Privacy Policy

Last updated October 21, 2026

1. Who we are

Shop Ops is provided by Ensei, based in Tokyo, Japan (“we”, “us”). Ensei is the data controller for the personal data described in this policy. You can reach us at any time through the contact form below.

2. What this policy covers

This policy covers this website and the Shop Ops application at app.ensei.dev. Shop Ops is a business tool used by the owners of online stores and the staff they invite. It is not a consumer service.

3. Information we collect

Account information

When you sign in with Google we receive your email address, your name and, if set, your profile picture. We keep your email address and display name to identify your account. Access is by invitation: if your email address has not been invited by a store owner, sign-in is refused and nothing is stored.

Connected mailbox data (only with your explicit consent)

A store owner may connect the store's support mailbox. This is a separate step with its own Google consent screen. Once connected, Shop Ops accesses the messages and threads of that mailbox, the drafts it creates there, and the list of verified “Send mail as” addresses. With your separate consent, it may also analyze up to 12 months of past support conversations once (see section 6). Details are in section 4.

Store data

The store owner may also connect business systems such as Shopify and an advertising account. We process order, product and advertising performance data from these systems to provide the service. Order data can include customer names and contact details, which we use only to answer that customer's message or to show the store owner its own orders.

Usage and technical data

Our servers record technical logs (such as IP address, browser type, time and the page requested) to keep the service secure and working. The application uses one strictly necessary session cookie to keep you signed in. We do not use advertising or cross-site tracking cookies.

Contact form

When you contact us we receive your name, email address, optional company name and your message.

4. Google user data

Shop Ops requests these Google permissions:

• openid, email, profile: to sign you in. Requested from every user.
• gmail.modify: to read support messages in the connected mailbox, to create and update reply drafts there, to send a reply when a person approves it, and to list the mailbox's verified “Send mail as” addresses so you can choose which address a reply is sent from. It is also used for a daily check of Sent-folder headers and, only with your consent, a one-time analysis of past support conversations (see section 6). Requested only when an owner connects a mailbox.

A scope-by-scope description is on How we use Google data.

5. How we use information

• To sign you in and check that you have been invited, and to show which person approved which action.
• To sort support email: we read incoming messages in the connected mailbox to decide whether they need a reply and what they are about (for example an order question or a return).
• To draft replies for human approval: we prepare a suggested reply and save it as a draft in the connected mailbox. A person reviews and edits it in Shop Ops.
• To send only on explicit human action: a reply is sent only when a signed-in person presses send, from the From address they chose. Shop Ops never sends email on its own.
• To prepare support templates (with your consent): a one-time analysis of past support conversations produces de-identified question categories, reply templates and FAQ drafts. See section 6.
• To run and secure the service: to troubleshoot problems, prevent abuse and keep an audit record of approvals.
• To answer you when you contact us.

We do not use Google user data for advertising, we do not sell it, and we do not use it to build profiles for any purpose unrelated to the features above.

6. What we store, and what we do not

We store:

• your account: email address, display name, role, and the store you have access to;
• for a connected mailbox: its address, the permissions granted, and the OAuth refresh token, which is encrypted before it is written to our database;
• the mailbox's send-as addresses, display names, default flag and verification status;
• for each support conversation: Gmail message and thread IDs, the category we assigned, its status (waiting, replied, no reply needed), and who approved a reply and when;
• for each reply awaiting approval: an approval record containing a short summary of the incoming message and the draft reply text, kept for up to 30 days.

Full mailbox contents stay in Gmail. We do not copy whole messages or attachments into our database; message content is fetched from Gmail when it is needed to sort a message, draft a reply or show it to you. Draft replies are also saved in the connected mailbox's Drafts folder.

Mailbox history analysis (only with your consent)

When a mailbox is connected, and only if the account owner agrees, Shop Ops may analyze up to 12 months of past support conversations in that mailbox once. The purpose is to derive de-identified question categories, reply templates and FAQ drafts for the store. These derived documents contain no names, addresses, phone numbers or order numbers. They are stored in our systems as private, version-controlled configuration, and we delete them on request. FAQ drafts are published to the store's website only after the account owner explicitly approves each item.

