Privacy Policy

Gentoo — operated by Waddle Labs Inc.
Effective date: 2026-10-30

This Privacy Policy explains how Waddle Labs Inc. (“Gentoo”, “we”, “us”) collects, uses, stores, and deletes information when you use the Gentoo application for Shopify and its connectors, including the optional Gmail connector and AI assistant connectors. By connecting an account or using the app, you agree to the practices described here.

1. Who we are

Gentoo is a Shopify application that provides an AI assistant to help merchants operate and grow their store. The app is provided by Waddle Labs Inc., 2261 Market Street, San Francisco, CA 94114. For any privacy question or request, contact us at support@waddlelab.com.

2. Information we collect

2.1 Shopify store data

When you install the app, we access store and merchant information made available through the Shopify Admin API (such as shop profile, products, orders, and customer-journey analytics) solely to provide the app’s features. We only request the Shopify scopes the app needs to function.

2.2 Google account data (Gmail connector)

Connecting the Gmail connector is optional and initiated by you. If you connect it, we request the following Google OAuth scopes and use them strictly as described:

• openid, email, profile — to identify the connected Google account. We store the account’s email address, display name, and Google account identifier so you can see which account is connected.
• https://www.googleapis.com/auth/gmail.readonly — to search and read messages in the connected mailbox only when you explicitly ask the assistant to (for example, “find the email from this customer”) or as part of a routine you have approved. Search returns thread metadata and short snippets; full message content is read only for the specific thread you ask about and is processed transiently to answer that request.
• https://www.googleapis.com/auth/gmail.compose — to create draft replies in your mailbox at your request. The app does not send email on your behalf; you review and send drafts yourself from Gmail.

We do not access your mailbox in the background for any purpose other than the features above, and never without an explicit request or an approved routine.

2.3 AI assistant connectors (Claude, ChatGPT)

Connecting Gentoo to a third-party AI assistant such as Claude or ChatGPT is optional and initiated by you from Settings > Connectors in the app. To connect, you create a one-time store connection key and approve access in a browser window. After that, the assistant can call Gentoo tools on your behalf to read your store’s Goals, Opportunities, Actions, Tools, performance, and credit usage, and, if you granted write access, to take the actions you ask for, such as approving an Action.

• We store only a hash of the connection key, never the key itself, and the access granted to the assistant is tied to your store.
• The results of each tool call are sent to the assistant you connected. How that provider processes, stores, and uses them is governed by your agreement with that provider, not by this policy.
• You can end access at any time by turning off the connector in Settings > Connectors, which revokes its keys immediately, and by removing Gentoo from the assistant’s own connector settings.

3. How we use the information

We use the information described above only to:

• provide and operate the assistant’s features you invoke;
• generate responses, summaries, and draft email replies in direct response to your requests;
• maintain security, prevent abuse, and debug the service;
• comply with legal obligations.

We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized or non-personalized AI/ML models.

4. AI processing and subprocessors

To produce assistant responses and email drafts, the relevant content (including the specific Gmail thread content you ask about) is sent to our AI model provider, Anthropic (Claude), acting as a subprocessor solely to generate the requested output. This data is not used by the provider to train its models. We may also use infrastructure and hosting subprocessors (for example, cloud hosting and key-management services) strictly to operate the service. We require subprocessors to protect data consistent with this policy.

5. Data storage and security

• OAuth tokens (access and refresh tokens) for the Gmail connector are stored encrypted at rest using envelope encryption backed by a managed key-management service. They are used only to call the Google APIs needed for the features above.
• Email message bodies are not persisted. Message content read to answer a request is processed transiently for that request and is redacted from any retained assistant/tool history.
• We store limited connector metadata (connected account email, display name, account id, connection status) to operate and display the connection.
• We apply administrative, technical, and organizational safeguards (encryption in transit and at rest, least-privilege access). Human access to user data is limited to what is necessary for security, to comply with law, or with your consent.

6. Data retention and deletion

You can disconnect the Gmail connector at any time from the app. When you disconnect, we delete the stored OAuth tokens from our secret vault and mark the connection as disconnected. You can also revoke Gentoo’s access directly from your Google Account permissions page. When you uninstall the app, associated store and connector data are deleted or anonymized in accordance with applicable Shopify and legal requirements. To request deletion of your data, contact support@waddlelab.com.

7. Limited Use disclosure (Google API Services User Data Policy)

Gentoo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Google user data obtained through the Gmail scopes is used only to provide or improve the user-facing features described above; is not transferred to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with your consent; is not used or transferred for advertising or any other purpose; and is not used to train generalized AI/ML models. Humans do not read this data unless we have your consent, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and used for internal operations in accordance with applicable privacy and other laws.

8. International users and data transfers

We may process and store information in countries other than where you are located. Where required, we use appropriate safeguards for international data transfers.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal data, and to withdraw consent. To exercise these rights, contact support@waddlelab.com.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version at https://www.gentooai.com/privacy and update the effective date above. Material changes will be communicated as required by law.

11. Contact us

Waddle Labs Inc.
2261 Market Street, San Francisco, CA 94114
support@waddlelab.com