Noemion — Privacy Policy

Last updated: 9 October 2026

1. Who we are

Noemion is an AI customer-service assistant for Shopify stores. It is provided by NOT SO COMMON LTD, trading as The Tryon Company ("we", "us"), a company registered in England and Wales under company number 17504170, with its registered office at Office 21814, 182-184 High Street North, East Ham, London, E6 2JA, United Kingdom.

For any question about this policy, or to use your rights: support@thetryoncompany.com.

2. Our two roles

• Shopper data (people who chat with a store that uses Noemion): the store is the controller and we are its processor. We act on the store's instructions under our Data Processing Agreement, apart from the purposes we name as our own in §3. If you are a shopper, the store you contacted decides what happens to your conversation, and your requests go to the store first (§10).
• Merchant and staff data (the merchant, and the store's staff who use Noemion): we are the controller (§6).

Replies and notes the store's staff write in a conversation are part of that conversation, and are shopper data.

3. What we process about shoppers, and why

Talk to a person. When you send a "talk to a person" request, your name and email address are also added to the store's Shopify customer list, tagged "Noemion chat", with no marketing consent. The email you type only to check an order is not added.

Lawful basis. For shopper data the store, as controller, decides the lawful basis, typically the performance of its contract with you or its legitimate interest in answering customer enquiries. We use shopper data as a controller for our own purposes only to protect the service from abuse, to bill stores, to diagnose faults and measure running costs, to check from counts and outcomes (never from message content) that the service works as intended, and to meet our legal obligations, including keeping proof that a privacy request was carried out. For these we rely on our legitimate interests, or on the legal obligation itself. We never use shopper data for advertising or to train or improve an AI model.

4. The assistant is an AI

The assistant's replies are generated by an AI model, not written by a person. Every chat begins with the notice "You're chatting with an AI assistant. Ask anytime to talk to a person."

5. What your browser stores

The chat stores the items below in your browser. It uses no cookies. All of them are strictly necessary for the chat to work, and none is used for advertising, analytics or tracking.

6. What we process about merchants and staff, and why

Your display name is shown to your teammates and to the shoppers you help, is included in the store's conversations API, and is added to the store's Shopify order timeline when you cancel or edit an order. The staff workspace uses a strictly necessary sign-in cookie, and keeps your preferences, recent searches, unsent replies and a key that stops a refund being issued twice in your browser's storage.

You are not legally required to give us any of this data, but we cannot provide the service, or a feature you choose to use, without the data it needs.

7. Who else processes the data

We disclose personal data only to the store a shopper contacted, to the providers below, where the law requires it, to protect people's safety or our legal rights, to our professional advisers, or to a buyer of our business who continues to protect it as this policy describes.

Neither AI provider may train AI models on the data. OpenAI may keep requests and responses for up to 30 days to detect abuse; the backup is used only under zero data retention. The first five providers are the subprocessors listed in our Data Processing Agreement.

If a store connects its own Google or Microsoft mailbox, replies are sent through it under the store's own agreement with that provider.

8. International transfers

We are in the UK, and our hosting and analytics are in the European Union; transfers between the UK and the EEA or Switzerland rely on adequacy. For providers in the United States we rely on the EU–US Data Privacy Framework and its UK Extension where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses in each provider's data processing terms, with the UK Addendum where those terms provide it. You can ask us for a copy of these safeguards at the address in §1.

9. How long we keep data

Unless a row says otherwise, retention is applied automatically. We may keep specific data longer where the law requires it or to establish, exercise or defend a legal claim.

The name and email a "talk to a person" request adds to the store's Shopify customer list are the store's own record, and we do not delete them.

10. Your rights

Data protection law gives you the right to access your personal data, to have it corrected or erased, to restrict its use, to data portability, and to object to processing based on legitimate interests.

Your right to object. Where we rely on legitimate interests, you can object at any time, and we will stop unless we have compelling legitimate grounds or need the data for a legal claim.

• Shoppers: contact the store you chatted with, which is the controller. If you contact us instead, we will pass your request to the store and help it respond.
• Merchants and staff: contact us at support@thetryoncompany.com. We respond within one month, and may need to confirm your identity first.

Erasure of shopper data. When a shopper's erasure request reaches us through Shopify, we delete their conversations' messages, staff messages included. We keep:

• each conversation's record (timestamps, counts, the store's tags and assignment), no longer linked to the shopper's browser, until its 12-month limit;
• the conversation's ratings, no longer linked to the shopper's browser, until the store's data is erased (§9);
• the store's records of staff activity on the shopper's orders, with the order numbers removed;
• the order number in two cases: a refund still in progress, until that refund record is deleted (§9); and a support-access record of an order that is neither linked to one of the shopper's conversations nor named in a refund or order-change record we still hold (an order change's record goes with its conversation at 12 months), until that record's 24-month limit;
• the record that the request was carried out.

We find a shopper's conversations by the email address linked to them through an email, a "talk to a person" request or an order check. A conversation in which an address was only typed is not found, and is deleted at 12 months.

Complaints. You can complain to us at the address above, and to the UK Information Commissioner's Office (ico.org.uk), or in the EU to the data protection authority where you live or work.

11. Security

Each store's data is kept separate, data is encrypted in transit and Shopify and mailbox credentials at rest, access is limited by role, and staff views of shopper conversations and orders are logged.

12. Changes to this policy

We post changes on this page and update the "Last updated" date. Before a material change takes effect, we tell merchants in the app or by email.