Privacy Policy

Agentic Flow is a Shopify app that measures whether AI assistants recommend your store, and enriches your product data so they can describe it correctly. Doing that requires sending some of your catalog data to third-party AI providers. This page states exactly what leaves your store, who receives it, why, and how long we keep it.

The short version: we handle product and catalog data. We do not collect, store, or transmit your customers’ personal information.

1. Data we read from your store

The app requests the read_products and write_products scopes. It reads product titles, descriptions, images, product types, tags, and variant options, and writes back the metadata it generates as product metafields.

read_orders is an optional scope. The app works fully without it. If you grant it, we read orders only to count how many were referred by AI assistants — see section 6.

2. Weekly visibility run — what goes to OpenAI, Perplexity and Google

Once a week, the app asks AI assistants the kind of shopping questions your buyers ask, then checks whether your store appears in the answers. Each question is sent to:

• OpenAI — Responses API, with web search enabled
• Perplexity — Sonar API, with web search enabled
• Google (Gemini) — generateContent, with Google Search grounding
• Shopify Global Catalog — the public product index that AI shopping agents query. No API key and no personal data; the query is sent alongside a link to our public agent profile.

What is actually sent

Each request to those providers contains exactly two things:

1. A fixed instruction, identical for every store and every query, containing no information about you: “You are a helpful shopping assistant. Answer the user’s question directly with concrete recommendations: name specific products, brands and online stores, and explain briefly why each is a good pick.”
2. One buyer question, 4 to 12 words — for example “best waterproof hiking boots for wide feet”.

Nothing else is transmitted. No product list, no images, no customer data, no store credentials, and no Shopify access token ever reaches these providers.

About your brand name

Two to three of your tracked questions are brand questions, generated from a template — “[your store name] reviews”, “is [your store name] legit”, “[your store name] shipping and returns”. Those necessarily contain your public store name, and are sent to the providers above. All remaining questions are generic and explicitly exclude brand and store names, so that we measure organic visibility rather than prompting the assistant with the answer.

How the questions are generated

The non-brand questions are written by Google Gemini from an aggregated summary of your catalog: your top product categories with a product count, plus a few sample materials, colors, and tags per category. Individual product titles, descriptions, prices, and URLs are not included in that summary.

3. Product scans — what goes to Google Gemini

When a product is scanned, we send it to Google Gemini to generate its category, color, material, attributes, and an AI-readable summary.

Yes, your product images are sent. Specifically:

• Up to 3 images per product.
• Each is first resized to 600×600 via Shopify’s own CDN, downloaded by our server, and transmitted inline as base64 image data in the API request — not as a link.
• Alongside them: the product title and the first 500 characters of its description, as text context.

Images are not retained by us. They are held in server memory for the duration of the API call and discarded when it returns. We never write an image file to disk or to our database. What we store is only the text Gemini returns — category, color, material, attribute, summary — which is also written to your store as product metafields.

Retention on Google’s side is governed by Google’s own API terms, not by us. See the Third parties section below.

4. Shopify Global Catalog — read live, never stored

The app shows you what Shopify’s Global Catalog tells AI assistants about your products — inferred descriptions and feature lists that you can neither see nor edit in your admin.

That content is fetched live on every page load, compared in memory, and discarded. We do not cache it, and product images from the catalog are rendered directly in your browser from Shopify’s URLs, never downloaded to our servers. This is a Shopify platform rule, and it is enforced in our code by design.

What we do store from that comparison is strictly derived: which fields diverge (not what they say), which categories of sensitive claim were detected (not the claim text), and a hash used to detect change (not the content that changed).

5. Competitor data

When an AI answer recommends other stores, we record the domain names cited and, for the catalog comparison, aggregate completeness rates per domain. No competitor product title, URL, price, description, or identifier is ever stored.

6. Orders and customer data

Agentic Flow holds no customer personal data. Not names, not email addresses, not postal addresses, not phone numbers, not customer or order identifiers.

If you grant the optional read_orders scope, we query the Shopify Admin API for three things per order: its creation date, its total price and currency, and its referrer information (which site the buyer arrived from). Those orders are aggregated in memory into a daily total per traffic source and then discarded.

