Flyweight: Using an AI Chatbot for Shopify in Compliance with GDPR & AI Act

Order Processing Agreement, labeling obligation, privacy policy, GDPR, AI Act - what? 🤯🤯

The checklist and privacy policy template below assume you run a Shopify store and want to add a GDPR-compliant AI chatbot. Since Flyweight now also drafts replies to emails and support tickets (Flyweight Copilot) and lets you or your team take over live chats, this guide covers those use cases too. Want the full picture of what our Shopify chatbot can do? Head to the main guide. This article does not constitute legal advice or acknowledgment of a legal obligation.

Terminology

1. General Data Protection Regulation (GDPR)
   The GDPR is the core privacy law in Europe. It sets the rules for how companies handle personal data, like collecting only what’s actually needed and storing it securely. It also gives people rights over their data, including access, correction, and deletion. For chatbots, that means no broad or unnecessary data collection, and clear communication about how data is used.

2. Artificial Intelligence Act (AI Act)
   The AI Act is an EU regulation that sets rules for artificial intelligence. Its requirements apply in stages; Article 50 transparency obligations apply from 2 August 2026. The goal is safer, fairer use of AI systems like chatbots. It groups AI systems by risk level, from low to high. Each category comes with its own requirements, like making it clear that users are interacting with AI and preventing discriminatory outcomes. Chatbots handling sensitive use cases may fall into higher-risk categories and face stricter requirements.

3. Data Processing Agreement (DPA)
   A Data Processing Agreement is a contract between the company using the chatbot and the provider operating it. It defines that the provider processes user data only on the company’s instructions and in line with data protection rules. If you use an external chatbot provider, a DPA is typically needed to document GDPR-compliant processing.

4. Privacy Policy
   A privacy policy explains what data is collected, why it’s collected, and how long it’s stored. It should also explain user rights, like the right to request deletion or access stored data. For chatbot use, this information should be easy to understand and easy to find.

5. Labeling Obligation
   Under Article 50 of the AI Act, people interacting directly with an AI system must generally be informed that they are interacting with AI, unless this is obvious in the circumstances. That’s the labeling obligation. The goal is transparency and fewer misunderstandings.

Roles and Responsibilities

Roles matter because they define who is responsible for what.

Processor

The chatbot provider is usually the processor. That means the provider processes data on behalf of the store operator and based on their instructions. The provider handles the technical setup and operation of the chatbot, but does not decide why the data is being processed. Their job is to follow the controller’s requirements and implement technical and organizational measures to protect personal data. In short, the chatbot provider is contractually bound to process data only as instructed, not for its own independent purposes.

Controller

This is the part that often feels a bit counterintuitive: the store operator is the controller. As the controller, the store decides why and how data is processed, for example, what the chatbot collects and whether it’s used for support, lead generation, or something else. The controller is responsible for making sure data collection and processing meet privacy requirements and that user rights are respected. In practice, that means the store operator defines how the chatbot is used and is responsible for the privacy compliance around that use. It sounds bigger than it is. Usually, it starts with being clear in the privacy policy.

Practical Example

Let’s say the Shopify store "GarlicPress24" wants to use an AI chatbot for lead generation. A customer asks about garlic press specs, and the AI gives expert guidance. During that flow, the chatbot collects the customer’s contact details, like name and email, and forwards them to the expert.

The store has to decide how this should work. Should the lead be collected through AI? Or should the chatbot simply show a message like, “Contact our experts at Email X”? The Shopify store is the controller because it decides what happens and makes sure customers are properly informed in the privacy policy. The AI chatbot provider handles the technical setup and processes the data according to the store’s instructions, which makes the provider the processor.

How to Use an AI Chatbot in Compliance with Data Protection Requirements: A Checklist

If you want to run a chatbot in line with GDPR and the AI Act, the roles above define the responsibilities.

