Privacy Policy

1. Introduction & Scope

This Privacy Policy describes how Nova Interactive Video Chatbot (“Nova”, “we”, “us”, or “our”), developed and operated by Unscripted Digital (https://unscripted.digital), collects, uses, processes, retains, and protects personal and technical data in connection with our Shopify application and associated storefront theme extensions.

This Policy applies to:

• Merchants: Business entities and authorized individuals who install, configure, and administer Nova within their Shopify admin console.
• Shoppers / Storefront Visitors: Consumers who navigate merchants’ online stores and interact with Nova’s video player bubbles, choice branches, and product actions.

By installing or interacting with Nova, you acknowledge and agree to the data collection and processing practices described in this Policy.

2. Relationship of the Parties (Controller vs. Processor)

Under applicable data protection legislation, including the European General Data Protection Regulation (GDPR) and the UK Data Protection Act:

• The Merchant is the Data Controller: The merchant determines the purpose and means of processing storefront shopper data, deciding which videos to display, which product catalogs to link, and which customer regions to engage.
• Unscripted Digital is the Data Processor: Nova processes customer engagement signals, delivers video streams, and triggers cart additions strictly on behalf of and according to the instructions of the merchant.

3. Information We Collect & Process

3.1 Merchant Data

When a merchant installs Nova from the Shopify App Store, we collect information granted via OAuth scopes:

• Store Identification: Permanent Shopify domain (e.g. store.myshopify.com), primary account email address, store owner name, store language, and country code.
• Video Assets & Flow Structures: Uploaded video clips, branching dialogue nodes, choice button text, target product IDs/variant IDs, custom thumbnail images, and audio settings.
• Design & Styling Configurations: Custom color palettes, avatar graphics, widget placement coordinates, border radiuses, auto-delay timers, and localized language configurations.
• Subscription & Billing Records: Current subscription plan (Free, Growth, Scale), billing cycle timestamps, and charge confirmation IDs verified through Shopify’s Billing API. Nova does not hold or store financial payment credentials.

3.2 Storefront Shopper (End-User) Data

When shoppers load a storefront with Nova activated, we collect anonymous and pseudonymous interaction data:

• Engagement & Video Telemetry: Video play events, playback progress checkpoints (25%, 50%, 75%, 100%), replay actions, choice option buttons tapped, and branching tree paths traversed.
• Conversion Actions: Product additions initiated via the video widget’s 1-click “Add to Cart” integration with Shopify’s Ajax Cart API.
• Technical Device & Locale Headers: Browser language header (used strictly to serve matching video audio/subtitles for multilingual setups), device viewport category (mobile vs. desktop), and user-agent string for layout responsiveness.

4. Legal Bases for Processing (GDPR Article 6)

We process data under the following lawful legal bases:

• Contractual Performance: Processing merchant data is necessary to provide the Nova platform, save video trees, and deliver interactive experiences pursuant to our merchant terms.
• Legitimate Interests: Processing anonymous shopper telemetry to measure video performance, maintain platform stability, prevent malicious traffic, and optimize CDN delivery.
• Compliance with Legal Obligations: Processing data required to fulfill mandatory statutory requirements, accounting regulations, and Shopify developer platform agreements.

5. Purpose of Data Processing

We use collected data strictly for the following operational purposes:

• To stream responsive, low-latency video flows to shoppers across desktop and mobile devices.
• To execute branching logic paths and trigger Shopify’s Cart API for seamless item checkout additions.
• To calculate and present merchants with aggregated conversion funnel metrics (impressions, completion rates, choice clicks).
• To automatically deliver localized video subtitles and flows based on shopper browser locale headers.
• To provide merchant technical support, debug flow connection issues, and maintain version history backups.
• To enforce subscription plan quotas and feature limits.

6. Cookies & Client-Side Storage

Nova utilizes modern browser sessionStorage and localStorage strictly for widget state management during a shopper’s visit. We do not use persistent advertising trackers, fingerprinting scripts, or cross-site marketing cookies.

• Widget State: Remembers whether the shopper minimized or expanded the video player during their active session.
• Playback Preferences: Preserves user sound/mute toggle state so videos don’t auto-unmute unexpectedly.
• Branch Continuity: Remembers the active node within a branching path if the customer navigates between store collection pages.

7. Sub-Processors & Infrastructure

Nova engages enterprise third-party sub-processors adhering to stringent security standards (SOC 2 Type II, ISO 27001):

• Shopify Inc. (Canada/USA): Platform provider for merchant OAuth, Theme App Extension delivery, API webhooks, and billing infrastructure.
• Cloud Dedicated Hosting (European Union): Dedicated server facilities located in Germany and Finland providing isolated database storage, API routing, and backend compute.
• Edge Content Delivery Network (Global): Geographically distributed edge caching servers utilized to cache public video clips and frontend widget assets with millisecond latency.

8. Mandatory Shopify Privacy Webhooks (GDPR & CCPA)

Nova maintains automated webhook listeners compliant with Shopify’s mandatory privacy framework:

• Customer Data Request (customers/data_request): When a shopper requests a copy of their data via Shopify, our system automatically compiles any interaction records associated with that customer and returns them to Shopify.
• Customer Data Erasure (customers/redact): When a customer exercises their right to erasure, our systems permanently purge all interaction records and event identifiers for that customer.
• Shop Data Erasure (shop/redact): 48 hours following a merchant uninstalling Nova, our automated lifecycle service permanently purges all merchant database records, video configurations, version releases, and uploaded assets.

9. Data Retention Schedule

• Active Subscriptions: Merchant flow configurations, styling settings, and video files are retained for the lifetime of the active store subscription.
• Aggregated Analytics: Video play counts and drop-off summaries are retained in aggregated, anonymous format for merchant dashboard historical reporting.
• Uninstalled Apps: All merchant data is scheduled for permanent purge 48 hours following app uninstallation in accordance with Shopify platform requirements.

10. Technical & Organizational Security Measures

We enforce rigorous technical safeguards to protect data from unauthorized access, loss, or alteration:

• Encryption in Transit: All communications between storefronts, merchant dashboards, and server APIs use Transport Layer Security (TLS 1.3 / HTTPS).
• Encryption at Rest: Database volumes and video backups are encrypted using AES-256 standard encryption.
• Access Restrictions: Production database access is limited strictly to automated application services via authenticated secure channels; direct human access is audited and restricted.

11. Your Data Protection Rights

Depending on your jurisdiction (including the EU, UK, and California), you possess specific rights:

• The right to access and receive a copy of your personal data.
• The right to rectify inaccurate or incomplete data.
• The right to request erasure (“right to be forgotten”).
• The right to restrict or object to the processing of your data.
• The right to data portability in a machine-readable format.
• The right to lodge a complaint with your local Data Protection Supervisory Authority.

12. Contact Information & Data Inquiries

For questions, formal inquiries, or to exercise your statutory privacy rights regarding Nova Video Chatbot, please contact our dedicated engineering and privacy team: