1. Scope and roles
This policy applies to the public website, Shopify application, and related support services operated by Veynavo LLC. For merchant account, billing, support, and service analytics data, Veynavo generally acts as the business responsible for deciding how that data is used. For store content processed on a merchant's instructions, Veynavo acts as a service provider or processor where applicable.
2. Information we process
- Shop and account data: shop domain, Shopify session data, granted scopes, app settings, subscription status, support communications, and notification email addresses supplied by the merchant.
- Store content: products, collections, titles, descriptions, SEO fields, tags, images and image alt text, storefront URLs and rendered metadata, and optional locale or translation data.
- Service activity: scans, suggestions, approvals, publishing and restoration history, automation settings, credit usage, audit results, model selections, and error records.
- Technical and security data: timestamps, request and application logs, IP-derived security information, browser or device details available in standard HTTP requests, and internal audit logs.
The app does not persist Shopify customer records and is not designed to process customer profiles, payment card data, or other consumer data. Merchants should not place personal or sensitive information in prompts, templates, product content, or support requests unless it is necessary and lawful.
3. How information is used
- Authenticate shops and provide requested application features.
- Scan catalog and storefront content, generate suggestions, and apply only merchant-approved changes.
- Operate subscriptions, credits, usage limits, automation, reports, support, and service communications.
- Protect the service, investigate errors or abuse, maintain audit trails, and meet legal or Shopify platform obligations.
- Improve reliability and product experience using account-level service events rather than advertising profiles.
4. AI and external service providers
When a merchant requests generation, relevant product metadata, instructions, and selected image URLs may be sent to the configured AI provider. Optional web research is used only when enabled and supported. Storefront URLs may be sent to a performance-testing provider when a merchant requests a PageSpeed test. Alert recipient addresses and alert summaries may be sent to an email delivery provider when email alerts are enabled.
We also rely on Shopify for authentication and billing, and on hosting, database, network, security, and logging providers to operate the service. These providers receive only the information reasonably necessary for their function and are subject to their own terms and privacy practices. See the Data & AI transparency notice for more detail.
5. Legal bases and merchant instructions
Depending on location, processing is based on performance of our contract, legitimate interests in operating and securing the service, compliance with legal obligations, and consent where required. Merchants are responsible for having a lawful basis to provide store content and to instruct the app to process or publish it.
6. Retention and deletion
Usage history is displayed for the retention window of the selected plan. Operational records, snapshots, suggestions, and publication history may remain stored for service continuity, restoration, fraud prevention, and legal compliance until deletion is requested or Shopify's required shop-redaction workflow is completed.
Uninstalling the app stops queued work, disables monitoring, marks the shop inactive, and removes applicable Shopify sessions. When Shopify sends the mandatory shop-redaction request, the shop record and related settings, snapshots, suggestions, billing metadata, usage records, and publication history are deleted. A merchant may contact us to request earlier deletion, subject to records we must retain by law or for unresolved billing and security matters.
7. Security and international processing
We use access controls, server-side credential storage, authenticated shop isolation, encrypted transport, bounded external requests, and operational audit logs. No system is completely secure, and merchants should protect their Shopify administrator accounts and promptly report suspected misuse.
Service providers may process data in countries other than the merchant's country. Where required, we use contractual and organizational safeguards intended to support lawful international transfers.
8. Privacy choices and rights
Merchants control optional image analysis, web research, automation, notification email, field approval, publishing, and subscription cancellation. Depending on applicable law, a person may request access, correction, deletion, restriction, objection, or portability of personal data, or may complain to a privacy regulator. We may need to verify the requester's identity and authority over the shop.
9. Cookies, children, and changes
The service uses only operational technologies described in the Cookie notice. It is a business service and is not directed to children. We may update this policy as the service or legal requirements change; the updated date above identifies the current version.
10. Contact
Privacy questions and verified data requests may be sent to [email protected]. Include the Shopify shop domain and enough information for us to understand the request, but do not email passwords, access tokens, or payment card details.