Privacy Policy
Last updated: 29 July 2026
1. Overview
Code Magic: Altify AI (“the App”, “we”, “us”) is a Shopify embedded application that helps merchants manage and improve the alt text, SEO metadata, and accessibility of their store media. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.
2. Data We Collect
We collect and store only the minimum data required to operate the App:
| Data type | Purpose |
|---|---|
| Shop domain (myshopify.com) | Identifies the merchant account; required for Shopify OAuth |
| Shopify OAuth session token | Maintains authenticated access to your store's Admin API |
| Media metadata (image URLs, Shopify media GIDs, alt text, product/collection/article titles) | Powers the Media Library, alt-tag editor, templates, and CSV export features |
| Scan job records | Tracks the progress and status of store media and accessibility scans |
| Alt-text templates | Stores templates the merchant creates for bulk alt-tag generation |
| Activity log entries | Records bulk operations (scans, imports, exports, AI generations) for the merchant's history view |
We do not collect, store, or process any personal data about your customers (shoppers). The App only accesses your store's media catalogue — no order data, customer names, emails, or payment information is ever read or stored.
3. How We Use Your Data
- To authenticate and maintain your session with the Shopify Admin API
- To scan and display your store's media in the App's Media Library
- To write updated alt text and metadata back to your Shopify store via the Admin API
- To apply and manage alt-text templates across your media catalogue
- To provide CSV import and export functionality
- To generate AI-powered alt text using a provider (OpenAI, Anthropic, Gemini, Groq, or Kimi) that you configure with your own API key
- To run WCAG 2.1 accessibility audits against your public storefront
We do not sell, share, or rent your data to any third party for marketing purposes.
4. Third-Party Services
The App uses the following third-party services:
- Shopify Admin API — to read and write media and metadata in your store
- Your chosen AI provider (OpenAI, Anthropic, Google Gemini, Groq, or Kimi/Moonshot) — to generate AI alt text (Pro plan only). Image data is transmitted directly using the API key you supply; no shop or merchant data is stored by us in the process.
- Hosting provider — the cloud host where the App server and database run, secured over HTTPS.
5. Data Retention & Deletion
All data associated with your shop is deleted automatically when you uninstall the App. This includes session tokens, media records, scan jobs, templates, and activity logs.
To request early deletion of your data, contact us at the email address below and we will process the request within 7 business days.
6. GDPR Compliance
The App implements all mandatory Shopify GDPR webhooks:
- customers/data_request — We store no personal customer data. Requests receive a confirmation response.
- customers/redact — We store no personal customer data. Requests receive a confirmation response.
- shop/redact — All shop data is permanently purged from our database.
7. CCPA (California Consumer Privacy Act)
If you are a California resident, the CCPA grants you additional rights regarding your personal information:
- Right to Know — described in Section 2 above.
- Right to Delete — contact us at the email below and we will process the request within 7 business days.
- Right to Opt-Out of Sale — we do not sell, rent, or trade your personal information. There is nothing to opt out of.
- Right to Non-Discrimination — we will not discriminate against you for exercising any of your CCPA rights.
Note: Code Magic: Altify AI is a business-to-business application. The personal information we collect relates to merchant (business) accounts, not end consumers. We do not collect or store any personal information about your store's customers.
8. Security
All data is transmitted over HTTPS. Access to the App requires a valid Shopify OAuth session. API secrets and database credentials are stored as environment variables and are never exposed to the browser. Any AI provider API key you supply is encrypted at rest in our database and is never exposed to the browser.
9. Contact
If you have questions about this Privacy Policy or wish to request data deletion, please contact us at apd12121998@gmail.com.