The only thing persisted is one anonymous row per day per source: shop, date, source (e.g. “chatgpt”), order count, revenue, currency. That row cannot be traced back to any individual buyer.

7. Email

We store the store owner email address and store name captured from your Shopify session, timestamps recording which lifecycle emails were sent, and a single opt-out flag. Emails are delivered through Resend.

Every email contains an unsubscribe link. Opening it sets a permanent global opt-out for your store and stops all further email immediately — no account, no login, no confirmation step. The link is signed, so only the recipient can use it. You can also write to us at the address below and we will set the flag manually.

8. Third parties

These are the only external services that receive data from your store:

We do not sell data, and we do not share it with advertisers, data brokers, or analytics resellers. Each provider processes data under its own terms; we do not control their internal retention.

9. What we store, and for how long

In our database (PostgreSQL, hosted on Fly.io in Paris) we keep, per store:

• Your Shopify session and access token, so the app can call the Admin API
• Your store domain, display name, primary domain, plan, and usage counters
• Per-product scan results: the category, color, material, attribute, and summary generated for each product
• Visibility history: tracked questions, and per question and engine whether you were cited, an excerpt of up to around 500 characters from the citing answer, the source URLs the engine returned, competitor domains, and a sentiment verdict
• Derived catalog-comparison verdicts (see section 4)
• Daily anonymous order aggregates, if you granted the optional scope
• Store owner email, email timestamps, and the opt-out flag

Retention rule: your data is kept for as long as the app is installed, and deleted in full when you uninstall. Deletion is triggered by that event, not by a timer.

This is a deliberate design decision, and it is worth saying why. Your weekly history is the product. A visibility measurement means nothing on its own: its value is the comparison with last week, last quarter, and the week before you fixed something. A rolling window — deleting everything older than 90 days, say — would quietly erase the very thing your subscription buys, and would do it right at the point where the history finally becomes useful. So we do not expire it.

You stay in control of the trigger: uninstalling the app deletes everything, across the eleven tables listed in the next section. Nothing is kept back, and nothing survives on a separate clock.

Two cleanups run continuously alongside this, both tied to events rather than age: scan records for products you delete from your store are removed when Shopify notifies us, and scan records left orphaned by a product that no longer exists are cleared out periodically.

10. Deletion and your GDPR rights

When you uninstall

Uninstalling immediately deletes your session tokens. Shopify then sends us a shop/redact request, normally 48 hours later. On receiving it we delete everything we hold for your store: product scans, AEO analyses, bulk scan jobs, alerts, visibility checks, catalog-comparison verdicts, tracked questions, visibility runs and their results, order aggregates, your store usage record including your email address, and any remaining sessions.

Customer data requests — stated honestly

Shopify also sends apps two customer-related requests: customers/data_request and customers/redact. We receive both, verify their signature, and log them.

Neither triggers any deletion or data export on our side, because there is nothing to delete or export. As stated in section 6, we hold no customer personal data at all: product enrichment is catalog-only, and order attribution persists nothing but anonymous daily totals that contain no customer identifier and therefore cannot be selected for, or attributed to, any individual buyer.

We would rather say this plainly than claim an erasure we do not perform. If you believe we hold personal data about you or one of your customers, write to us and we will investigate and respond.

Your rights

Under the GDPR you may request access to, correction of, or erasure of your personal data, object to processing, or request portability. For merchant data, uninstalling the app triggers full deletion as described above. For anything else, contact us at the address below. You also have the right to lodge a complaint with your local data protection authority.

11. Security

All traffic runs over HTTPS. Shopify access tokens are stored in our database and used only to call the Shopify Admin API on your behalf. Webhook requests are rejected unless their HMAC signature verifies. The scheduled visibility endpoint requires a secret compared in constant time.

12. Changes

If we change what data leaves your store, we update this page and its date. Material changes are announced by email to subscribed merchants.

13. Contact

Questions about this policy, or about the data we hold: bandiera.simon@gmail.com