Privacy Policy

1. Introduction

Welcome to SEOAi ‑ Image & Speed Optimize ("SEOAi", "we", "us", or "our"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Shopify application.

SEOAi is a Shopify application that provides image optimization, compression, and SEO enhancement services for Shopify merchants. We operate as a data processor on behalf of Shopify merchants (data controllers) who install and use our application.

By installing, accessing, or using SEOAi, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this Privacy Policy, please do not install or use our application.

2. Definitions

For the purposes of this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Merchant" or "You" means the Shopify store owner who installs and uses SEOAi.
• "End-User" or "Customer" means customers of the Merchant's Shopify store.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, and deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data (the Merchant).
• "Data Processor" means the entity that processes Personal Data on behalf of the Data Controller (SEOAi).
• "Services" means the image optimization, compression, and SEO features provided by SEOAi.

3. Data We Collect

3.1 Merchant Data (Collected Directly)

When you install and use SEOAi, we collect the following information:

3.2 Data We Do NOT Collect

We explicitly do NOT collect:

• Customer personal information (names, emails, addresses)
• Payment card details or financial information
• Customer order history or purchase data
• Customer browsing behavior or analytics
• Social security numbers or government IDs
• Health or medical information
• Biometric data

3.3 Automatically Collected Information

When you use our app, we may automatically collect:

• Browser type and version
• Device type
• IP address (anonymized)
• Access times and dates
• Pages viewed within the app
• Error logs and diagnostic data

4. How We Use Your Data

We use the collected data for the following purposes:

4.1 Primary Service Functions

• Image Optimization: Compressing, resizing, and converting your product images to improve load times
• SEO Enhancement: Analyzing and generating optimized meta titles, descriptions, and alt text
• Automatic Scanning: Detecting new images for optimization based on your settings
• Backup & Restore: Maintaining original image backups for restoration

4.2 Service Operations

• Authentication: Verifying your identity and store ownership via Shopify OAuth
• Billing: Managing subscriptions through Shopify's billing system
• Support: Responding to your inquiries and providing technical assistance
• Communication: Sending service-related notifications and updates

4.3 Service Improvement

• Analytics: Understanding how merchants use our features to improve the service
• Bug Fixes: Identifying and resolving technical issues
• Feature Development: Developing new features based on usage patterns

4.4 Legal Compliance

• Complying with applicable laws and regulations
• Responding to legal requests and preventing fraud
• Enforcing our terms of service

5. Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process your data based on the following legal grounds:

6. Data Sharing & Disclosure

6.1 Service Providers

We may share your data with trusted third-party service providers who assist us in operating our Services:

All service providers are bound by data processing agreements and are required to protect your data in accordance with this Privacy Policy and applicable laws.

6.2 We Do NOT Sell Your Data

6.3 Legal Disclosures

We may disclose your data if required by law or in response to:

• Valid legal process (subpoenas, court orders)
• Government requests from authorized authorities
• Protection of our legal rights or defense against claims
• Emergency situations involving potential harm to individuals

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

7. Data Retention

We retain your data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

7.1 Data Deletion Upon Uninstall

When you uninstall SEOAi from your Shopify store:

1. We receive a webhook notification from Shopify
2. Within 48 hours, we automatically delete all your store data
3. Image backups are purged from our storage
4. Optimization logs and settings are permanently removed

7.2 GDPR Shop Redact Compliance

We fully comply with Shopify's mandatory GDPR webhooks. Upon receiving a shop/redact webhook (sent 48 hours after uninstall), we permanently delete all data associated with your store.

8. Data Security

We implement industry-standard security measures to protect your data:

8.1 Technical Safeguards

• Encryption in Transit: All data transmitted between your browser and our servers uses TLS 1.3 encryption (HTTPS)
• Encryption at Rest: Sensitive data stored in our databases is encrypted using AES-256 encryption
• Secure Authentication: We use Shopify's OAuth 2.0 protocol with session tokens (no cookies)
• HMAC Verification: All webhooks are verified using cryptographic signatures
• Access Controls: Role-based access control limits data access to authorized personnel only

8.2 Organizational Safeguards

• Regular security assessments and vulnerability testing
• Employee training on data protection and privacy
• Incident response procedures for data breaches
• Vendor security assessments for third-party providers

8.3 Data Breach Notification

In the unlikely event of a data breach affecting your personal data:

• We will notify affected merchants within 72 hours of discovery
• We will notify relevant supervisory authorities as required by law
• We will provide details of the breach and remediation steps taken

9. Your Rights

9.1 GDPR Rights (European Economic Area)

If you are located in the EEA, UK, or Switzerland, you have the following rights under GDPR:

9.2 CCPA Rights (California Residents)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of personal information collected, used, and shared
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the sale of personal information (Note: We do NOT sell your data)
• Right to Non-Discrimination: Equal service regardless of exercising your privacy rights

9.3 LGPD Rights (Brazil)

Brazilian residents have similar rights under Lei Geral de Proteção de Dados (LGPD), including access, correction, deletion, and data portability.

9.4 PIPEDA Rights (Canada)

Canadian merchants have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), including access to and correction of personal information.

9.5 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

We may need to verify your identity before processing your request. This may include confirming your Shopify store ownership.

9.6 Supervisory Authority

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority.

10. International Data Transfers

SEOAi operates globally and may transfer your data to countries outside your jurisdiction. We ensure appropriate safeguards are in place:

10.1 Transfer Mechanisms

• Standard Contractual Clauses (SCCs): EU-approved contractual terms for data transfers
• Data Processing Agreements: Binding agreements with all service providers
• Adequacy Decisions: Transfers to countries with adequate data protection (where applicable)

10.2 Data Storage Locations

Your data may be processed in:

• United States (primary infrastructure)
• European Union (for EU merchants, where possible)
• Other regions as necessary for service delivery

10.3 EU-US Data Transfers

For transfers from the EU/EEA to the United States, we rely on Standard Contractual Clauses and supplementary measures to ensure adequate protection of your data.

11. Cookies & Tracking Technologies

11.1 Our Cookie Usage

SEOAi is an embedded Shopify application that uses session tokens for authentication, not traditional cookies. This is in compliance with Shopify's security requirements.

11.2 What We Use

11.3 Third-Party Analytics (If Enabled)

We may use anonymized analytics to understand app usage. You can opt out by contacting us.

12. Children's Privacy

SEOAi is a business application intended for use by Shopify merchants who are at least 18 years of age (or the age of majority in their jurisdiction).

We do NOT knowingly collect personal information from children under 16 years of age (or 13 in the United States). If we discover that we have inadvertently collected such information, we will promptly delete it.

If you believe we have collected information from a child, please contact us immediately at privacy@seoaioptimizer.com.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

13.1 Notification of Changes

When we make material changes to this Privacy Policy:

• We will update the "Last Updated" date at the top of this page
• For significant changes, we will notify you via email or in-app notification
• We may require you to re-accept the updated policy for continued use

13.2 Review Recommendation

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

14.1 Data Protection Officer

For GDPR-related inquiries, you may also contact our Data Protection Officer at: dpo@seoaioptimizer.com

14.2 Shopify Data Subject Requests

Shopify merchants can also submit data subject requests through Shopify's official channels. We fully cooperate with Shopify's GDPR webhook system for data requests and deletions.

15. Acknowledgment

By installing and using SEOAi, you acknowledge that:

• You have read and understood this Privacy Policy
• You consent to the collection and use of your data as described herein
• You are authorized to install apps on behalf of your Shopify store
• You will inform your customers about any relevant data processing activities