Daily Sent-folder check

Once a day, Shop Ops reads the headers and IDs of messages in the connected mailbox's Sent folder (not their content) to match replies that were sent with the approvals recorded in Shop Ops.

7. AI-assisted drafting

To sort a message and draft a reply, our server (hosted on AWS in Japan) sends the content of that message, and the related order details if any, to Anthropic's Claude API. We use the API under Anthropic's Commercial Terms, under which Anthropic does not use the content to train its models. Message content is sent to the model only to produce a draft, and we do not retain it beyond the approval record described in section 6. The same applies to the one-time mailbox history analysis. We do not use your data to train or improve AI models, ours or anyone else's. Every AI-written draft is reviewed by a person before anything is sent.

8. Sharing and sub-processors

We do not sell, rent or trade personal data or Google user data. We share it only with the service providers below, only as needed to run Shop Ops, and under contracts that require them to protect it:

We may also disclose information if required by law, to protect the rights and safety of users or others, or as part of a merger or acquisition, in which case this policy will continue to apply to the data transferred.

9. Retention

• Account information: while your account is active, and deleted within 30 days after it is closed.
• Refresh tokens: deleted immediately when a mailbox is disconnected, when Google reports the access was revoked, or when the account is closed.
• Thread IDs, categories and reply status: kept while the mailbox is connected, and deleted within 30 days after it is disconnected or the account is closed.
• Approval records (message summary and draft text): up to 30 days.
• Templates, categories and FAQ drafts derived from mailbox history: kept while the account is active, and deleted on request or when the account is closed.
• Server logs: up to 30 days, unless needed longer to investigate a security incident.
• Contact form messages: as long as needed to answer you, and no longer than one year.

10. Security

• All traffic is encrypted in transit with TLS.
• Data is stored on encrypted volumes and encrypted in transit. OAuth refresh tokens are additionally encrypted at the application level with AES-256-GCM using a key kept outside the database, and are decrypted only inside the server process that calls Google.
• Least privilege: we request only the Google permissions listed above; staff and service accounts have only the access they need; invited support staff see only the support inbox.
• Tokens and message content are never written to logs.

No system is perfectly secure. If we learn of a breach that affects your data, we will notify you and the relevant authorities as required by law.

11. Your rights

Depending on where you live, including under Japan's Act on the Protection of Personal Information and, where it applies, the EU and UK GDPR, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to withdraw consent at any time. To make a request, use the contact form below. We will respond within 30 days. You may also complain to your local data protection authority.

12. Revoking Google access

You can remove Shop Ops's access to your Google data at any time:

• In Shop Ops: Settings → Support → Disconnect mailbox. We revoke the token with Google and delete it from our database immediately.
• In your Google Account: open myaccount.google.com/permissions, choose Shop Ops and remove access.

After access is revoked we can no longer read, draft in, or send from that mailbox.

13. Limited Use disclosure

Shop Ops's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• we use Google user data only to provide and improve the user-facing features described in this policy;
• we transfer it to others only as necessary to provide those features, for security, to comply with law, or as part of a merger or acquisition with notice to you;
• we do not use or transfer it for serving ads, including retargeting or personalized ads;
• we do not allow humans to read it unless you give us permission for specific messages, it is necessary for security purposes, it is needed to comply with law, or it is aggregated and anonymized for internal operations;
• we do not use it to develop, improve or train generalized or non-personalized AI or ML models.

14. Where data is processed

Our application and database are hosted in Japan (AWS Tokyo region). To draft replies, message content is sent from our server to Anthropic's Claude API, which processes it in the United States. Other sub-processors listed in section 8 may also process data outside Japan. Where required, we rely on appropriate safeguards for these transfers.

15. Children

Shop Ops is a business tool and is not directed to anyone under 16.

16. Changes to this policy

If we change this policy we will update the date at the top. If a change materially affects how we use Google user data, we will tell signed-in users in the application and ask for consent again where required.

17. Contact

For any question or request about this policy or your data, please use the contact form below.