Account data: your email, store name, and what you bought (via Whop).
Connected services: API keys for Gorgias, Shopify, WooCommerce, Slack, and Google Sheets. Stored encrypted (AES-256-GCM). Used only to do the work you asked for.
Tickets: when Bobble works a ticket we read the conversation and relevant order details, and we keep a log entry: ticket number, customer email, subject, what Bobble decided, the reply text, time spent.
Rules and store facts: the instructions you give Bobble.
Who sees it
Anthropic processes ticket text to generate replies. Per their commercial terms they don't train on it.
Cloudflare hosts the service and database (US).
Whop handles payments. We never see your card.
Resend delivers our emails to you.
Bobble staff can see your rules, work log, and ticket drafts to support you. We cannot read your stored API keys.
What we don't do
We don't sell data. We don't use your customers' data for anything except answering their tickets. We don't train models on your tickets.
Retention and deletion
Work logs are kept while your account exists. Delete your account (ask us at hello@hirebobble.com or from your desk) and everything, including encrypted keys and logs, is deleted within 7 days. Disconnecting a service deletes its key immediately.
Your customers
If you're a customer of a store that uses Bobble and want to know what was processed, contact that store; they control the data. We act as their processor.