Last updated: 27 September 2026
In short. Aidunn is a working tool for online stores. To do its job it reads the store's product catalog, and, if the store turns it on, also orders, customers, customer service email and chat conversations from the storefront. All of it belongs to the store. We do not own it, we do not sell it, and we do not use it to train AI models.
The service runs on servers in the United States, and several of our providers are American companies. That is described below, together with a complete list of everyone who processes data on our behalf.
Aidunn is provided by Heimegut AS, company registration number 918 917 950, a Norwegian limited company. The application is hosted at app.aidunn.com.
Privacy questions go to bjarne@heimegut.com.
Which role we hold depends on which data is involved, and it determines who decides how the data is used.
For information about you as an Aidunn user, meaning your name, email address, role and sign-in history, Heimegut AS is the data controller. We decide why and how it is processed.
For everything we retrieve from your online store, meaning products, orders, customers, email and chat, the store is the controller and Heimegut AS is the processor. We process that data only on the store's instructions, governed by a data processing agreement. See section 10.
Titles, descriptions, prices, images, variants, metafields, inventory, vendor and categories. This is normally not personal data.
When the store enables the orders, customers, sales reports or CRM modules, we retrieve order and customer data from the commerce platform. That includes the customer's name, email address, phone number, shipping and billing address, order lines, amounts and order status.
We never retrieve card numbers or other payment details. Those stay with the store's payment provider and are not available to us.
Stores using the Inbox module connect their own Google account to Aidunn. We then read the contents of the customer service inbox, meaning messages, senders, attachments and labels, and can send replies on the store's behalf. That email normally contains personal data about the store's customers.
The connection is optional and is created by the store itself. It can be revoked at any time at myaccount.google.com/permissions.
Stores using the chat module have conversations between their visitors and Aidunn stored. A conversation may contain whatever the visitor writes, for example a name, email address, order number or uploaded images.
If the store connects Google Search Console, Google Ads or Google Analytics, we retrieve page-level statistics, meaning impressions, clicks, click-through rate and position. The Search Console access we request is read-only, and we cannot change anything in Search Console or in the storefront through it.
We use no tracking pixels, no advertising networks and no visitor analytics on app.aidunn.com.
Aidunn's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In practice that means data we retrieve from Gmail, Search Console, Google Ads and Google Analytics is used only to deliver the features the store has itself enabled. It is not sold, not used for advertising, and not used to train generalized AI models.
Aidunn uses language models to suggest text, analyse the catalog, answer in chat and draft customer service replies. That means the content being processed, in some cases including email content and chat conversations, is sent to the AI providers listed in section 7.
Those providers process the data on our behalf and do not use it to train their models, under the terms that apply to business use of their APIs.
All AI-generated content is presented as a suggestion. Nothing is published to the store without a human approving it.
These process data on our behalf so the service can work. The list is accurate as of the date at the top of this page.
| Provider | What they do for us | Established in |
|---|---|---|
| Railway | Hosting of the application and the database | USA |
| Cloudflare (R2) | Daily encrypted database backup | USA |
| Anthropic (Claude) | AI text, catalog assessment, chat replies and email drafts | USA |
| OpenAI | Text embeddings for semantic search in CRM | USA |
| fal.ai | Image processing | USA |
| SerpAPI | Google Shopping lookups for price comparison | USA |
| Resend | Delivery of transactional email | USA |
| Gmail, Search Console, Ads and Analytics, only when the store connects them | USA | |
| Profrakt (EDI Soft) | Shipping labels, only for stores that use it | Norway |
The commerce platform the store has chosen, for example Shopify, Mystore or Centra, is the store's own provider and not our sub-processor. We connect to it using access the store has explicitly granted.
Stores with a data processing agreement are notified before we add a new sub-processor, and may object to the change.
The application and the database run on Railway in the us-west2 region, meaning in the United States. Backups are stored with Cloudflare R2. Several of the providers in section 7 are American, so personal data is transferred outside the EEA.
Transfers rely on the European Commission's Standard Contractual Clauses, and for providers certified under the EU-US Data Privacy Framework on that framework.
We are able to move the service to a European region. Stores that require data to stay within the EEA should contact us so we can settle it before signing.
Where we process personal data on behalf of a store, we enter into a data processing agreement under GDPR article 28. It covers purpose, duration, security measures, use of sub-processors, assistance with data subject requests, breach notification and deletion at the end of the agreement. Request it from bjarne@heimegut.com.
You have the right to access your own data, to have errors corrected, to have data erased, to receive it in a machine-readable format, to restrict processing and to object to it.
If the request concerns data we process on behalf of a store, contact that store, which is the controller. We assist them in responding.
You may lodge a complaint with the Norwegian Data Protection Authority if you believe the processing breaches the rules.
If we change this policy materially, we notify stores by email before the change takes effect. The date at the top shows when the text was last updated.
Heimegut AS, bjarne@heimegut.com.