Privacy Policy

This policy explains what data the Shopify app Capyo: AI Product Photos Bulk and this website process, why, on what legal basis, and how long it is kept. It is written for the merchant who installs the app. It is not legal advice about your own obligations as a data controller, or about the rights in the images you publish.

1. Who is responsible

The controller depends on the data. For your relationship with the app — the store record, plan and billing status, and support correspondence — and for this website, the controller is Capyo, operated by an individual developer. For everything the app processes about your shop and catalog, and for the images it generates for you, you are the controller and Capyo acts as your processor under the Data Processing Agreement. Contact for anything in this document, including all data-protection requests: gimbernat13@gmail.com.

Operator legal name and address: [to be added]

For the personal data of your customers, you remain the controller. Capyo is built to never receive your customers' names, email addresses, phone numbers or physical addresses, and it requests no Shopify scope that would give it access to them — see section 2 for exactly what it does read and store.

2. Data the app processes

It comes from Shopify when you install the app, from the runs you create, and from you. In detail:

• Store record. Your .myshopify.com shop domain, store name, primary locale, current plan and when it was last checked, the start of the current credit cycle, install and uninstall timestamps, your default for publishing generated images automatically, and whether the review prompt was shown.
• Sessions. The Shopify access token issued to the app for your store, and the session fields Shopify supplies with it: the shop domain, the Shopify staff user id, first and last name, email address, locale, whether the user is the account owner or a collaborator, and the token's scope, expiry and refresh data. This is the data of the merchant and staff who use the app, not of your customers.
• Runs. The selection you chose (a collection, a tag, a search or all products), the product ids frozen into the run, the mode (scene, clean white or on-model), the chosen scene or model preset, whether an HD output was requested, the publish options (set as featured, alt text, square crop, auto-publish), the run's status, the credits reserved, and its timestamps and undo-retention date. If you are on Growth or Pro and write a custom scene prompt, the prompt is stored with the run. Custom prompts are sent to the image provider in English.
• Run items. One row per product in a run: the product's Shopify GID, the source media id and URL the run read (the product's featured image at the time), the item's status, its attempt count, the id and URL of the generated file in your shop's Files, the media id once it is published to the product, any error text, and an idempotency key that stops the same item being generated twice.
• Snapshots. What publishing changed for one product in one run: the ids of the media that were added, the previous featured media id, and the previous media order. Ids only — the app never stores image bytes.
• Credit ledger. An append-only record of every credit movement for your shop: each output charged, each automatic refund, each grant and each cycle reset, with the run and item it belongs to.
• Product-usage events. Shop domain, an event name from a fixed list (install, run created, preview confirmed, run done, output published, undo used, plan changed and similar) and a timestamp — no personal data, used only to see which steps merchants get stuck on.
• Job queue. Queued work items for a run: the job type and the identifiers it needs (shop, run and item ids) until the job completes.
• Operational logs. Error and warning traces from the app's own process: the identifiers a job needs (shop domain, run id, error text) written to the container's rotating log buffer. The web server in front of the app is configured to keep no access logs, and no IP address or user agent is written to the database.
• Support correspondence. If you email us, we keep the message and our reply.

Where any of this is personal data, it is the personal data of you — the merchant and your staff — not of your customers. The app does not store the image bytes it generates; it stores the Shopify file and media identifiers that point at them.

3. What is sent to the image providers

To generate a photo, the app's provider adapter sends the source image (the product's featured image at the time the run started) and the mode instruction to the provider for that mode: Google for Gemini image generation in the scene and on-model modes, and fal.ai for image-edit models and for the dedicated background-removal model used by the clean-white mode. Whichever provider a mode calls receives the product image and the instruction, and nothing else: no shop data, no order data and no customer data. The instruction is the app's own prompt plus your custom scene prompt if you set one. If a provider refuses an image for safety reasons, the item is marked failed and its credit is refunded.

The model presets are the app's own synthetic people, generated once by the app's pipeline and stored as app assets; they are labelled as synthetic in the Models screen. The app sends a preset's reference image, never a real person's photograph.

The app's provider keys belong to the operator, not to you: you are never asked to paste an AI provider key.

4. What we never store

• Your customers' names, email addresses, postal addresses, phone numbers or customer ids.
• Order, checkout or payment data — the app requests no read_orders scope and no protected customer data.
• Image bytes. Generated and source images live in your own Shopify Files; the app stores only their ids and URLs.
• IP addresses or user agents in the app's database; the web server keeps no access logs.
• Your theme code — the app does not edit theme files, because it has no storefront component at all.
• Any merchant AI-provider key; the app uses its own.

Shopify sends every public app the two mandatory customer-privacy webhooks (customers/data_request and customers/redact). Capyo acknowledges them; because it holds no customer personal data, there is nothing to return.

5. No storefront output

Capyo is admin-only. It has no theme extension, no widget, no app proxy and no web pixel, and it adds no script to your storefront. What it writes to Shopify is product media — the generated images, through Shopify's own Files API — and only when you publish a run or a run is set to publish automatically. Your shoppers never interact with Capyo.

6. This website

This site is a set of static pages. It sets no cookies, runs no analytics, and contains no tracking pixels, no advertising tags and no embedded third-party content. The typeface is self-hosted rather than loaded from a font CDN. The host of these pages processes the ordinary request data any web server sees, including your IP address, to deliver them.