1. Collect Only Necessary Data
   The chatbot should collect only the data that’s actually needed. This is mainly a provider responsibility. At Flyweight, we aim to process only the minimum personal data required. For example, if a customer asks about an order status, we only process postal codes and order numbers, not extra address details or broader order data. Data entered into the chatbot’s dedicated forms is handled separately from the AI model. Free-text messages can still contain personal data, and Copilot processes the open support conversation to draft a reply.

2. Be Transparent
   Users should understand what data the chatbot collects and what it’s used for. The privacy policy is the right place to explain this clearly, especially for Shopify store operators. Since the store is the controller, the policy should be updated so customers are properly informed. A template is included below to help with that.

3. Put a Data Processing Agreement (DPA) in Place
   If the chatbot comes from an external provider, there should be a contract that covers GDPR-compliant data processing. Check whether the provider offers a DPA, often as part of the standard agreement.

4. Review Security and Data Protection Regularly
   The AI Act also points toward regular reviews of AI-related risks, so the chatbot setup stays compliant over time. This is usually handled by the chatbot provider. We keep this guide updated and share relevant changes.

5. Label the Chatbot Clearly
   Users should know they are talking to AI. Article 50 transparency obligations apply from 2 August 2026; see the European Commission guidance. Our AI chatbot includes a default footer that says: “AI powered by Flyweight,” and we recommend keeping it. If you want to be extra careful, you can also mention AI in the welcome message or the chatbot name.

6. Email and Ticket Support with AI (Flyweight Copilot)

   If you or your team use Flyweight Copilot to draft replies to emails or tickets, the same roles apply: you are the controller, Flyweight is your processor under the DPA. Every draft is reviewed and sent by you or a person on your team, so no automated decision is made about the customer's request. What you need to do: add the section from the template below to your privacy policy, make sure only you and the people you authorise have access, and never ask customers for health data or other sensitive information that is not needed to solve the request.

7. Taking Over Live Chats

   When you or a member of your team take over a chat from the AI, the customer should see that a person has joined. This is the flip side of the AI labeling obligation: if you tell customers when they talk to AI, tell them when they talk to a human. Flyweight shows the handover in the chat widget by default. Use first names or team aliases; you decide what is shown.

Do I need consent from customers who email us?

Usually, separate consent is not required simply to answer a routine support email. Depending on the request, processing may be necessary to perform a contract with the customer (Article 6 (1) (b) GDPR) or justified by a documented legitimate-interest assessment for customer support (Article 6 (1) (f) GDPR). The merchant must select the appropriate basis for the actual processing, including AI assistance, and ensure that only necessary data is used. Consent is not a substitute for that assessment, and support should not depend on consent to unrelated processing.

What you do need is transparency: name Flyweight as a processor in your privacy policy (template below) and, if you like, link to it from your email signature or auto-reply.

Special categories need additional care: health data and other special categories require an applicable condition under Article 9 (2) GDPR as well as an Article 6 legal basis. A support contract or legitimate interest alone is not enough. You cannot stop a customer from writing "I need to return this because of my allergy", but you can (1) make sure you, your team and your AI setup never actively ask for such data, (2) add a short note in your privacy policy or auto-reply asking customers not to share health data unless it is needed for their request, and (3) if your store sells health-related products (supplements, medical devices, pharmacy items), talk to your data protection officer about a data protection impact assessment before rolling out AI-assisted support. Flyweight's DPA covers incidental processing of such data and rules out separate evaluation or model training; the DPA does not itself supply the merchant's Article 9 condition. Assess whether the planned processing is likely to create a high risk and therefore requires a data protection impact assessment before rollout.

See the EDPB guidance on legal bases and special categories of data.

⭐️ Privacy Policy Template

As we’ve seen, Shopify stores acting as controllers are mainly responsible for clearly explaining how data is processed.

And the best place for that? Your privacy policy.

💡 If we were the shop operator using the Flyweight AI Chatbot, we’d add the following section to the privacy policy (without acknowledging a legal obligation or providing legal advice):

Adapt the template to the features you actually use, your legal bases and your retention policy.

