Privacy Policy
Who we are
ShopReels ("we") provides a Shopify application that generates product videos, publishes approved ones to a merchant's storefront, and reports how they perform. Questions: support@shopreels.app.
What we collect from merchants
- Store data via the Shopify API: shop domain, store name, contact email, timezone, currency, and product catalog data (titles, handles, images, prices, variants, inventory availability). We request the minimum scopes needed to read products and to write the media a merchant approves.
- Merchant inputs: reference photos, product descriptions and prompt notes uploaded in the app, and the generated videos and images themselves.
- Review links: when a merchant sends a set of slides to their team for approval, we store the name each reviewer types, their decision and comments, and a one-way hash of their IP address used only to limit abuse. Links expire after 14 days and can be turned off at any time; the answers are deleted with the store's data.
- Account and billing state: the plan a merchant selects and the subscription status reported by Shopify Billing. We never see or store card numbers; payments are handled by Shopify.
What we collect from storefront visitors
Our storefront widget and web pixel record how videos perform. Each event carries a randomly generated visitor identifier, the video and product it refers to, and a timestamp. Event types are: widget impression, feed open, video play, qualified play (two seconds or more), completion, add to cart, product view, share, promo view, promo click, and completed checkout (order id, currency, and line items).
- The visitor identifier is a random string. It is not an email address, a name, a Shopify customer id, or an advertising id, and we do not attempt to link it to a real-world identity.
- Analytics run only where the storefront's consent settings allow it. When a visitor has not consented to analytics, no persistent identifier is written and events are recorded without one.
- We do not sell personal data, we do not share it with advertising networks, and we do not use it to train third-party models.
Generation providers
To produce videos and images we send the prompt text and the product reference images a merchant supplies to model providers (currently OpenRouter for text, vision and image generation, and BytePlus ModelArk for video). We do not send storefront visitor data to these providers.
Where data is stored
Application data is stored in a managed PostgreSQL database in the European Union and media files in Cloudflare R2 object storage. Approved videos and images are also stored by Shopify on the merchant's own store, where the merchant controls them.
How long we keep it
- Raw storefront events: 90 days. Aggregated daily counts are kept for the life of the account.
- Generated candidates that are rejected or never approved: 30 days.
- Store and account records: for the life of the installation. When an app is uninstalled we stop collecting new data, and we delete the store's data within 30 days or on request, whichever comes first.
Shopify compliance requests
We answer Shopify's mandatory customers/data_request, customers/redact, and shop/redact webhooks, and we act on them rather than only acknowledging them. We store no customer names, emails, addresses, or Shopify customer ids. What we may hold about a customer is a set of storefront events keyed by Shopify order id and by a first-party visitor cookie: purchases, line items, and the playback and cart events of that visitor.
- Data request: we compile every record linked to the requested orders and the visitor cookies found on them, and deliver the export to the merchant within 30 days. The merchant passes it to the customer.
- Customer redaction: we delete the events and line items of the listed orders and the entire event history of the visitor cookies found on them; other purchases by the same visitor are anonymised. Aggregated daily counts without identifiers are kept.
- Shop redaction: we delete the store's database records, the store's files in our object storage (reference images, generated candidates, posters), and any landing-page leads or events recorded for that store domain. Requests that fail are retried until they succeed and are visible to our operators until then.
Leads and operational notifications
If you leave your store and email on our home page, we store them to contact you about early access and send a notification to our own team channel (a Telegram, Slack, or Discord webhook we operate). Lead records are deleted on request and are removed together with a store's data when that store is redacted.
Your rights
Merchants can request access to, correction of, or deletion of their data by emailing support@shopreels.app. We respond within 30 days. Storefront visitors should contact the store they visited; we act as a processor on that store's behalf and will assist the merchant with any request.
Changes
If this policy changes materially we will notify merchants by email and update the date at the top of this page.