Privacy Policy

Last updated: 10 July 2026

ScaleSEO (“ScaleSEO”, “we”, “us”) is a Shopify application that researches a merchant’s store and generates, publishes, and tracks SEO/AEO blog content on that merchant’s own storefront. This policy explains what data we process, why, who we share it with, and the rights you have. It covers both the merchants who install the app and the visitors to those merchants’ stores.

Who is the data controller

For data about the merchant’s account and store, ScaleSEO is the data controller. For personal data belonging to a merchant’s own customers/store visitors, the merchant is the controller and ScaleSEO acts as a processor on the merchant’s behalf.

What we collect

• Store identity & authorization — your .myshopify.com domain, the Shopify access token granted at install, and the scopes you approve. The token is stored to call the Shopify Admin API on your behalf.
• Store content used for research — product titles, descriptions, metafields, brand/positioning text, and public storefront content, used to build your content knowledge base.
• Content we generate — the articles, metadata, and images ScaleSEO drafts and publishes for you, plus your content settings (author byline, templates, blog destination).
• Usage & billing — counts of articles generated, plan/subscription status, and job history. Payments are handled entirely by Shopify Billing; we never see or store card details.
• Performance data — page view and click counts on published content, and — for revenue attribution — the order id, total, and currency of orders that arrive via a tracked link. We do not collect store-visitor names, emails, or payment data.

How we use it

• To research your brand and generate on-brand, factually grounded content.
• To publish and manage that content on your storefront via the Shopify Admin API.
• To measure content performance (traffic, product clicks, revenue attribution) and AI-search visibility.
• To operate billing, enforce plan limits, and provide support.

We do not sell personal data, and we do not use your store data to train our own models.

Subprocessors we share data with

• Shopify — the platform your store and content live on.
• Vercel — application hosting.
• Supabase — database and file storage for your knowledge base, content, and settings.
• OpenRouter (and, through it, model providers including OpenAI, Anthropic, Google, and Perplexity) — to generate content and run AI-visibility checks. Prompts are the research context and topic keywords; we do not send store-visitor personal data to these providers.

Each subprocessor only receives the data needed to perform its function and is bound by its own data-processing terms.

Data retention & deletion

We retain your data for as long as the app is installed. When you uninstall, Shopify sends us an app/uninstalled webhook and we clear your access token. We honor Shopify’s mandatory GDPR webhooks — customers/data_request, customers/redact, and shop/redact; because we do not store your customers’ personal data, redaction requests are acknowledged and any associated records removed. To request deletion of your account data at any time, email us at the address below.

Security

Data is transmitted over HTTPS and stored on managed, access-controlled infrastructure (Supabase/Vercel). Access tokens are stored server-side and never exposed to the browser. API requests from the embedded app are authenticated with Shopify session tokens.

International transfers

Our infrastructure and subprocessors may process data in the EU and the United States. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

Your rights

Depending on your jurisdiction (including under GDPR and CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Contact us to exercise these rights.

Changes

We may update this policy as the app evolves. Material changes will be reflected by the “last updated” date above.

Contact

Questions or requests: privacy@scaleseo.app.