Last updated 14 October 2026
Privacy
Dana is an assistant that a merchant installs on their Shopify or WooCommerce store. This describes what it collects when a shopper talks to it, what it records about the merchant’s own team, who that information is shared with, and how long it is kept.
Who is responsible for what
The merchant whose store you are shopping on is the controller of your data. Dana is their processor: we hold and process shopper information on their instructions and for no purpose of our own. We do not sell it, we do not use it for advertising, and we do not use conversations from one store to train anything for another.
What Dana collects when you use the chat
- What you type, and what Dana replies. The whole conversation is stored so the merchant can read it, so a member of their team can pick it up, and so the assistant can remember what you said a moment ago.
- Your email address, if you give it. Only when you enter it yourself — to claim a discount, to be emailed about an order, or to be replied to after you have left the page.
- Your Shopify customer ID, if you are signed in to the store. It comes from Shopify, not from the page, and it lets the merchant connect the conversation to your account.
- Your order number and email, if you ask about an order. They are used to look the order up and nothing else. On a WooCommerce store the lookup is made to the store itself, and only the order’s status, item count, total, tracking and shipping city, region and country come back — never a street address, a name or a phone number.
- On WooCommerce stores, an anonymous session cookie (
dana_sid), set only if you have allowed analytics. It lets a purchase be linked to the conversation that led to it. - Which pages you looked at during the visit. These records carry no IP address, no user agent, no email and no device fingerprint — an anonymous session identifier and nothing else.
- Your cart, and any order that follows. If a conversation leads to a purchase, the order is linked back to it so the merchant can tell whether the assistant is worth what it costs them.
What Dana does not collect
Payment details never reach it — checkout happens on the store and the assistant is not part of it. It does not read your email, it is not given your password, and it cannot see anything on your device outside the store page it is embedded in.
If you work on a store that uses Dana
When someone on a merchant’s team opens the Dana app inside Shopify, Dana records who they are and where they connected from: the name and email Shopify holds for their staff account, the IP address of that request, and the approximate location it resolves to (country, region and city). The location is looked up on our own server; the address is not sent to anyone else. It is used to show the merchant, and us, who installed and operates Dana on the store, and to notice installs made by people who do not run it. It is deleted with the rest of the store’s data when the store uninstalls Dana and Shopify asks for that data to be removed.
On WooCommerce, the store’s team opens the Dana dashboard from their WordPress admin. That sign-in records no IP address and no location.
Who else sees it
Only the services Dana needs to work. Each one receives the least it can be given to do its job.
- Us, when something is not working. We may open a conversation to investigate a fault or to answer a merchant’s support request.
- An AI language model provider — the model that writes the replies. Your messages, and the product information needed to answer them, are sent to its API. This is the only kind of third party that sees the text of a conversation. Whichever provider is in use, it is under contract not to train its models on what is sent, and it is sent the conversation and the products only — never your email, your name or your payment details. If you want to know which provider is in use today, ask us at the address below and we will tell you.
- A vector search provider — search over the merchant’s product catalogue. It holds product information, not conversations. Each store’s catalogue is kept separate from every other store’s.
- Amazon Web Services — hosting and the database, in the US East (N. Virginia) region.
- Shopify or WooCommerce — where the store, its catalogue and its orders already live. On a WooCommerce store, Dana calls the store’s own site to look up an order or to create a single-use discount code, and nothing else.
If the merchant has connected Dana to their own email or helpdesk tools — Klaviyo, for instance — information also goes there, at their instruction and under their own privacy policy.
How long it is kept
The merchant chooses, up to a limit set by their plan: 7 days on the free tier, 30 days on Starter, 90 on Growth, and up to a year on Pro. Conversations past that window are deleted automatically. A merchant can also purge their store’s conversation history at any time, and uninstalling the app begins deletion of everything belonging to that store. On WooCommerce, disconnecting the plugin stops anything new being sent at once; what is already held is deleted on the same schedule, or straight away if the merchant asks us.
Your rights
Ask the merchant. They can export everything Dana holds about you or delete it, from inside their Shopify admin, and Shopify passes those requests to us automatically — Dana implements Shopify’s data-request, customer-deletion and store-deletion webhooks. On WooCommerce, the merchant asks us by email and we do the same. Depending on where you live you may also have the right to access, correct, delete or port your data, or to object to its processing; those rights are exercised against the merchant as the controller.
If you cannot reach the merchant, or want to raise something with us directly, write to support@dana.gettanabana.com.
Children
Dana is not intended for children, and it is not designed to collect information from them.
Changes
If what Dana collects, or the kinds of service it is shared with, changes, this page changes with it and the date at the top moves. Material changes are told to merchants directly rather than left here to be discovered. Replacing one supplier with another of the same kind — a different model provider, say — does not change what is collected or what that supplier is permitted to do with it, and so does not change this page; ask us and we will tell you who it currently is.