Privacy Policy

Riggr is a Shopify app operated by Best & Basic Inc.. It connects a merchant’s Shopify store to AI clients (Claude, Codex, ChatGPT, Cursor) through the Model Context Protocol, and to scripts through a REST API. This page explains what we collect, how we use it, and how to reach us if you want it removed.

The short version: Riggr does not warehouse your Shopify catalog, order line items, or customer records. Requests from an AI client or script are proxied live to Shopify and returned without persisting that payload. Riggr does store account credentials and connection state needed to run the service (details below).

Protected customer data (Level 1)

Riggr operates under Shopify Protected Customer Data Level 1. Live Admin GraphQL selections used by active tools do not request customer name, email, phone, or street/postal address. Order and fulfillment responses may include coarse destination region (city / province / country) for ops workflows only. Features that need customer contact fields are not enabled until a future Level 2 approval.

What we collect

• Shopify access token. Issued to Riggr when you authorize the app. Stored encrypted at rest (AES-256-GCM). Used to call Shopify Admin GraphQL on your behalf when your AI client or script asks a question.
• Shop domain. Your *.myshopify.com URL, associated with your Riggr account.
• Email address. Used to sign in via magic link and to send account-related messages (sign-in links, subscription notifications).
• API keys and OAuth tokens you create. Bearer tokens you mint on your Riggr dashboard to authorize AI clients or scripts. Stored hashed; the raw value is shown only at creation time.
• Subscription status. Received from Shopify Billing API / subscription webhooks (active, cancelled, on trial). No payment card or billing address ever reaches Riggr.
• Projects and help progress. Project names/slugs and optional Help Center checklist state on your account.
• In-app support chat. Messages you send in Riggr Support, plus allowlisted account status used to answer (plan and connected AI tool names). Do not paste secrets into chat.

Riggr does not store Shopify order, customer, product, inventory, discount, or return records as a data warehouse. Those are read live from Shopify and returned to the client that asked.

How we use it

• To let you sign in and manage your Riggr account.
• To authenticate requests from your AI clients and forward them to Shopify.
• To enforce subscription state: an active Riggr MCP subscription is required for MCP access. The free plan keeps REST API access with an API key after install.
• To send transactional email (sign-in links, account notices).
• To provide AI-assisted support answers grounded in Riggr Help (via an AI subprocessor listed below). Support chat may include your questions and allowlisted account status.

We do not sell your data. We do not use it to train AI models. We do not share it with third parties except the sub-processors listed below and apps you authorize (see the next section). When you connect an AI client, that client receives the live Shopify responses you request through Riggr; that vendor’s privacy policy then applies.

Integrations you authorize

Some apps you use, such as a shipping or reporting tool, can connect to Riggr to read your store data. An app gets access only after you approve it: either on a Riggr consent page that names the app and lists what it can read, or by starting the connection from that app and approving Riggr’s access on Shopify. It receives the same read-only operations data your AI tools do (orders, fulfillments, products, locations and shipping), never customer names, emails, phone numbers or street addresses. That app’s own privacy policy then applies to what it receives.

You can see every app and API key with access in Riggr inside your Shopify admin and remove it at any time; removal takes effect on its next request. We never share your data with an app you have not approved.

Sub-processors

• Shopify. Source of all merchant data; recipient of every request Riggr forwards.
• Vercel. Application hosting and edge network.
• Neon. Managed Postgres for account state (email, encrypted tokens, API key hashes, subscription status, support chat).
• Twilio SendGrid. Delivery of magic-link sign-in and support notification emails.
• Anthropic. AI-assisted in-app support answers (chat text and allowlisted account status only).
• Pusher, Sentry, Linear. Only when enabled: realtime support chat delivery, error monitoring, and internal support task tracking. When a team member files a support task, Linear receives your email, an account summary, and the support chat transcript.

The current subprocessor list, with vendor legal entities and locations, lives on our Subprocessors page. Cookies used on the site are described in our Cookies Policy.

Retention

When you uninstall Riggr from your Shopify Admin, your access token is cleared immediately. Shopify then sends a shop/redact webhook approximately 48 hours later, at which point we hard-delete the store record, associated API keys and MCP OAuth tokens, projects, help progress, support conversations, and the linked Riggr user account for that shop. To disconnect, uninstall Riggr from Shopify Admin (Settings → Apps and sales channels).

Security

All traffic to and from Riggr is served over TLS 1.2+. Shopify access tokens are encrypted at rest with AES-256-GCM. Access to production systems is limited to the Best & Basic Inc. engineering team and audited.

If we become aware of a security incident that affects your data, we will notify affected merchants without undue delay and no later than 72 hours after becoming aware of the incident, in line with GDPR Article 33.

A Data Processing Agreement (DPA) is available on request. Email support@hiriggr.com.

Your rights

You can access, correct, export, or delete your Riggr account data at any time by emailing support@hiriggr.com. If you are an EU or UK resident, you also have the right to lodge a complaint with your local data protection authority. Riggr responds to Shopify’s GDPR compliance webhooks (customers/data_request, customers/redact, shop/redact) automatically. Because we do not warehouse Shopify customer records, customer data request / redact topics are acknowledged with no stored customer payload to return or erase.

Changes

If we materially change how we handle your data, we’ll update this page and notify active subscribers by email.

Contact

Questions or requests: support@hiriggr.com.

Mailing address:
Best & Basic Inc.
8605 Santa Monica Blvd
#36312
West Hollywood, CA 90069
United States