7. Why we process it, and on what legal basis

• To provide the app you installed — running your bulk selections, calling the image providers, uploading outputs to your Files, publishing them to your products, and computing credits, history and undo. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
• To bill you through Shopify's Managed Pricing. We read which plan is active; Shopify performs the billing. Legal basis: Art. 6(1)(b) GDPR.
• To keep the service secure and working — queue handling, provider health, error handling, abuse prevention, and the usage events that show which steps fail. Legal basis: legitimate interests, Art. 6(1)(f) GDPR.
• To answer support requests. Legal basis: Art. 6(1)(b) and (f) GDPR.
• To meet legal obligations, including Shopify's mandatory compliance webhooks. Legal basis: Art. 6(1)(c) GDPR.

We do not use your data for our own advertising, we do not profile you, and we never sell or rent it.

8. How long we keep it

• Sessions and queued jobs: deleted immediately when Shopify sends the app/uninstalled webhook, and scheduled jobs for your shop are cancelled.
• Snapshots: stay undoable for 30 days on Free and Starter and 90 days on Growth and Pro. After the retention window the run remains in your history as a record, but it can no longer be undone.
• Everything else about your shop — store record, runs, run items, credit ledger, model selections, usage events, job rows and generated-file references: deleted when Shopify sends the shop/redact webhook, 48 hours after uninstall, which deletes every row for the shop in every table. A reinstall inside those 48 hours cancels the scheduled deletion. Ask us to delete earlier and we will.
• Operational logs: kept only for as long as the container's rotation retains them (three 10 MB files), then overwritten.
• Database backups: taken daily and rotated after 14 days, so a row deleted by uninstall or shop-redact can remain inside a backup until that rotation passes. Backups are used only for disaster recovery, are readable only by the server's root and database accounts, and are never used to restore a deleted shop's data on request.
• Support correspondence: kept up to 24 months, deleted sooner on request.

9. Who else is involved (sub-processors)

There is no analytics provider, no error-tracking SaaS, no advertising network, no email marketing tool and no CRM in this list. Every provider the app can be configured to call lives behind one adapter per provider; a provider that is not configured is never called. We will update this table before any new sub-processor starts processing.

10. International transfers

Merchant data processed through the app is stored on servers located in the United States — the application server in Boston, Massachusetts and the PostgreSQL database in Manassas, Virginia. Both are operated for us by European companies (Hostinger International Ltd, Cyprus; netcup GmbH, Germany), but the processing itself happens outside the EEA, which engages Chapter V of the GDPR. The product images sent to Google and fal.ai for generation are likewise processed by United States-based providers.

For those transfers we rely on the Standard Contractual Clauses included in those providers' data processing terms, together with the technical and organisational security measures in section 11. The app stores no end-customer personal data, so nothing about your shoppers crosses a border. What does is the store configuration, runs and run items, credit ledger, snapshot ids and access token described in section 2, plus the product images and prompts described in section 3.

Hosting locations can change; any change of hosting location or sub-processor is announced in the app and on this page before it takes effect. Shopify may transfer data internationally under its own DPA and transfer mechanisms, which govern the Shopify-to-merchant relationship independently of this policy.

11. Security

• All traffic to the app and to this website is served over HTTPS/TLS. There is no plaintext endpoint.
• The database is not exposed to the public internet: its firewall accepts PostgreSQL connections only from the application server's IP address, over an encrypted connection with password authentication.
• Shopify access tokens are stored in that database and are never written to logs or shown in the UI.
• Administrative access to the server and the database is limited to the operator, over SSH with key authentication.
• Webhook requests from Shopify are verified by HMAC signature before anything is acted on.
• The app requests the minimum Shopify scopes it needs: read_products, write_products and write_files. It requests no read_orders scope, no read_customers scope and no protected customer data.
• Provider credentials (Gemini and fal.ai keys) belong to the operator, are held as server environment secrets, and are never requested from or shown to merchants.

We do not claim a formal certification (no ISO 27001, no SOC 2) and we do not claim encryption at rest beyond what the hosting providers apply to their own storage.

12. Protected customer data

Capyo requests no Shopify protected customer data. Its scopes are read_products, write_products and write_files. It never receives customer names, emails, phone numbers or addresses, and it processes no order data. A future feature that needed protected customer data would only follow a separate Shopify approval and a change to this policy before it started.

13. Your rights

Under the GDPR you can ask us to:

• confirm what we hold about you and give you a copy (access, Art. 15);
• correct anything inaccurate (rectification, Art. 16);
• delete it (erasure, Art. 17);
• restrict what we do with it (Art. 18);
• hand it over in a machine-readable form, or send it to another provider (portability, Art. 20);
• stop processing based on legitimate interests (objection, Art. 21).

Email gimbernat13@gmail.com and we will answer within one month. You do not need to justify a request. Uninstalling the app starts the deletion described in section 8. Where a request concerns data the app holds on your instruction as controller — for example a generated image that lives in your own Shopify Files — we forward it to you and support you in answering rather than answering on your behalf; that split is set out in the Data Processing Agreement.

You can also complain to a data-protection supervisory authority — normally the one where you live, work, or where you believe the problem occurred.

14. Changes to this policy

When this policy changes, the new version appears on this page with a new date at the top. The version in force is the one published here.

15. Contact

gimbernat13@gmail.com — data-protection requests, security reports and everything else. See also our Terms of Service and the Data Processing Agreement.