Privacy Policy.

Who we are

The App is operated by Navaal AI, a digital product studio based in Sydney, Australia ("Navaal AI", "we", "us"). For any privacy question or request, contact [email protected]. This policy applies to the App as distributed on the Shopify App Store; it does not cover third-party services except where described below.

What data the App accesses

The App is an embedded Shopify app. When you install it, you grant it access to your store's Admin API using the following OAuth scopes:

• write_products — read and write product titles, descriptions, and product-level SEO metadata (meta title and description) and image alt text.
• write_content — read and write online-store content such as blog articles, pages, and collection descriptions.
• write_metaobjects and write_metaobject_definitions — create and manage structured content objects (for example, FAQ entries the App publishes as schema) and the definitions that describe them.

We request write scopes because the App's purpose is to generate and, with your approval, publish optimised content back to your store. The App only writes content you have reviewed and chosen to publish through its Review & Publish workflow.

What data we store

To operate the App we store the following on our infrastructure:

• Shop domain — your myshopify.com domain, used to identify your account.
• Offline access token — an encrypted Shopify access token that lets the App perform the work you request without you being logged in at that moment.
• Generated content drafts — the AI-generated descriptions, meta tags, FAQs, alt text, and other content the App produces, so you can review, edit, and publish them.
• Usage counts and plan data — how many generations you have used against your plan limit, and which subscription plan is active.

Data is stored in a PostgreSQL database hosted on Fly.io, with Redis used for background job queues (for example, bulk generation jobs). We do not store your customers' personal data as part of the App's normal operation.

How we use AI (Anthropic's Claude)

The App generates content using Anthropic's Claude API. When you ask the App to generate or optimise content, the relevant store content you selected (such as a product title, existing description, or attributes) is sent to Anthropic's API so Claude can produce a draft. We send only what is needed for the requested generation.

We do not use your store's content to train, fine-tune, or improve AI models, and Anthropic does not use data submitted through its API to train its models. Anthropic processes this data as a subprocessor under its own commercial terms and privacy commitments. You can review Anthropic's practices at anthropic.com/legal/privacy.

Billing data

All billing is handled entirely by Shopify through the Shopify Billing API. We never see, receive, or store your payment card details or bank information. We only receive from Shopify the subscription status needed to grant you the plan you selected.

GDPR and Shopify's mandatory webhooks

The App implements Shopify's mandatory compliance webhooks:

• customers/data_request — if a store customer requests their data, we respond to the store owner with any customer data the App holds. In normal operation the App holds no customer personal data.
• customers/redact — we delete any customer data associated with a redaction request.
• shop/redact — 48 hours after a store uninstalls, Shopify sends this webhook and we permanently delete that store's data from our systems.

In addition, when you uninstall the App we delete or schedule deletion of your store's stored data, including the offline access token and generated drafts.

Data sharing and subprocessors

We do not sell your data or share it for advertising. We share data only with the subprocessors required to run the App: Anthropic (AI generation), Fly.io (application hosting and database), and Shopify (platform and billing). Each processes data on our behalf to deliver the service.

Data retention and security

We retain your data for as long as the App is installed, and delete it after uninstall as described above. Access tokens are stored encrypted. Access to production systems is restricted to Navaal AI. No method of transmission or storage is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete the data we hold about your store, and to object to or restrict certain processing. To exercise any of these rights, email [email protected] from the store owner's contact address and we will respond within a reasonable time.

International transfers

Navaal AI is based in Australia, and our subprocessors may process data in other countries, including the United States. Where data is transferred internationally, it is handled under the terms and safeguards of the respective providers.

Children's privacy

The App is a business tool for Shopify merchants and is not directed to children. We do not knowingly collect data from anyone under 16.

Changes to this policy

We may update this policy as the App evolves. Material changes will be reflected by updating the "Last updated" date above, and where appropriate we will notify merchants in-app.

Governing law

This policy is governed by the laws of New South Wales, Australia. Navaal AI operates from Sydney, Australia.

Contact

Privacy questions and requests: [email protected]. See also our Terms of Service and Support page.