Privacy Policy

What this app is

CatalogPilot AI is a Shopify app that analyzes a merchant's product catalog against deterministic quality rules and can generate AI-drafted suggestions to improve specific product fields (title, description, SEO title, SEO description, tags, and image alt text). Every suggestion is generated only when the merchant explicitly requests it, and no change is ever written to the merchant's store without the merchant's explicit approval.

Information we access from your store

When you install the app, Shopify grants it access to your store's product catalog (the write_products scope, which includes read access to products). The app reads product titles, descriptions, SEO fields, tags, images, and related metadata in order to score catalog health and generate suggestions. The app does not request or use any scope covering customers, orders, or any other store data.

Information we store

We store only the following, all scoped to your shop:

• Session data — your shop's domain and an access token issued at install time, used solely to make authorized requests to your store's Shopify Admin API on your behalf.
• Catalog health analysis records — Shopify product IDs, a snapshot of a product's title and last-updated timestamp (used only to detect whether a product changed since it was last analyzed), computed quality scores, and the specific issues detected (for example, "title too short"). We do not store a full copy of your product content.
• AI request and recommendation records — which product and field an AI suggestion was generated for, the AI provider and model used, timing and token-usage metadata, the proposed text itself, and its review status (proposed, edited, approved, rejected, or published). We do not store the full prompt sent to the AI provider or the AI provider's raw response — only the final, validated proposed value.
• Analytics and lifecycle events — an append-only record, scoped to your shop, of when certain things happened in the app: the app was installed, the app was uninstalled, a first catalog analysis completed, an AI suggestion was generated, an AI suggestion was applied, or an AI suggestion was rejected. An event may include identifiers such as a Shopify product ID, an analysis run ID, or a recommendation ID, the time it occurred, and limited structured metadata (for example, which type of field a suggestion was for, or a feedback category you selected). These event records do not contain AI prompts, raw AI responses, access tokens, secrets, your product text, the text of a suggestion, anything you type, or customer data.
• Product change history — a record of each change the app attempts or applies to your Shopify store after you approve it. A record may include the Shopify product ID (and, for image alt text, the image's media ID), which field was changed, the value that field held immediately before the change, the value that was applied, the status of the change (pending, applied, or failed), and relevant timestamps. This is the one place where we keep a copy of product content beyond the records above, and only for the specific fields you chose to change. We keep it for auditability and troubleshooting, and so that a history or restore feature can be offered in the future; the app does not currently provide a way to view this history or to restore a previous value.
• Operational error and reliability logs — limited technical information used to detect, diagnose, and prevent failures. A log entry may include a request ID, your shop's identifier, a product identifier where it is needed internally to investigate a failure, the name of the operation, an error category or code, a timestamp, and sanitized diagnostic information. Secrets, access tokens, full AI prompts, raw AI provider responses, query strings, and unnecessary merchant or customer content are excluded or redacted. These logs are kept separately from the application database (see "Data retention and deletion" below).

Information we do not collect

We do not collect, process, or store any data about your store's customers (shoppers) — no customer names, emails, addresses, order history, or other customer-identifying information, under any circumstance. The app has no code path that reads or persists Shopify customer data, and it does not request any scope that would grant access to it.

Why we process this information

We process the information above only to:

• Compute a deterministic catalog health score and identify specific product issues.
• Generate an AI-drafted suggestion for one specific issue, at your request.
• Let you review, edit, reject, or approve a suggestion, and apply an approved change back to your store.
• Detect if a product has changed since a suggestion was generated, so we don't apply a suggestion over an edit you made in the meantime.
• Measure app feature usage and lifecycle events needed to operate and improve the service.
• Maintain an auditable record of merchant-approved product changes.
• Detect, investigate, and resolve application, AI-provider, Shopify API, and infrastructure failures.
• Enforce service reliability and usage safeguards.

We do not use your catalog data for any purpose beyond delivering, operating, and improving this functionality for you. We do not use merchant data for advertising, for profiling, for resale, or to train AI models.

AI processing

When you request an AI suggestion, the app sends only a small, explicitly limited set of facts about the specific product and field involved (for example, the product's title, product type, vendor, tags, and existing content relevant to that field) to our AI provider. We never send your full product catalog, your customers' data, or another merchant's data. Any optional feedback you provide when requesting a different suggestion ("Try another") is sent as descriptive preference data only — it is never treated as an instruction that can override the facts about your product.

Our current production AI provider is: OpenAI. That provider processes the data we send it under its own privacy policy and data-handling terms; we encourage you to review them.

Third-party service providers

We rely on the following categories of third-party providers to operate this app:

• Shopify — the platform this app runs on. All product data originates from, and is written back to, your store via Shopify's Admin API.
• AI provider — either OpenAI or Anthropic, depending on how this deployment is configured (see "AI processing" above for the current one). Receives only the limited, whitelisted product facts needed to generate one suggestion.
• Hosting/infrastructure provider — Railway, which hosts the application server and its PostgreSQL database. As our hosting and infrastructure provider, Railway may process the application and database data described in this policy, as well as the operational logs the application produces.

We do not sell, rent, or trade merchant or customer data to any third party for any purpose, including advertising.

Data retention and deletion

The shop-scoped records in our application database are retained only while the app remains installed on your store. When you uninstall the app, its access to your store is invalidated immediately. Following Shopify's mandatory shop/redact process, the application database records for your shop are permanently deleted approximately 48 hours after uninstall. This covers every database record type described above: session data, catalog health analysis records, AI request and recommendation records, analytics and lifecycle events, and product change history.

Operational error and reliability logs are separate from the application database and are not deleted by the shop/redact process. Limited operational logs may be retained temporarily, in line with our infrastructure provider's and our own security retention requirements, and are used only for security, reliability, debugging, and abuse prevention.

Shopify privacy and compliance requests

This app implements Shopify's mandatory privacy compliance webhooks:

• Customer data request — because the app never stores any customer (shopper) data, there is nothing to locate or export in response to this request.
• Customer redact — for the same reason, there is nothing to delete in response to this request.
• Shop redact — permanently deletes the app's application database records for the shop, as described above.

Security practices

We take reasonable steps to protect the information described above, including: encrypting data in transit via HTTPS, keeping API keys and access tokens server-side only (never exposed to your browser or any client-side code), redacting secret-shaped values from application logs, and scoping every database read/write to your specific shop. Our structured error and reliability logging records only an allow-listed set of operational fields, redacts secret-shaped values, and sanitizes exception diagnostics before they are written. We do not currently use a third-party error-monitoring service; if we introduce one in the future, it will receive a more restricted set of data than our internal logs, and this policy will be updated first. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

How you control your data

• Every AI suggestion requires your explicit review and approval before it changes anything in your store — nothing is applied automatically.
• Uninstalling the app immediately invalidates its access to your store.
• You may contact us at any time using the details below with questions or requests regarding your data.

Changes to this policy

We may update this policy from time to time. If we do, we will post the revised policy here with an updated effective date. Where appropriate, we may also communicate material changes through other reasonable means, such as an in-app notice or an email to the address associated with your account. We encourage you to review this policy periodically.

Contact

Questions about this policy, or requests regarding your data: sushantpatil0611@gmail.com
General contact: sushantpatil0611@gmail.com