Shortlisted — Privacy Policy

1. Information the App accesses

When a merchant installs the App, Shopify grants it access to the store's product data only (the write_products permission, which includes reading products). The App does not request access to customers, orders, or any shopper's personal information.

The App reads, through Shopify's API:

• Product catalog data: product titles, descriptions, product types, vendors, tags, prices and currency, variant barcodes, image dimensions and alt text, and the App's own product metafields. When a product is created, Shopify notifies the App, which reads that product the same way.
• Collection data: collection titles and descriptions, how many products each holds, the titles and types of up to 10 of its products, and the App's own collection metafields.
• Store settings needed to work: the store's name, its primary domain and default language, and the App's own installation details (such as its plan subscription status).

The App also reads public storefront pages the way a search engine or AI crawler would: the store's public robots.txt file and one public product page, to check what AI crawlers can see.

2. Information the App stores

On our servers, the App stores only:

• Session data needed to connect to the store: the store's myshopify.com domain, the access and refresh tokens Shopify issues to the App, the granted permission scope, and token expiry information.
• Score history: one record per store per day with the catalog's average AI-readiness score and product counts, and one record per visibility check with the share-of-voice percentage and counts. These records contain no product text and no personal information.
• Usage counts and settings: how many AI generations and visibility checks the store used (each month on a paid plan, or in total without one or during a free trial, to apply its allowance), and the interface language chosen in the App's settings, if any.
• Names in AI answers: for each visibility check, up to 20 brand or store names that the AI answers mentioned, with how many answers named each and which AI engines named it, plus how many answers were read and how many named the store. They come from the AI answers, not from the store.
• Drafts waiting for approval: when the merchant turns on Autopilot, the content the App drafts for a new product, kept until the merchant applies or dismisses it, when it is deleted. The product's title, its Shopify ID and the status of its drafting stay until the store's data is deleted (section 6).
• Buyer questions the merchant adds: the questions the merchant chooses to add to the visibility monitor (up to 8 per store), exactly as the merchant wrote them. They are free text, so they can contain whatever the merchant writes, for example the store's brand or product names.
• Server logs: kept by our hosting provider for a limited time; they may contain the store's myshopify.com domain, the buyer questions sent in visibility checks, and error details.

Content the App generates (descriptions, FAQs, structured attributes and schema) is saved to the merchant's own store in Shopify (as product and collection descriptions and metafields) when the merchant approves it — not in our database, except Autopilot drafts until the merchant applies or dismisses them.

The App does not store any shopper's personal information.

3. How the information is used

We use the information only to provide the App's features to the merchant who installed it:

• computing the AI-readiness audit and the dashboard's scores and trends;
• generating AI-optimized content for products and collections when the merchant asks for it, and saving it to the store only after the merchant approves it;
• when the merchant turns on Autopilot, drafting content for new products in the background (after checking the store's plan with Shopify), to wait for the merchant's approval;
• running AI-visibility checks when the merchant asks for them, using the buyer questions the merchant added and questions built from the store's product types, and showing which brands and stores the AI answers named;
• checking the store's public pages for AI-crawler access problems;
• managing the merchant's plan through Shopify's billing.

We do not sell information, and we do not use it for advertising.

4. Service providers that receive information

To provide these features, the App sends limited information to the following service providers:

These providers process the information under their own terms and privacy policies: Anthropic, OpenAI, Google, Perplexity, Fly.io and Shopify.

5. Where information is stored

Our servers and database are hosted by Fly.io in the United States (Ashburn, Virginia). Service providers in section 4 may process information in other countries.

6. Retention and deletion

• When a merchant uninstalls the App, we delete the store's session data (including the access token) as soon as Shopify notifies us.
• About 48 hours after uninstall, Shopify sends us a store-data deletion request (unless the store reinstalls the App), and we then delete all remaining records for that store (score history, visibility-check history including the names read from AI answers, the buyer questions the merchant added, Autopilot drafts, usage counts and settings).
• Content the App saved into the store stays in the merchant's Shopify store, under the merchant's control, until the merchant changes or deletes it.
• Shopify's customer data requests and customer deletion requests are acknowledged; the App holds no customer data to return or delete.

7. Security

Access tokens are stored on our server's database and used only to call Shopify's API for the store they belong to. Communication with Shopify and with the service providers uses encrypted connections (HTTPS).

8. Your rights

Merchants can contact us at the address below to ask what information we hold about their store, to correct it, or to delete it. Depending on where they are, merchants may have rights under data-protection laws (such as the GDPR or Israel's Privacy Protection Law) to access, correct or delete their information and to complain to a data-protection authority. They can exercise these rights by emailing the address in section 10, and we reply within 30 days.

9. Changes to this policy

We may update this policy when the App changes. We will post the updated policy at this address and update the date at the top.

10. Contact