Privacy Policy
Last Updated: June 24, 2026
Introduction
StoreHQ, operated by InAtom Labs Inc ("StoreHQ", "we", "us", "our"), is committed to protecting your privacy. This privacy policy describes how we collect, use, and protect information across all StoreHQ products and services, including our website at storehq.ai and our Shopify applications.
By using any StoreHQ product, you agree to the practices described in this policy. We comply with GDPR, CCPA/CPRA, and other applicable privacy regulations.
App-specific data practices are detailed in the App-Specific Addenda section at the bottom of this page.
1. Information We Collect
1.1 From Shopify Apps
When you install a StoreHQ Shopify app, we access data through Shopify's APIs as authorised by the permissions you grant at install. The specific data accessed varies by app and is described in each app's addendum below.
All Shopify apps built by StoreHQ share these common practices:
- Authentication is handled via Shopify OAuth 2.0 - we never ask for your Shopify password
- We store your shop domain and OAuth access token to service API requests on your behalf
- We request only the API scopes necessary for the app's core functionality
1.2 Information You Provide
We collect information you provide directly:
- Contact details (email, name) when you reach out for support or use in-app contact features
- App preferences and configuration settings
- Support and sales communications
1.3 Automatically Collected Data
When you use our services we may automatically collect:
- Usage data (features used, actions taken, time spent)
- Technical data (IP address, browser type, device information)
- Error logs and performance metrics
2. How We Use Your Information
We use collected information to:
- Provide and improve our app functionality and services
- Respond to support requests
- Send service-related notifications
- Ensure security and prevent fraud
- Comply with legal obligations (including Shopify's mandatory webhook requirements)
- Analyse aggregate usage to guide product development
We do not use your store data to train AI models, nor do we sell it to third parties.
3. Data Sharing
We do not sell your personal information. We share data only in these circumstances:
- Service providers - trusted sub-processors who help us operate our services (see each app addendum for the specific list). They are contractually bound to protect your data.
- Legal requirements - when required by law, court order, or government request.
- Business transfers - in the event of a merger, acquisition, or asset sale, with advance notice to affected users.
- Safety - to protect the rights, safety, or property of StoreHQ, our users, or the public.
4. Data Retention
| Data type | Retention period |
|---|---|
| Active account and app data | While the app is installed |
| App data after uninstall | Most data is deleted immediately on uninstall (app/uninstalled). Any remaining data is permanently erased on Shopify's shop/redact webhook, which Shopify sends ~48 hours after uninstall. |
| Support communications | 2 years or until you request deletion |
| Legal compliance records | As required by applicable law |
5. Security
We implement industry-standard security measures:
- TLS encryption for all data in transit
- Encryption at rest for sensitive tokens and credentials
- Strict access controls and authentication on production systems
- Access limited to authorised InAtom Labs engineers
No internet transmission is completely secure. We cannot guarantee absolute security but take every reasonable precaution.
6. Data Storage Location
Data is stored on secure servers in the United States depending on the sub-processors used by each app (see app addenda). By using our apps, you consent to data transfer to these regions. International transfers comply with GDPR requirements including appropriate transfer mechanisms where applicable.
7. Your Rights
Depending on your location, you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Request deletion of your data
- Receive a portable copy of your data
- Restrict or object to certain processing
- Withdraw consent at any time
To exercise any of these rights, email us at tech@storehq.ai. We respond within 30 days.
To delete all app data immediately, uninstall the app from your Shopify Admin. Deletion is automatic and permanent upon receipt of Shopify's redact webhook.
8. GDPR (European Users)
If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority. Our legal bases for processing include:
- Contract performance - processing necessary to deliver the service you installed
- Legitimate interest - service monitoring, security, and product improvement
- Consent - where we ask you to provide information voluntarily (e.g. contact forms)
9. California Privacy Rights (CCPA / CPRA)
California residents have the right to:
- Know what personal information is collected and how it is used
- Request deletion of personal information (subject to legal exceptions)
- Opt out of the sale or sharing of personal information (we do not sell your data)
- Correct inaccurate personal information
- Non-discrimination for exercising privacy rights
10. Cookies
Our website may use cookies and similar technologies (our embedded Shopify app authenticates with App Bridge session tokens, not cookies) to:
- Maintain sessions and authentication state
- Remember preferences
- Analyse usage patterns
- Ensure security
You can control cookies through your browser settings, though disabling them may limit app functionality.
