• Visitors to hireamy.ai — anyone who reads our website, joins the waitlist or redeems an invite. For this data, Hire Amy is the data controller.

What we collect

From merchants

• Your Shopify store’s domain, the store owner’s name and email, and the OAuth access Shopify grants at install.
• The Shopify permissions (scopes) Amy asks for: read_customers, write_customers, read_orders, read_fulfillments, read_products, read_discounts, write_discounts, read_files, write_files, read_customer_events, write_pixels and write_marketing_events. Each write permission has one job: write_customers writes marketing consent back to Shopify; write_discounts creates discount codes you approve; write_files uploads email images; write_pixels installs Amy’s web pixel; write_marketing_events credits Amy’s traffic in Shopify’s marketing reports.
• Your brand settings — voice, selling points, sending domain, mailing address — because Amy writes and sends as your brand.
• Amy is billed through Shopify App Pricing. Shopify holds your payment details; we never see them.
• What you write to Amy’s Help chat, and the replies.
• If you connect Klaviyo, and only with your permission, the results of your past Klaviyo campaigns, so Amy can learn what worked for your store.

About shoppers (on the merchant’s behalf)

• Contact details: first and last name, email address, phone number, and the Shopify customer id.
• Shipping and billing addresses and their country, from Shopify orders, checkouts and customer records. Shipping emails show where a package is going, and Amy uses these addresses to place a shopper’s country.
• The country Amy derives from a storefront visitor’s IP address.
• Orders and their line items, and the product views, carts and checkouts reported by Amy’s web pixel.
• Contacts imported from Klaviyo, with their consent history.
• Consent records — for every opt-in or opt-out: the exact disclosure shown, its version, the timestamp, source, and the IP address and browser user-agent at signup. These records exist because the law (CAN-SPAM, TCPA, GDPR) requires provable consent, and they are retained as legal evidence.
• The messages sent, with their delivery, open, and click events. Order and browsing events trigger the automations the merchant enabled.

From visitors to hireamy.ai

• What you type into the waitlist or invite forms: your email, your store’s address, which platform it runs on, what you use for email and texting today, and your monthly email and text volume.
• How you found us: the page you signed up from and the campaign tags (UTM parameters) on the link you arrived by.
• Information collected automatically by our website and by the advertising and analytics partners listed below: your IP address, browser and device type, the pages you view, the ad or link you came from, and whether you went on to join the waitlist or install Amy.

Cookies on merchants’ storefronts

On a merchant’s storefront, Amy sets one first-party cookie, amy-onsite-id — a random anonymous identifier (no personal data inside) that lets a signup connect to that browser’s earlier browsing, for up to 180 days. Amy sets no advertising or cross-site tracking cookies on a merchant’s storefront, ever.

Cookies and tags on hireamy.ai

Our own website may use cookies, pixels and similar tags from advertising and analytics partners, such as Google, Meta, Microsoft, LinkedIn, TikTok, Reddit and X. They tell us which ads and links bring people to us and which of them go on to join the waitlist or install Amy, let us show our ads to people who have visited our site (retargeting), and help us find businesses like the ones that already use Amy. These partners may collect information about your visit and combine it with what they know about you from other websites, under their own privacy policies. You can block or delete cookies in your browser, and turn off personalized ads in each partner’s ad settings.

How we use it

• To send the email and SMS the merchant approved, to people who consented — and to refuse to send to anyone who didn’t.
• To draft message copy with AI. Neither merchant nor shopper data is used to train AI models. To draft copy, Amy sends Anthropic your brand settings, product details and campaign results; Anthropic does not train on it. Questions in Amy’s Help chat are answered the same way.
• To report performance to the merchant: deliveries, opens, clicks, and revenue attributed to messages.
• To protect deliverability — bounces and spam complaints permanently suppress an address.
• To market Hire Amy to businesses: to answer waitlist signups and send invites, to measure and improve our advertising, and to show our ads to people who visited our website or joined the waitlist. To do this we may give an advertising partner a hashed (scrambled) copy of a merchant’s or waitlist signup’s email address, so it can match our ads to the right people and tell us which ones worked.

Shopper data is never used for our own advertising. Information Amy holds about a merchant’s customers and subscribers is used only to run that merchant’s email and texts. It is never given to an advertising partner, never used to advertise Hire Amy, and never combined across stores.

We do not sell personal data for money. Some US state privacy laws treat the advertising cookies and audience matching described above as “selling” or “sharing” personal information, even when no money changes hands; you can opt out of that at any time (see Your rights). Apart from that, we share personal data only with the service providers below, and only as needed to run the service.

Service providers

• Amazon Web Services — hosting and storage (United States, us-east-1), with per-store data isolation. Our databases and their backups are encrypted at rest with AWS KMS.
• Shopify — the platform Amy runs inside, and billing.
• Mailgun — email delivery, from the merchant’s own authenticated domain.
• Telnyx — SMS delivery and carrier registration.
• Anthropic — AI drafting of message copy from brand, product and campaign-results context, and answers in the Help chat. Anthropic does not train on it.
• Advertising and analytics partners — on hireamy.ai only, such as Google, Meta, Microsoft, LinkedIn, TikTok, Reddit and X, to measure and target Hire Amy’s own advertising. They never receive shopper data.

How it’s protected

• Every store’s data is isolated at the database layer — one store can never read another’s records.
• Connections to hireamy.ai and the Hire Amy app are encrypted with HTTPS (TLS).
• Store credentials, such as Shopify access tokens and Klaviyo API keys, are encrypted by our application with a separate key for each store (AES-256-GCM) before they're saved, so they are never stored in plaintext.
• We work to keep personal data out of our logs.

How long we keep it

• Message content and recipients are anonymized after 365 days.
• When a store uninstalls Amy, sending stops at once, and the store’s data is erased when Shopify sends its shop redact request 48 hours later.
• A customer’s erasure request is completed within 30 days.
• Consent and suppression records are kept as evidence of permission while the store uses Amy.
• Waitlist and invite details are kept until you install Amy, ask us to delete them, or we close the waitlist. Advertising partners keep what their cookies collect for as long as their own policies say.

Your rights

Merchants and their customers can ask for a copy of their data in a machine-readable format, a correction, or deletion, by emailing help@hireamy.ai. We answer within 30 days.

If you’re a shopper

• Unsubscribe — every marketing email carries a one-click unsubscribe (honored instantly and permanently); reply STOP to any text to end texts, HELP for help.
• Access or deletion — contact the store you subscribed to, or email us; deletion erases your contact record, message content, and identifiers, and leaves a suppression marker so a stale re-import can never make you contactable again.

If you visit hireamy.ai or join the waitlist

• Opt out of targeted advertising and “sale” or “sharing” — email help@hireamy.ai with the subject “Do not sell or share”, or turn on Global Privacy Control in your browser, which we treat as that request for that browser.
• Advertising cookies — where the law requires your consent before advertising cookies are set, including in the European Economic Area and the United Kingdom, we ask for it first. You can also block or delete cookies in your browser.
• Access, correction or deletion of your waitlist details — email us, as above.

If you’re a merchant

• Uninstalling Amy stops all sending and revokes store access immediately. Shopify’s shop redact request, 48 hours later, then erases the store’s data.
• Amy implements Shopify’s mandatory GDPR webhooks — customer data requests, customer erasure, and shop erasure — automatically.

Consent and suppression records may be retained after deletion requests where the law requires proof that consent existed or that an opt-out is being honored.

Contact

Questions or requests: help@hireamy.ai. If we change this policy materially, the date above changes and merchants are notified in the app.