Privacy Policy

Last updated 2026-04-30

What we collect

We collect only what's needed for the App to function:

• Shopify shop information — your .myshopify.com domain, primary custom domain (if set), an OAuth access token to read products and write blog articles, and your Shopify subscription state.
• Catalog metadata — product titles, handles, tags, and collections (used to generate internal links inside articles). We do not read inventory levels, customer data, or orders.
• Google Search Console data — for the property you connect, we read query terms, impressions, click-through rate, and average position for the past 28 days. Read-only; we never modify your Search Console settings or submit URLs.
• Articles you generate and publish — drafts, final HTML, FAQ pairs, and internal-link records.
• Operational metadata — usage counters (articles generated this period), billing state, and audit log of administrative events.

What we don't collect

• Your customers' personal information (names, emails, addresses, payment data).
• Order or transaction data.
• Anything from your Google account beyond Search Console (no Gmail, Drive, or profile).

Where it lives

All data is stored on Cloudflare infrastructure (D1 SQLite database, KV, Queues) running in Cloudflare's global network. OAuth access tokens (Shopify and Google) are encrypted at rest with AES-256-GCM using a master key only the application can read.

Third parties we share with

• OpenAI (via Cloudflare AI Gateway) — generated article prompts and completions. Prompts include cluster query terms, your voice profile (extracted from your existing content), and a summary of your product catalog. We do not send customer data, orders, or PII.
• Shopify — API calls for catalog reads, blog article writes, and billing.
• Google — OAuth + Search Console API.
• Sentry (error tracking) — error stack traces and request metadata. PII fields are not attached to error reports.

Retention

• While the App is installed: all data we collect.
• On uninstall: your Shopify session and Google Search Console OAuth grant are deleted immediately; published-article records and historical drafts are kept (in case you reinstall).
• 48 hours after uninstall: per Shopify's mandatory shop/redactGDPR webhook, we delete all remaining data for your shop, irreversibly.

Your rights

You can request a copy of your data or its deletion at any time by emailing us via the Support page, or by uninstalling the app (which triggers automatic deletion within 48 hours via Shopify's compliance webhooks).

Cookies & tracking

The App itself doesn't set tracking cookies. The Shopify embedded admin sets session cookies scoped to admin.shopify.com for authentication — those are governed by Shopify's privacy policy.

Google API Services User Data Policy

Pagecraft AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data accessed via the https://www.googleapis.com/auth/webmasters.readonly scope (Search Console query terms, impressions, click-through rate, and average position) is used solely to provide the user-facing content generation features of Pagecraft AI:

• Identifying SEO opportunities (keywords on which the merchant's store is ranking on page 2 of Google).
• Clustering related queries into content topics.
• Generating, reviewing, and publishing blog articles that target those topics.

We do not use Google user data to train generalized or non-personalized AI/ML models. We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features (e.g. sending cluster query terms to OpenAI via Cloudflare AI Gateway to produce article drafts), to comply with applicable law, or as part of a merger, acquisition, or sale of assets with the user's explicit consent. Human reading of Google user data is performed only with the user's affirmative agreement for specific support cases, for security, or to comply with applicable law.

Changes to this policy

We'll notify merchants in-app of material changes. The "Last updated" date at the top of this page reflects the most recent revision.

Contact

Privacy questions or requests: see the Support page.