Privacy Policy

When you install the App, Shopify gives us access only to the data allowed by the permissions you approve. We collect:

• Store information: your store’s myshopify domain, store name, store contact email address, primary domain, currency and published languages.
• Product information: product titles, descriptions, tags, product types, vendors, variant names, prices, product URLs, product image URLs and their existing alt text, and existing SEO meta titles and descriptions. To show the free store-wide scan and to build your llms.txt file, we read basic information about all of your products (titles, product types, prices, URLs and whether images have alt text). We generate and write text only for products created after installation, and for existing products if you purchase the catalog backfill.
• Access credentials: an access token issued by Shopify so the App can work in the background. It is stored encrypted (AES-256-GCM).
• Billing status: your current plan and the status of charges you approve. Payments are processed by Shopify; we never receive your payment card details.

Product change notifications: when a product is created, updated or deleted, Shopify sends the App a notification (webhook) that contains the product’s details, which may include prices, SKUs and inventory information. The App uses these notifications only to detect which products changed and does not store their contents.

Permissions and why we need them: read and write products (to read product details and write SEO meta titles and descriptions), write files (only to update the alt text of your product images), read locales and write translations (to translate alt text and meta information on the Pro plan), and write app proxy (to serve your llms.txt file). The App does not request access to customers, orders or other protected customer data.

• Settings you enter in the App, such as a brand name and words to avoid.
• Text the App generates (image alt text, meta titles, meta descriptions and their translations), together with the previous values, so that you can roll back changes.
• Processing records (which products were processed, when, and whether processing succeeded) and monthly usage counts.
• Messages you send to our support email address.

The App does not place cookies or tracking technologies on your storefront and does not collect information about your store’s visitors or customers. When the App serves your catalog summary file (llms.txt) through the Shopify App Proxy, it only verifies Shopify’s signature and returns the file; it does not store information about the request.

When you use the free Image SEO & Accessibility Checker, we fetch the public product listing of the store URL you enter, one time, to calculate the result. We do not store the store URL or the result. To prevent abuse, we keep a keyed one-way hash of your IP address together with a request count, and delete it within 48 hours. Our Website does not use advertising or analytics cookies.

• To provide the App: generating and writing alt text and SEO metadata, translations (Pro plan), rollback and llms.txt.
• To send service emails to your store contact email: notices when your monthly quota is used up (at most once a month) and, on paid plans, a weekly digest of what the App did.
• To manage billing, prevent abuse (for example, to prevent the same store from starting a free trial repeatedly) and keep the App secure.
• To diagnose errors and improve the App.
• To publish aggregate, anonymous statistics (for example, “the share of product images without alt text across stores using the App”). These statistics are only produced from 50 or more stores, never include store names, domains or product names, and cannot be used to identify a store.

We do not sell personal information and do not use your data for advertising.

To generate text, the App sends product information and product images (and, on the Pro plan, the generated text to be translated) to Google’s Gemini API. We use Google’s paid API service, under which Google does not use the submitted content to train or improve its models. Generated text may be inaccurate; you can review and roll back any change in the App.

We share information only with the providers we need to run the App:

• Cloudflare, Inc. – hosting, database, file storage and job queues. Cloudflare keeps short-term request logs (such as IP addresses, URLs and timestamps) for security and troubleshooting.
• Google LLC – AI text generation (Gemini API).
• Resend, Inc. – delivery of service emails.
• Functional Software, Inc. (Sentry) – error monitoring. Error reports may include your store domain.
• Shopify Inc. – app platform and billing.

We may also disclose information if required by law, or in connection with a merger or acquisition of our business, in which case this Policy will continue to apply.

We are based in Japan. Our service providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as the providers’ standard contractual clauses.

• We keep your data while the App is installed.
• When you uninstall the App, processing stops immediately and the access token is deleted. Shopify then sends us a data deletion request (48 hours after uninstalling), and we delete your store’s data, including product processing records, rollback history and your llms.txt file.
• Exception: to prevent repeated free trials, we keep a keyed one-way hash of your store’s domain and the date a trial started. This hash cannot be reversed into your domain.
• We keep a record that we received each data request from Shopify (customer data request, customer redaction, shop redaction), identified only by a keyed one-way hash of your store’s domain, to demonstrate that we responded.
• Request logs kept by our hosting provider are deleted automatically within a few days.
• Aggregate anonymous statistics (section 5) do not contain your data and are not deleted.
• Text already written to your store by the App stays in your store unless you change it.

All traffic is encrypted with TLS. Access tokens are encrypted at rest with AES-256-GCM. Webhooks and App Proxy requests are verified with Shopify’s signatures. Access to production systems is limited to the operator.

Depending on where you live (for example under the GDPR, UK GDPR, the California Consumer Privacy Act, or Japan’s Act on the Protection of Personal Information), you may have the right to access, correct, delete or export your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at privacy@altrasoftware.app. You can also delete all data at any time by uninstalling the App. If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection authority. Where we process personal data on a merchant’s behalf, our Data Processing Addendum applies.

Requests from your store’s customers made through Shopify (customer data requests and deletion requests) are received by the App; because the App does not hold customer data, there is nothing to export or delete.

The App and Website are intended for businesses and are not directed to children under 16.

We may update this Policy. We will post the new version on this page with a new effective date and, for material changes, notify merchants by email or in the App.

Altra Software
Address: Available upon request
Country: Japan
Email: privacy@altrasoftware.app