Privacy Policy
Last updated: July 25, 2026
1. Information We Collect
We collect: email address (for account creation), store domain and product data (to provide AI analysis), and usage analytics (page views, features used). We do NOT collect payment information — payments are processed by Paddle.
2. How We Use Your Data
Your data is used exclusively to: provide AI visibility analysis, generate optimization recommendations, track ranking changes over time, and improve our service. We never sell your data.
3. Data Storage
Account data is stored on Supabase (US East). AI content generation is processed via the DeepSeek API. Payment data is handled entirely by Paddle — we never see your credit card.
4. Cookies
We use essential cookies for authentication (Supabase Auth) and analytics (Cloudflare). No tracking cookies. No ad cookies.
5. Your Rights
You may request deletion of your data at any time by contacting [email protected]. We will comply within 30 days.
6. GDPR Compliance
EU users have the right to access, rectify, and erase their personal data. ProdRank acts as a data controller for account information and a data processor for store data analyzed through the Service.
7. Shopify App Data Processing
When you install the ProdRank Shopify App, we process: product data (titles, descriptions, prices, images, SKUs), store information (name, email, plan, currency, timezone), and an OAuth access token used solely to read and write product metafields for schema and AI content. We do not process or store customer order data, customer personal information, or payment information. Your access token is used only against your own store's Admin API and is never exposed to third parties.
8. Automated Deletion (GDPR Webhooks)
To comply with Shopify's App Store requirements and GDPR, we implement Shopify's mandatory data-privacy webhooks: customers/data_request, customers/redact, and shop/redact. When Shopify triggers shop/redact (a merchant deletes their store or requests erasure), all data associated with that store — products, generated content, usage history, and connection records — is permanently deleted within 24 hours. Because we store no customer data, customers/redact has nothing to purge.
9. Subprocessors
We use the following subprocessors: Supabase (database hosting, US East) for all account and store data; DeepSeek API for AI content generation; Resend for transactional email; Paddle for payment processing (we never see your card details); Cloudflare for CDN and DDoS protection. Each subprocessor is bound by data-processing terms. For the current list, contact [email protected].