11. Children's Privacy
Our products are not intended for users under 18. We do not knowingly collect information from children. If we become aware that we have, we will delete it promptly.
12. Changes to This Policy
We may update this policy periodically. Material changes will be posted here with an updated date and, where appropriate, communicated via in-app notice. Continued use after changes constitutes acceptance.
13. Contact Us
InAtom Labs Inc Email: tech@storehq.ai Website: https://storehq.ai
App-Specific Addenda
Addendum A - StoreHQ: SEO & AEO Audit
Shopify App Store listing: StoreHQ: SEO & AEO Audit App URL: https://seo-audit.storehq.ai
A.1 Data We Access via Shopify API
This app requests the following Shopify scopes: read_products, read_content, read_online_store_pages, read_online_store_navigation.
We use this access to fetch SEO-relevant fields only:
| Resource | Fields used |
|---|---|
| Products and collections | Title, handle, SEO title/description, image alt text, media count |
| Pages and blog articles | Title, handle, body HTML, SEO title/description |
| URL redirects | Path and target |
We also crawl your live storefront pages (rendered HTML) to audit meta tags, headings, canonical tags, structured data (JSON-LD), internal links, and AEO files (robots.txt, llms.txt, sitemap.xml, agents.md).
We do not collect end-customer (buyer) PII or payment information. We store only your shop domain and OAuth credentials needed to operate the app.
Password-protected storefronts: If your storefront uses Shopify password protection, you may need to set your storefront password to the value shown in the app's Connectivity settings so StoreHQ can run rendered HTML audits. This password is used only to access your public storefront pages for scanning; we do not store your Shopify admin credentials.
A.2 Data Stored
| Data | Purpose | Storage |
|---|---|---|
| Shop domain and OAuth session | Authentication | PostgreSQL (Supabase) |
| Storefront connectivity status | Dashboard display | PostgreSQL (Supabase) |
| Scan results (scores, issues, fix hints) | Audit reports | PostgreSQL and Supabase Storage |
| Cached storefront HTML fields | Avoid redundant fetches per scan | PostgreSQL (Supabase) |
A.3 Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database and file storage for scan reports | US / EU |
| Shopify | OAuth authentication and Admin API | Global |
A.4 Data Deletion
When you uninstall this app:
- All scans, page cache, exported reports, and session records are deleted immediately on receipt of the app/uninstalled webhook
- Permanent deletion of all remaining data occurs on receipt of the shop/redact webhook (sent by Shopify 48 hours after uninstall)
- No customer data is held, so customers/redact requests are acknowledged with no action required
A.5 Shopify Mandatory Webhooks
| Webhook | Our response |
|---|---|
| customers/data_request | Acknowledged - no customer PII stored |
| customers/redact | Acknowledged - no customer PII stored |
| shop/redact | All shop data permanently deleted |
Addendum B - StoreHQ Alt Generator
Shopify App Store listing: StoreHQ Alt Generator
App URL: https://alt-text-generator.storehq.ai
B.1 Data We Access via Shopify API
This app requests the following Shopify scopes: read_products, read_files, write_files, read_content, write_content.
We use this access only to list store images, generate alt text, and write alt text back when you save or run auto-apply:
| Resource | Fields used |
|---|---|
| Shop | Name and description (brand context for generation) |
| Products | Title, description, product type, tags, collection titles, product media (image ID, URL, existing alt text) |
| Files (media library) | Image file ID, URL, existing alt text |
| Blog articles | Article ID, title, summary, blog title, featured image URL and alt text |
When you generate alt text, our servers temporarily download a reduced-size copy of each image (via its Shopify CDN URL) and send it, together with the context fields above, to Google Gemini to produce a suggested alt string. We do not persistently store image files.
