Privacy policy

Information we process

• Shopify store and account information: store identifiers and domain, store settings such as currency and timezone, granted permissions, authentication credentials, subscription status, and staff identifiers associated with edits and approvals.
• Catalog information: products, variants, SKUs, prices, costs, inventory and locations, vendors, collections, tags, product content, media references, metafields, and discount information needed for supported edits.
• Information you provide: editing instructions, uploaded CSV data, settings, approvals, schedules, and support emails and attachments.
• Service records: previews, before-and-after values, job history, failures, restoration snapshots, and diagnostic information such as request timing and errors. Our hosting provider also processes network information such as IP addresses to deliver and protect the service.

The current release does not request Shopify order or customer read permissions, or install storefront tracking pixels. Shopify may send customer information in mandatory privacy notifications; the deletion queue stores only the identifiers needed to handle a request, not customer names or contact details. Do not include customer personal information or secrets in editing instructions or CSV files.

How we use information

We use this information to authenticate store access, interpret editing instructions, build previews, apply approved changes, run schedules, restore eligible changes, enforce plan limits, troubleshoot failures, respond to support requests, and process privacy requests. SKU Pilot does not provide advertising targeting or sell merchant or customer data.

Service providers and AI processing

• Shopify provides installation, authentication, catalog APIs, app billing, and privacy notifications. Payment details are handled by Shopify; SKU Pilot does not collect payment card numbers.
• Cloudflare hosts the app and stores its database, cached data, uploaded files, and restoration snapshots.
• Google Gemini or OpenAI, depending on the configured AI provider, processes editing instructions with language and timezone context. Catalog alias generation can also send the store identifier and vendor, product-type, tag, and collection names, including during catalog setup. AI processing is not limited to text you explicitly submit. These requests do not intentionally include Shopify access tokens or customer contact information.
• Zoho Mail processes correspondence sent to our support mailbox.

Information sent to a provider is also subject to that provider’s applicable service terms and data practices. Data may be processed outside your country, including outside the European Economic Area, through these providers. Contact us for questions about processing locations or provider arrangements.

Retention and deletion

Store credentials, catalog data, settings, schedules, and operation records are retained while the app is installed to provide its functions. A plan’s visible history window is an access limit, not an automatic deletion deadline for the underlying records.

CSV import sessions expire after 24 hours and their stored upload and error files are removed by background cleanup. Manual restore data expires after 24 hours. Preview and scheduled restoration snapshots have their own expiry times so a scheduled operation can finish; expired artifacts are removed by background cleanup.

When we receive Shopify’s uninstall or shop-deletion notification, we queue deletion of the shop’s app database records and stored files. Failed cleanup is retried, so removal is not necessarily immediate. Minimal completion records containing the shop identifier, notification identifier, topic, and processing timestamps are retained for 30 days after completion to handle duplicate notifications. Pending deletion records remain until processing succeeds.

Support correspondence and provider diagnostic or backup records are separate from the app’s uninstall cleanup and follow the applicable operational retention arrangements. Contact us to request deletion of support correspondence or ask about retained records. Uninstalling does not reverse product changes already applied to your Shopify store or delete Shopify’s own records.

Access and security

The app uses HTTPS, verifies Shopify authentication for merchant APIs, and verifies signed Shopify notifications. Store access credentials are used on the server to perform authorized operations. These public information pages do not require a Shopify account and do not set app cookies or load advertising or analytics scripts. Authentication within Shopify is governed by Shopify’s own session mechanisms.

Your choices and privacy requests

Depending on applicable law, you may have rights to access, correct, delete, or receive a copy of personal information, restrict or object to processing, or complain to your local data protection authority. Email support@nlplug.com with the subject “SKU Pilot privacy request” and the relevant store domain. We may need to verify your identity and authority before acting on a request.

If you are a customer of a Shopify merchant, contact that merchant first so they can identify your information and initiate the appropriate Shopify request. Merchants can stop future app access by uninstalling SKU Pilot in Shopify Admin.

Contact and policy updates

For privacy questions, contact NL Plug Solutions at support@nlplug.com. We update this page when our practices change and show the latest revision date above.