Data, privacy, and uninstall

ⓘ

Who can use this feature?

Reading data through the APIs requires an API key, which needs the Pro or Plus plan.
The privacy webhooks and the uninstall behavior on this page apply to every plan.

Overview

The Chatty APIs return real personal data: names, email addresses, phone numbers, IP addresses, and the full text of conversations with your shoppers. Anything you copy into your own systems becomes yours to protect, and Chatty has no way to reach into your systems and remove it later.

This page covers what the APIs expose, what Chatty does when Shopify asks for a shopper's data to be removed, and the one step people miss when they uninstall the app.

What the APIs expose

Data	Where it appears	Notes
Name, email address, phone number	GraphQL `Customer`, conversation and contact responses	Present whenever the shopper gave it or Shopify supplies it.
IP address and derived location	GraphQL `Customer` fields `ipAddress` and `ipLocation`	Last seen values, not a history.
Order count and total spent	GraphQL `Customer`	Reflects the orders Chatty has synced.
Message text and attachments	Chat Conversations API	Includes everything the shopper typed, including anything they should not have typed.
Webhook payloads	Every event you subscribe to	The same personal fields, pushed to your server as events happen.

There is no read-only key and no per-field permission. Any key you create can read all of the above for your store, so treat a Chatty API key as you would treat a Shopify admin token. See Authentication.

How long Chatty keeps it

Chatty keeps your conversations and contacts for as long as the app is installed. There is no retention setting and no automatic expiry you can configure, and uninstalling the app does not delete them on its own.

Data leaves Chatty in three ways only: Shopify sends one of the privacy webhooks below, you delete a contact from the app, or you ask support to remove it.

Before you uninstall the app

Uninstalling does not revoke your API keys and does not stop your webhooks.

When you remove Chatty from your store, Chatty marks the store as uninstalled, signs your team out, and disconnects the Klaviyo, Facebook, and email channels. Your API keys stay active and your webhook subscriptions stay enabled. Anyone holding a key can keep reading, and any third-party server you pointed a webhook at keeps receiving events. Delete both before you uninstall.

Delete every webhook subscription

List what you have with GET /chat/webhooks, then delete each one with DELETE /chat/webhooks/{id}. Deleting them from Chatty is the only way to stop delivery — turning off the receiving server just produces failed deliveries, and Chatty keeps retrying.

Delete every API key

Go to Settings → General → Manage keys and remove each key. A deleted key can still work for up to 5 minutes, so do this before you uninstall rather than during.

Check nothing is still calling

Watch your own server logs for a few minutes. If events are still arriving, one subscription was missed. Reinstall is not needed to find it, but you do need a valid key to list subscriptions, so run this check before you delete the last key.

Then uninstall

Remove the app from your Shopify admin.

If you have already uninstalled, contact support to have the keys and subscriptions removed. You cannot do it yourself without access to the app.

Shopify's privacy webhooks

Shopify requires every app to handle three privacy requests. Chatty subscribes to all three and answers each one automatically. You do not configure or trigger them, but you should know what each one changes, because the results show up in your inbox and contact list.

Customer data request

A shopper asks your store for a copy of their data. Chatty receives the request and notifies the Chatty support team. It does not produce a data file automatically. Someone from the team assembles the data by hand, so allow time for it. If a request is urgent, contact support directly rather than waiting.

Customer redact

A shopper asks your store to delete their data. Chatty marks that contact and all of their conversations as Redacted, and deletes the orders Shopify names in the request. The conversation history stays in your inbox under the Redacted label rather than disappearing. If your obligation requires the message text itself to be removed, contact support and say so.

Shop redact

Shopify sends this some time after a store has uninstalled the app. Chatty deletes the files uploaded from your store, including contact imports, logos, avatars, and icons, and removes your team member records.

Delete one shopper's data

Two routes, both outside the API. There is no API endpoint that deletes a contact or a conversation.

Through Shopify. Erase the customer's personal data from your Shopify admin. Shopify sends the customer redact request, and Chatty applies it as described above. This is the route to use for a formal privacy request, because it leaves a record on Shopify's side.
In the Chatty app. Open Contacts, find the person, and delete them there.

If you have already copied that shopper into your own database, CRM, or warehouse through the API, neither route touches your copy. Removing it is on you.

Export all your data

There is no bulk export endpoint. You have two options.

Contacts, by yourself. Export your contact list from Contacts in the app.
Everything else, through support. Contact the Chatty support team from your dashboard and ask for a data export. Say which store, which date range, and which data you need: conversations, contacts, or both. It is assembled manually, so ask early if you have a deadline.

You can also build your own export by paging the Chat Conversations API and the GraphQL Customer API. That gives you a live copy you control, and it is the better answer if you need the data on a schedule rather than once.

Need help?

For a privacy request, a data export, or to have keys and subscriptions removed after an uninstall, contact the Chatty support team from your dashboard. Include your store domain and, for a privacy request, the shopper's email address.

For what each API returns and how to authenticate, see Authentication and Webhooks.

Errors and Rate Limits Overview