Data and privacy

← Back to documentation

This page explains, in plain terms, what the app asks permission for, what leaves your store and where it goes, what is kept, and what happens when you uninstall. The privacy policy is the formal version.

The permissions the app asks for

Permission	Why Octolift needs it
View and edit products	Read everything the analysis looks at (title, description, type, category and its fields, variants, media, availability), and write the title, description, category and category fields you approve. Editing covers reading; nothing is written without your approval.
View and edit metaobjects	Category field values in Shopify are entries in its taxonomy; when you pick a value a store does not have yet, Octolift creates that entry so the field can be set.
View metaobject definitions	To find out which entry type a category field uses, so the value above can be written to the right place.
View themes	To read whether the Octolift theme app embed is switched on. No theme file is modified, and no feature depends on the embed.
View reports	To read the aggregate sales Shopify attributes to AI assistants, for the Agentic sales cards. Aggregate totals only, never individual orders or customers.

What leaves your store

Analysing a listing and writing suggestions is done by a large language model at one of three providers: OpenAI, Anthropic and Google. Which one receives a request depends on the model in use: scoring uses the fixed rating model, and suggestions use the model you chose on the Plan and model page. What is sent:

• The product's title, product type, category, category field values and description (its first part when very long), with the word count.
• For the category audit: the names of the category's attributes, their current values and the values Shopify allows.
• For suggestions: the gaps found by the scan and the candidate categories, so the model writes for the checks.
• When Octolift tests how an assistant would answer a shopper's question about the product: the AI catalog's summary of the product (its options and price range included) and text excerpts of up to three of the policy pages the catalog links for your store (refund, shipping, privacy, terms of service).

We use these providers' paid API tiers, whose terms state that submitted content is not used to train their models. The shopper questions and their rankings go to Shopify's global AI catalog, which is Shopify's own service, and the sales totals come from Shopify's analytics.

What is stored

• Store profile: the store domain, name, plan, country and currency, plus the contact details Shopify gives installed apps, so we can run the app and support you.
• Your account: the name and email of the store owner, captured when they open the app. It is where the welcome, goodbye and rating emails go, what identifies you in the support chat, and what the Resend contact is keyed on. Staff members who open the app are recognised for the chat but not stored.
• Scores: the last score of each analyzed product, with the previous one, so the Products page can show them.
• Change history: for every change you apply, the field, the previous value, the new value, the suggestion it came from and whether you edited it. This is what the undo uses. It is kept for 30 days and then deleted.
• Tracked questions: the questions you track per product and country, with the rank and the winning listing at the time of the check.
• Usage: how much of the allowance each period used, and the size and cost of each model request, without its content.
• A snapshot of that product's 30-day agentic sales (orders and revenue) at the moment you apply a title or description change, so the effect of a change can be measured later.

Results such as scan verdicts, the shopper questions and the sales totals are cached for a while (from an hour up to 30 days) so that reopening a product is quick and does not repeat work.

What is never read or sent

• Individual customers or orders. Octolift only reads aggregate sales totals.
• Your Shopify access tokens, customer data or order data to any model provider.
• Anything to an advertising or tracking network. There is no analytics script in the app.

Emails you receive

All from Octolift at notifications.craftshift.com: a welcome email on your first install, a short goodbye when you uninstall, and, only if you rate the app inside it, either a personal note from us after a low rating or a one-off request to review on the App Store the day after five stars. Reply to any of them to reach us. Support chat runs on Crisp (which receives your store domain and contact email so we can help you), and the emails are sent through Resend (which holds a contact with your email, first name, store domain, Shopify plan, country, whether the store is a development store, the install date and whether the app is still installed). Both are listed in the privacy policy.

Uninstalling and deletion

• Immediately: Octolift's access to your store is revoked and all processing stops. Nothing you applied is reverted; that content is your own product content and stays exactly as it is.
• About 48 hours later: Shopify sends the request to erase your store's data and we delete the scores, the change history, the tracked questions and your contact details. Our own billing records (how much each period used) carry no personal or product content and are kept.
• Reinstalling before that erasure brings your history back; after it, you start fresh.

To exercise a data request under GDPR or CCPA, or to ask anything about this page, email support@craftshift.com.

Related guides