We do not collect end-customer (buyer) PII or payment information. We store only your shop domain and OAuth credentials needed to operate the app.
B.2 Data Stored
| Data | Purpose | Storage |
|---|---|---|
| Shop domain and OAuth session | Authentication | PostgreSQL (Supabase) |
| Shop plan and install status | Billing tier and quota enforcement | PostgreSQL (Supabase) |
| Alt-text generation jobs | Bulk-run progress and status | PostgreSQL (Supabase) |
| Per-image generation results (image ID/URL, old alt, suggested alt, save status) | Review before save; job history | PostgreSQL (Supabase) |
| Daily API usage counters | Monthly generation quota enforcement | PostgreSQL (Supabase) |
Job queue messages (shop domain and job ID only) pass through Redis temporarily while a bulk run is processed; they are not retained after the job completes.
B.3 Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Application database | US / EU |
| Google (Gemini API) | AI alt-text generation from image + context | Global |
| Shopify | OAuth authentication and Admin API | Global |
Google processes image and text inputs only to return alt-text suggestions for your store. As stated in Section 2 of this policy, we do not use your store data to train AI models.
B.4 Data Deletion
When you uninstall this app:
- OAuth sessions, all generation jobs, and per-image results are deleted immediately on receipt of the
app/uninstalledwebhook - The shop record is marked uninstalled; daily usage counters are retained temporarily to prevent free-tier quota abuse on reinstall
- Permanent deletion of all remaining data (including usage counters) occurs on receipt of the
shop/redactwebhook (sent by Shopify ~48 hours after uninstall) - No customer data is held, so
customers/redactrequests are acknowledged with no action required
B.5 Shopify Mandatory Webhooks
| Webhook | Our response |
|---|---|
customers/data_request |
Acknowledged - no customer PII stored |
customers/redact |
Acknowledged - no customer PII stored |
shop/redact |
All shop data permanently deleted |
Addendum C — StoreHQ Compliance Scanner
Shopify App Store listing: StoreHQ Compliance Scanner
App URL: https://compliance-scanner.storehq.ai
C.1 Data We Access via Shopify API
This app requests the following Shopify scopes: read_legal_policies, read_privacy_settings, read_products.
We use this access only to read your store’s policies, privacy settings, and products so we can run automated compliance checks. The app is read-only and never modifies your store.
Specifically, we access:
- Shop — store legal policies (privacy, refund/return, terms of service, shipping) and their URLs.
- Privacy settings — cookie-consent / privacy banner configuration.
- Products — title, handle, product type, media, and selling-plan (subscription) details, used to locate a product and cart page to check.
To check your storefront and accessibility, our service loads your publicly accessible storefront pages (home page, a product page, cart, policy pages, and the account registration page) in a headless browser and runs automated checks, including accessibility (axe) scans. We read only public pages; we do not log in to, place orders on, or alter your storefront.
We do not collect end-customer (buyer) personal information or payment information. We store only your shop domain, the OAuth credentials needed to operate the app, and the results of your compliance scans.
C.2 Data Stored
All data below is stored in our PostgreSQL database (hosted on AWS RDS):
- Shop domain and OAuth session — for authentication.
- Booking record (shop domain only) — records that you booked an optional consultation call.
- Compliance scan results (scores, flagged issues, evidence, scanned URLs) — to show your report and scan history.
- Per-page scan status — to track scan progress across your storefront pages.
If you book a consultation call, your scheduling details (name, email, chosen time) are collected and held by Calendly, not by StoreHQ. Our database records only that a booking was made (your shop domain) — no name, email, or contact information.
C.3 Sub-processors
- Amazon Web Services (AWS) — application hosting, page rendering, and database (PostgreSQL). Location: US (us-east-1).
- Shopify — OAuth authentication and Admin API. Location: Global.
- Calendly — scheduling optional consultation calls. Location: US / Global.
This app does not use any AI/LLM service, and we do not use your store data to train any models.
