Privacy Policy

• Your store's catalogue content (products, collections, pages): you, the merchant, are the controller. We process it on your instructions, only to provide the service (processor under article 28 GDPR). A data processing agreement is available on request at support@fexaai.com.
• Your account data (dashboard login, billing records): GENISOFT is the controller.

• Store details: shop domain and name, primary domain, enabled languages, plan and credit balance.
• Catalogue content: titles, descriptions, SEO titles and meta descriptions, vendor, product type, tags, variant options, image ALT text and URLs, trusted product metafields, collections and pages. We keep scan results (scores and issues), the drafts we generate, and a before/after copy of every change written to your store, so it can be restored.
• Store settings you declare: the delivery, payment and returns statements you enter in Settings.
• Shopify access: the access tokens Shopify issues to the app. Where Shopify provides a staff-specific session, it may include that staff member's name and email as supplied by Shopify.
• Dashboard account: email address and a salted password hash (bcrypt) if you sign up with a password. Accounts opened from the Shopify admin use the shop domain as identifier and have no password.
• Usage records: credit purchases and consumption, and technical logs of AI requests (model, token counts, cost) used for billing accuracy and abuse prevention.
• Server logs: request URL, IP address and user agent, kept by our hosting provider for operations and security.
• Rate-limit counters: to prevent abuse, sign-up, log-in and the free SEO checker count requests per IP address (and, for the checker, per checked store domain) in short time windows.

Free SEO checker. The checker reads the public pages of the store you enter, as any visitor could: its home page, llms.txt, public product list and up to five product pages. The report is sent to your browser and is not stored. The checked domain and your IP address are used in the rate-limit counters above, and the domain, the number of products checked and the duration are written to our server logs.

• Providing the service you installed — scanning, generating drafts, applying and restoring changes, billing: performance of the contract (art. 6(1)(b) GDPR).
• Rate-limiting sign-up, log-in and the free SEO checker: legitimate interests in preventing abuse and in not overloading the stores being checked (art. 6(1)(f)).
• Keeping change history, security logs and billing records: legitimate interests in a safe, reversible and fraud-free service (art. 6(1)(f)), and legal obligations for accounting records (art. 6(1)(c)).

Drafts are generated with the Google Gemini API. For each generation we send the catalogue content of the item concerned (and, for a collection, a sample of its product titles). Google processes this data under its Gemini API terms. We do not send shopper data, and we do not use your content to train our own models.

AI output can be wrong. The app removes or flags claims your data doesn't support, but you decide what is applied: nothing is written to your store until you apply it, and every applied change can be restored from History.

To help external AI answer engines (ChatGPT, Perplexity, Gemini) discover your store, the app serves a public /apps/catalog-seo-ai/llms.txt file via Shopify App Proxy. This file contains only titles and URLs of products and pages that you have published to your Online Store. Collections, and any unpublished, draft or hidden items are never included.

• Google Ireland Limited — application hosting and serverless compute (Google Cloud Run, region europe-west1, Belgium).
• PingCAP (US), Inc. / Amazon Web Services (AWS) — managed relational database (TiDB Cloud Serverless, region eu-central-1, Frankfurt, Germany). Encrypted at rest (AES-256) and in transit (TLS 1.3).
• Google (Gemini API) — generation of drafts. Requests may be processed outside the European Union; such transfers are covered by Google's data processing terms and the European Commission's Standard Contractual Clauses.
• Shopify — the platform the app runs on, and the billing of subscriptions and credit packs.

We do not sell or rent any data.

• Catalogue data, drafts, change history and operational usage records: while the app is installed. When Shopify sends us a shop redaction webhook (typically 48 hours after uninstall), we permanently erase all operational database rows linked to your store. Invoices and official transaction records remain governed and archived directly by Shopify Billing.
• Password-based dashboard accounts: until you ask us to delete them.
• Encrypted infrastructure backups: daily automated snapshots encrypted at rest retained for disaster recovery and operational integrity, after which they expire automatically.
• Hosting logs: according to our hosting provider's retention (30 days by default).
• Rate-limit counters: deleted during routine housekeeping once they are more than 24 hours old.

The dashboard only uses cookies that are strictly necessary for it to work, so no consent banner is required: the sign-in session cookie, its security (CSRF) and redirect cookies, and a cookie remembering which of your stores is selected. The app inside the Shopify admin uses no cookies; it authenticates with Shopify session tokens.

All traffic is encrypted in transit (HTTPS/TLS). Data is stored in a managed database encrypted at rest by our hosting provider, and every query is scoped to the store it belongs to. Passwords are stored only as salted hashes. Access to production systems is restricted to the operator.

You can ask to access, correct, delete or export your data, to restrict or object to its processing, by writing to support@fexaai.com. We answer within one month. If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or your local supervisory authority.

Shopify's privacy requests are handled automatically: customers/data_request and customers/redact are acknowledged (we hold no shopper data), and shop/redact triggers the deletion described in section 7.

We will update this page when our processing changes and change the date above. Significant changes will be announced in the app. See also our legal notice and terms.