Privacy Policy

Last updated: October 2, 2026

This Privacy Policy describes how Zutomatic ("we", "our", or "the App") collects, uses, and protects information when you install and use our Shopify application.

---

1. Information We Collect

When you install the App, we collect and store the following merchant data:

• Shop domain — to identify your store and make API calls on your behalf
• Access token — encrypted Shopify API token required to read/write product data
• Product data — product titles, descriptions, and images used to generate AI content
• Generated content — AI-generated tabs, FAQs, highlights, and specifications stored in our database
• Subscription data — your plan and billing status
• Buyer questions — questions shoppers submit through the optional "ask a question" form on your product pages, including an email address if the shopper chooses to provide one

We do not access your customers' accounts, addresses, or order history. The only customer-provided data we store is a question a shopper submits through the "ask a question" form, with an email address only if the shopper chooses to leave one for a reply. These submissions are deleted on request and covered by the GDPR webhooks below.

2. How We Use Your Information

• To authenticate your store and make Shopify Admin API calls
• To generate AI-powered product content using your product data
• To publish generated content to your storefront via Shopify metafields
• To manage your subscription and enforce plan limits

3. Data Sharing

We do not sell, rent, or share your data with third parties, except:

• AI providers — product titles and descriptions are sent to AI APIs (Groq and OpenAI) solely for content generation. No shop credentials are shared.
• Shopify — data is exchanged with Shopify's APIs as required for app functionality.

4. Data Storage & Security

All data is stored on secured servers. Shopify access tokens are encrypted at rest using AES-256 encryption. We implement industry-standard security practices to protect your data.

5. Data Retention

Your data is retained for as long as the App is installed on your store. When you uninstall the App, your store is marked as inactive. All remaining data (products, generated content, shop record) is permanently deleted within 48 hours in compliance with Shopify's GDPR requirements.

6. Your Rights (GDPR)

If you are in the European Economic Area, you have the right to:

• Access the data we hold about your store
• Request correction or deletion of your data
• Object to processing of your data

To exercise these rights, contact us at the email below.

7. Shopify GDPR Webhooks

We comply with all of Shopify's mandatory GDPR webhook requirements:

• Customer data requests — we report any stored buyer-question submissions matching the customer's email.
• Customer redact — we delete the customer's email from any stored buyer questions; the anonymized question text may remain.
• Shop redact — all shop data is permanently deleted within 48 hours of app uninstallation.

8. Cookies

The App runs embedded inside the Shopify Admin and does not use tracking cookies. Session management is handled via Shopify's App Bridge and short-lived session tokens.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date above.