C.4 Data Deletion
When you uninstall this app:
- OAuth sessions and all compliance scan results (scans and per-page scan records) are deleted immediately on receipt of the app/uninstalled webhook.
- Your booking record (shop domain only) is retained until the shop/redact webhook.
- Permanent deletion of all remaining data (including the booking record) occurs on receipt of the shop/redact webhook (sent by Shopify ~48 hours after uninstall).
- No end-customer data is held, so customers/redact requests are acknowledged with no action required.
C.5 Shopify Mandatory Webhooks
customers/data_request— Acknowledged; no customer PII stored.customers/redact— Acknowledged; no customer PII stored.shop/redact— All shop data permanently deleted.
Addendum — StoreHQ AI Readiness
Shopify App Store listing: StoreHQ AI Readiness
App URL: https://ai-readiness.storehq.ai
D.1 Data We Access via Shopify API
This app requests the following Shopify access scopes: read_products, read_content, read_online_store_pages.
We use this access only to read your products, store content, and online store pages so we can run automated AI-readiness checks. The app is read-only and never modifies your store.
Specifically, we access:
- Products — title, handle, description, SEO fields, images and alt text, variants (SKU, barcode, price), product category, metafields, and inventory status. Used to check catalog completeness and product-data quality.
- Content (pages and blog articles) — titles, handles, and body content. Used to check brand and site content.
- Online store pages — page URLs and publication status. Used to locate storefront pages to check.
To check crawlability and accessibility, the app also loads your publicly accessible storefront pages (home page, product pages, collection pages, robots.txt, sitemap.xml, and agent files such as llms.txt and agents.md). We read only public pages; we do not log in, place orders, or alter your store.
We do not collect end-customer (buyer) personal information or payment information. We store only your shop domain, the OAuth credentials needed to operate the app, and the results of your readiness scans.
During the full audit, two checks additionally process data through third-party services — see Sub-processors (D.3) for exactly what is sent.
D.2 Data Stored
All data below is stored in our PostgreSQL database (hosted on AWS RDS):
- Shop domain and OAuth session — for authentication.
- Readiness scan results (scores, flagged issues, evidence, sampled URLs) — to show your report and scan history.
- Per-scan progress status — to track scan progress across page loads.
- Lead record (shop domain only) — records that you booked an optional consultation call.
If you book a consultation call, your scheduling details (name, email, chosen time) are collected and held by Calendly, not by StoreHQ. Our database records only that a booking was made (your shop domain) — no name, email, or contact information.
D.3 Sub-processors
- Amazon Web Services (AWS) — application hosting, storefront page fetching, and database (PostgreSQL). Location: US (us-east-1).
- Shopify — OAuth authentication and Admin API. Location: Global.
- Calendly — scheduling optional consultation calls. Location: US / Global.
- Anthropic — AI content-quality checks. When these checks run (in the full audit), product text such as titles and descriptions is sent to Anthropic's API to assess content quality. No buyer or payment data is sent. Location: US. Anthropic does not use API data to train its models.
- ScrapingDog — JavaScript-rendering checks. When these checks run (in the full audit), the public URL of a storefront page is sent to ScrapingDog to fetch a JavaScript-rendered version of that page for comparison. Only the public page URL is sent. Location: US / Global.
We do not use your store data to train any models. The Anthropic and ScrapingDog checks run only during the full audit; they do not run during the free scan.
D.4 Data Deletion
When you uninstall this app:
- OAuth sessions and all readiness scan results (scan jobs and reports) are deleted immediately on receipt of the
app/uninstalledwebhook. - Your lead record (shop domain only) is retained until the
shop/redactwebhook. - Permanent deletion of all remaining data (including the lead record) occurs on receipt of the
shop/redactwebhook (sent by Shopify ~48 hours after final uninstall). - No end-customer data is held, so
customers/redactrequests are acknowledged with no action required.
D.5 Shopify Mandatory Webhooks
customers/data_request— Acknowledged; no customer PII stored.customers/redact— Acknowledged; no customer PII stored.shop/redact— All shop data permanently deleted.