---

Use of the Chatbot with Forms
We offer you an AI-based chatbot from Flyweight GmbH, Jungbuschstraße 28, 68159 Mannheim, Germany (https://flyweight.io/legal-notice / https://flyweight.io/privacy-statement) on our website to answer your questions. When using the chatbot, your queries are combined using the database created from the website information read from our own website and a large language model to provide you with answers to your query. The chatbot is instructed not to ask for personal data. Good to know: If separate forms appear as a result of your inquiries, in which you may then have to provide personal data based on your inquiry, the information you provide there will be processed separately and accordingly will not be sent to AI.

Processed Data Categories: The data categories result from your inquiries when you enter personal data within your question.

• For example, if you ask: “Where is my order?”, a form will appear in which you can enter your order number and your zip code.

• If, for example, you would like to find out more about a product and receive appropriate advice, a form will appear in which you can enter the relevant information (e.g. name, telephone, e-mail, etc.).

Purpose of Processing: Processing the information you provide to create responses to your requests using the chatbot.

• Example: For example, if you ask: “Where is my order?” and enter your order number and zip code in the form, this information is used to make a direct request to the store system (Shopify) so that the delivery information can be sent and you can be informed about the status of the order.

• Example: If you would like advice on a product, your request (with the data you provide in the form and the entire chat history) will be forwarded to the store operator so that they can contact you.

Data Source: We collect this data directly from you.

Legal Basis: We process data to fulfill contractual or pre-contractual obligations in accordance with Article 6, paragraph 1, point (b) of the General Data Protection Regulation (GDPR).

Data Retention: We retain support data for as long as necessary to resolve your inquiry and for any applicable legal claims or recordkeeping obligations. Statutory retention periods of 6 to 10 years apply only to records subject to those requirements. Flyweight stores conversations on our behalf for the term of our contract and deletes them within 30 days after it ends, in accordance with our data processing agreement.

Location of Recipients: EU and non-EU.

Guarantees for Transfers to Third Countries: EU Standard Contractual Clauses (SCC), Adequacy Decision

AI-Assisted Customer Support (Email and Tickets)

When you contact our customer support by email or through our helpdesk, we use Flyweight Copilot, a tool provided by Flyweight GmbH, Jungbuschstraße 28, 68159 Mannheim, Germany (legal notice / privacy statement), to assist us with customer support. The tool reads your message and, where available, the related order information from our store system, and drafts a suggested reply. Every reply is reviewed and sent by a member of our team. No decision about your request is made automatically. Please do not include health data or other sensitive information in your message unless it is necessary for your request.

Processed Data Categories: The content of your message (subject and text), your name and email address, and order details related to your request (such as order number, order status and order history).

Purpose of Processing: Answering your support request faster and more accurately.

Data Source: We receive this data directly from you and from our store system.

Legal Basis: Article 6 (1) (b) GDPR (performance of a contract or pre-contractual measures) and Article 6 (1) (f) GDPR (our legitimate interest in providing efficient customer support). Flyweight GmbH processes your data on our behalf as a processor under a data processing agreement.

Data Retention: We retain support data for as long as necessary to resolve your request and for any applicable legal claims or recordkeeping obligations. Statutory retention periods of 6 to 10 years apply only to records subject to those requirements, not automatically to every support message. Flyweight stores conversations on our behalf for the term of our contract and deletes them within 30 days after it ends, in accordance with our data processing agreement.

Location of Recipients: EU and non-EU.

Guarantees for Transfers to Third Countries: EU Standard Contractual Clauses (SCC), Adequacy Decision.

Live Chat with Our Team

A member of our team may join a chatbot conversation and continue it personally. You will see in the chat when this happens. The conversation, including any information you provided in the chat, is then available to our team so that we can help you with your request.

Legal Basis: Article 6 (1) (b) GDPR (performance of a contract or pre-contractual measures). Flyweight GmbH provides the chat infrastructure as our processor.

Data Retention: As stated above for the chatbot.

---

Install the privacy-compliant chatbot for European Shopify stores ✌️