Last updated: November 1, 2026
1. Who is responsible
Rabbit (rabbitimport.com and the Rabbit app for Shopify) is published by BLACKCUT CONSULTING FZE LLC, a free zone company registered under No. 3359 with the Free Zones Authority of Ajman (Ajman Media City Free Zone), Premises BLA-BR3-1135, AMC - Boulevard-A Building, Ajman Media City, United Arab Emirates (“Rabbit”, “we”).
Contact for any question about your data: support@rabbitimport.com.
We apply United Arab Emirates Federal Law No. 45 of 2021 on the protection of personal data and, for people located in the European Economic Area, Regulation (EU) 2016/679 (GDPR).
2. Two different situations
- You use Rabbit (website, app, account): we are the controller of your data.
- You are a buyer in a Shopify store that uses the Rabbit app: the controller of your data is the store where you bought. Rabbit processes it only on that store’s behalf, to have your order prepared and delivered (see §6).
3. The data we process
Your account: email address, name, password (stored only in irreversibly encrypted form), language, chosen plan, acceptance of the terms and its date. If you use Rabbit without an account, we create an anonymous guest account; your IP address is not stored in it, only an irreversible fingerprint of it.
Your conversations with Rabbit: the messages you write, the replies shown, the product photos you send, the products viewed and the prices shown.
Your orders: products ordered, amounts, status, tracking, and the shipping address you provide (recipient’s name, address and phone number).
Your payments: your card payments are processed by Stripe. We never receive your full card number: we keep only the card brand, the last four digits, the expiration date, the Stripe identifier and, when you authorize charges for your sales, the IP address of that authorization.
Your store (if you connect it): your store’s address, the email of your Shopify account when Shopify has verified it, and the products you send to it. The access keys to your store, to AliExpress and to marketplaces are stored encrypted.
Sign-in and security: sign-in history (date, IP address, browser type), temporary sign-in codes and links.
Operations: a technical log (pages called, errors, durations, internal account number, with no IP address and no conversation content), deleted after 14 days.
4. Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide the service: search for a product, calculate a cost, place and track an order, send a product to your store | Performance of the contract |
| Collect payments, invoice, keep our accounts | Performance of the contract; legal obligation |
| Write to you about your account and your orders | Performance of the contract |
| Send you tips and reminders (you can unsubscribe from any email) | Legitimate interest |
| Secure the service, prevent fraud and abuse, enforce our rights | Legitimate interest |
| Monitor that the platform works properly | Legitimate interest |
We don’t sell or rent your data. We don’t use your data for targeted advertising.
5. Who receives it
Only the data needed for each task is shared, and only with:
- Stripe: card payments (email, name, customer identifier).
- Shopify: if you connect your store, to send your products to it and read your sales.
- Our artificial intelligence providers: your messages and photos, to understand your request, recognize a product and write the replies.
- Our image search providers: a product’s photo, to find that product online.
- The purchasing platforms (1688, AliExpress) and our purchasing agent in China: to place your order, the recipient’s name, phone number and address, and the products ordered.
- Carriers and tracking services: the tracking number.
- Our hosting provider (Hostinger, servers in France) and our email delivery service.
- Our team, which receives internal alerts (for example, a new account or a declined payment).
- The authorities, when the law requires us to.
Rabbit in Claude or ChatGPT. If you link your Rabbit account to Claude (Anthropic) or ChatGPT (OpenAI), the assistant receives, when it uses Rabbit at your request: your name, your email address and your plan; the products you search for or view and their quotes; your orders, their tracking, the warehouse photos and your invoices; the products in your store and your sales, with no data about your buyers; the warehouse address. What the assistant then does with this data is governed by the privacy policy of Anthropic or OpenAI.
For this link, Rabbit keeps an access key specific to the assistant, valid for one hour and renewable for 30 days, the references of the products viewed from the assistant, and the photos you drop off through the upload link, which are deleted after two hours. If you delete your account, all of this is deleted with it. You can cut off access at any time from your Rabbit account (My account, then Claude, then “Cut off access”): the keys are then revoked.
6. Data of buyers in Shopify stores
When a store that uses the Rabbit app receives a paid order, Rabbit reads from Shopify the products ordered and the shipping address: name, address, postal code, city, country, phone number. Rabbit does not ask for the buyer’s email.
This data is used only to order the products and have them delivered. It is passed to the purchasing platform or the purchasing agent that ships the parcel (§5). It is never used for any other purpose.
It is stored encrypted. Apart from being sent for delivery, only Rabbit administrators can read it, and every read is logged: who, when, and for what reason. The log of our exchanges with the purchasing agent does not keep it.
It is deleted 90 days after the sale ends (delivered, refunded, canceled or stopped). If a parcel is never reported delivered, the address is deleted 90 days after it ships. The sale and its amounts remain, without the buyer’s contact details.
When Shopify sends us a deletion request for a buyer, we delete their address and remove their contact details from our logs. When a store uninstalls the app and Shopify then asks us to delete the store’s data, we delete the addresses of all its buyers, its products and its unpaid sales. Paid sales are kept, without the buyers’ contact details, for our accounting obligations.
Buyers exercise their rights with the store where they bought. We help with the response.
7. Transfers outside your country
Rabbit is operated from the United Arab Emirates. Our servers are in France. Some providers (§5) are located outside the European Economic Area, notably in the United States and in China. To deliver a product bought in China to you, the shipping address must be sent to China.
8. How long we keep it
- Account, conversations, orders: as long as your account exists. If you delete your account, this data is deleted, except:
- invoices and payments, which the law requires us to keep;
- conversations with our team, kept with no link to your account and without your email address.
- Photos sent to prepare an order with the agent: deleted automatically after 2 hours.
- Technical log: 14 days.
- Backups: 7 days.
- Data of buyers in stores: 90 days after the sale ends (see §6).
9. Your rights
At any time, you can:
- download your data from your account;
- delete your conversations from your account;
- delete your account from your account, once your ongoing orders are complete.
You also have the rights of access, rectification, erasure, restriction, objection and portability. To exercise them, write to support@rabbitimport.com from your account’s email address. We reply within one month. We may ask for proof of identity if we have any doubt.
If you live in the EEA, you can also lodge a complaint with the data protection authority of your country (in France, the CNIL).
10. Cookies and storage in your browser
Rabbit uses no advertising cookies and no third-party audience measurement tools.
We use only what is necessary for the service to work:
- your browser’s local storage, to keep you signed in (30 days at most) and remember your display preferences;
- technical cookies lasting a few minutes while you connect a store or an AliExpress account.
These do not require your consent.
In the Shopify admin, the Rabbit app keeps only one thing in your browser: the search in progress, in the tab’s session storage, while you accept its fees on Shopify’s page (30 minutes at most, deleted once read). No cookie and no lasting storage; without this storage, the app still works and takes you back to the search.
11. Security
Exchanges with Rabbit are encrypted (HTTPS). Passwords are stored in irreversibly encrypted form. The access keys to your stores and partner accounts are encrypted. The addresses of store buyers are encrypted. Card payments go through Stripe. Repeated sign-in attempts are limited.
No system is invulnerable. If a data breach is likely to create a risk for you, we will notify you, as well as the competent authority, under the conditions provided by law.
12. Minors
Rabbit is for people who buy to resell. It is not intended for anyone under 18.
13. Changes
We may change this policy. The date at the top of the page shows the latest version.