Privacy policy
Last updated: October 13, 2026
Surfaced: AI Search Readiness (“Surfaced”, “we”, “us”) is a Shopify app that scores a store’s product catalog for AI shopping agents, applies optional fixes to product SEO fields, and reports revenue from AI assistants. This policy explains what information the app accesses when a merchant installs it, how that information is used, and how it is deleted. It applies to the Surfaced app and this website.
1. Information we access
When you install Surfaced, Shopify grants the app the following access, which you approve on install: write_products (which includes reading products), read_orders and read_legal_policies.
| Data | How we use it | Stored? |
|---|---|---|
| Store details: shop domain, API access token and granted permissions | To authenticate the app with your store | Yes, until uninstall |
| Product data for active products: titles, handles, descriptions, product type, vendor, tags, category, options, images and alt text, variants, barcodes (GTINs), weights, SEO title and description | To calculate readiness scores and suggest fixes | Yes: scan results (scores, issues and the product fields needed to show them) |
| Product changes you apply | When you click a fix, we write image alt text, SEO title or meta description to the product and record the previous and new value so you can undo it | Yes: change log |
| Store legal policies (refund, shipping, privacy, terms) | To check that the policies AI channels require are published | Only whether each policy is present |
| Orders: order ID, date, total and currency, referrer URL, landing page, and the referrer, landing page and UTM source of the customer’s first and last visit | Read live from Shopify when you open the AI sales page, to count orders and revenue from AI assistants | No. Order data is processed in memory and not saved |
| App settings: first scan score, background job status, review prompt dates | To run the app and show progress | Yes, until uninstall |
Website (not the app): if you join the launch list on our website, we store the email address and optional store address you enter, only to send you one launch email. We delete it after that email unless you install the app, or sooner if you ask. Our free tools keep anonymous daily usage counts only (no IP addresses or store addresses).
2. Customer personal information
Surfaced does not request or store your customers’ names, email addresses, phone numbers, postal addresses or payment details. The order fields listed above are read only to attribute sales to AI assistants and are never written to our database. Because we hold no customer data, there is nothing to export or erase in response to a customer data request; we still acknowledge Shopify’s customers/data_request and customers/redact webhooks.
3. How we use information
- To provide the app’s features: scoring, fixes, undo and AI sales reporting.
- To enforce plan limits and show your plan in the app (billing is handled by Shopify).
- To troubleshoot problems you report to support.
We do not sell or rent information, do not use it for advertising, and do not use your store data to train AI models.
4. Sharing and service providers
We share data only with infrastructure providers that host the app and its database (for example our cloud hosting and managed PostgreSQL providers), solely to run the service, and with Shopify through its APIs. We may disclose information if required by law.
5. Retention and deletion
- On uninstall, the app’s access token is deleted immediately and the app can no longer access your store.
- Within 48 hours of uninstall, Shopify sends the
shop/redactwebhook and we permanently delete all data we hold for your store: scan results, the change log, settings and session records. - Product changes you applied remain on your products in Shopify, because they are your store’s data. You can undo them from the Changes page before uninstalling.
6. Security
Data is transmitted over HTTPS. Requests from Shopify are verified with session tokens and webhook HMAC signatures. Access to the production database is restricted to the app.
7. Your rights
Merchants can ask us to access, correct or delete their store’s data at any time by emailing us. If you are in the EEA, UK or California, you have rights under GDPR, UK GDPR and CCPA, including access, deletion and objection. Your customers can exercise their rights through your store; Shopify forwards those requests to us.
8. Changes
We will update the date above when this policy changes and, for material changes, notify merchants in the app.
9. Contact
Questions about privacy: getsurfaced@proton.me