Ryea AI Receptionist
Privacy Policy
1. Who we are
This Privacy Policy describes how Arure LLC (“Arure,” “we,” “us”) processes personal data when merchants install and use the Shopify app Ryea AI Receptionist (the “App”). The App gives the merchant a phone number answered by Ryea, an AI receptionist that books, changes and cancels appointments, takes messages and transfers calls, and adds callers to the merchant’s Shopify customers. It supplements our corporate policy at arure.tech/privacy-policy; where they conflict for App data, this page controls.
For Shopify Protected Customer Data purposes, we process customer data only for App functionality (adding callers to the merchant’s customers) and Customer service (the merchant’s call, booking and message records).
2. Roles
The merchant is the controller of its callers’ and customers’ data. Arure acts as a processor on the merchant’s instructions, as set out in the Merchant Data Processing Addendum. Shopify is a separate controller or processor for platform data under its own terms.
3. Personal data we process
| Data | Examples | Purpose |
|---|---|---|
| Merchant and staff | Shop domain and name; Shopify access tokens (encrypted at rest); business name, type, time zone, opening hours and transfer phone number; staff email on Admin sessions | Install, sign-in, billing, and what the receptionist tells callers |
| Callers | Phone number (caller ID), name and email if given, the call’s audio as it happens, a transcript and summary, appointments (date, time, service, notes) and messages left | Answering the call, booking appointments, taking messages, and showing them to the merchant |
| Shopify customers | Name, phone and email of callers, a “ryea” tag and a short note per call or booking | Adding callers to the merchant’s Shopify customers, found by phone or email or newly created |
| Privacy requests | Customer ID, phone and email from Shopify privacy webhooks; data-request exports | Fulfilling customers/data_request, customers/redact and shop/redact |
The App reads no orders. It reads and writes only the customers that match a caller’s phone number or email.
4. Calls and AI
Calls are handled by the Ryea service, operated by Arure. Ryea uses a telephony provider (Twilio) for the phone number and the call, and AI speech and language providers (Google Gemini, and for some features OpenAI and Deepgram) to understand and answer the caller in real time. Call transcripts and summaries, appointments and messages are stored in Google Cloud (Firebase). Voicemails may be recorded where the caller leaves one.
Merchants are responsible for telling callers, where their law requires it, that calls are answered by an AI system and may be transcribed. We do not sell App personal data, use it for advertising, or use it to train AI models for anyone else.
5. Retention
- This App’s call log (caller, event and summary, used for the customer sync and the App’s activity list) is kept while the App is installed.
- Customer erasure: on Shopify’s
customers/redactwe delete that customer’s call records from the App. Shopify customer records are the merchant’s and stay in Shopify. - Customer data requests: exports are kept for 30 days for the merchant to hand over, then cleared.
- Uninstall: on
app/uninstalledwe end all App sessions and pause the receptionist (calls are no longer answered). About 48 hours later Shopify sendsshop/redact: we delete all of the shop’s App data, close its Ryea receptionist and release its phone number. - Backups: the App database is backed up nightly and each backup is kept for 14 days.
6. Security
Admin access requires Shopify authentication. Shopify access tokens and the secret that signs Ryea’s events are encrypted at rest. Webhooks from Shopify and from Ryea are verified by signature. All traffic uses HTTPS.
7. Your rights and merchant controls
Callers and customers should contact the merchant first for access, correction or deletion. Merchants can use Shopify’s privacy request tools (which trigger our webhooks and appear on the App’s Privacy page), contact us, or uninstall the App.
8. Where data is processed
The App and the Ryea call service are hosted with DigitalOcean in the United States; Ryea’s records are stored in Google Cloud and its web services run on Vercel. The App is offered to merchants in the United States. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.
9. Changes
We may update this policy as the App evolves and will change the “Last updated” date when we do.
10. Contact
Privacy questions: privacy@arure.tech. Support: hello@arure.tech.