Privacy policy

1. Who we are

SmartConvertAI is a Shopify app operated by Elkad SAS, a company registered in France (TODO — registered office address). We are the data controller for the data described below. Contact: support@elkad.fr.

2. Data we collect

For every store

• Store identity: your myshopify.com domain.
• Shopify credentials: access tokens issued by Shopify, used only by our servers and never sent to your browser.
• Staff account details that Shopify shares when a staff member opens the app (name, email, locale), used to authenticate the session.
• Pages you submit: the URLs of public pages of your store and their page type.
• Audit data: rendered page content, screenshots, scores, recommendations, their status and your 👍 / 👎 feedback.
• Technical logs: request logs (time, route, status) for security and debugging.

If you activate the AI Developer

• Your theme files: read through Shopify’s theme API and kept in a private code repository dedicated to your store, so the agent can work on them and every change can be reviewed and undone.
• Your requests: the messages you send, attached screenshots, the agent’s replies, and comments from our team if you ask for a review.
• Change history: a log of every theme write (allowed or refused), theme backups and AI usage per request.
• Optional backup on your GitHub: if you connect your own GitHub account, a copy of your theme code is pushed to a repository you own. You can disconnect at any time; uninstalling removes our access, and the repository stays yours.

The CRO audit requests no Shopify permission. The AI Developer requests theme access (read_themes, write_themes) only when you activate it.

3. Data we do not collect

We do not access your orders, customers, payment information or checkout data. We add no script or cookie to your storefront. If a page you submit displays personal data (for example a review with a first name), it may appear in the screenshots of that page.

4. Why we use it (legal basis)

• Providing the app you installed: audits, AI Developer, support (performance of a contract).
• Security, abuse prevention and debugging (legitimate interest).
• Improving the quality of recommendations using your feedback and anonymised quality checks (legitimate interest). We do not use your data to train AI models.
• Billing, handled by Shopify (performance of a contract, legal obligations).

We never sell or rent your data, and we don’t use it for advertising.

5. Who processes it

Anthropic does not train its models on data sent through its API. Transfers outside the European Economic Area are covered by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

6. How long we keep it

• While the app is installed: until you delete it. You can delete a page and all its audits from the app at any time.
• When you uninstall: access tokens and sessions are deleted right away. When Shopify sends the shop/redact request (48 hours after uninstall), we erase all remaining data for your store: database records, screenshots and attachments, the private theme repository, and our access to your GitHub backup if you connected one.
• Technical logs: 30 days.

7. Your rights

Under the GDPR and similar laws (including the CCPA), you can access, correct, export or erase your data, object to or restrict its processing. Most of it is visible and deletable in the app; for anything else, email support@elkad.fr. We answer within 30 days. You can also complain to the French data protection authority (CNIL, cnil.fr) or your local authority.

We handle Shopify’s privacy requests (customers/data_request, customers/redact, shop/redact). As we hold no data about your customers, customer requests usually have nothing to return or erase.

8. Security

• HTTPS everywhere; database and storage encrypted at rest.
• Shopify tokens are never exposed to the browser and are redacted from logs.
• Each store’s theme repository is private and reachable only with a token limited to that repository.
• Access to production systems is limited to the people who need it.

9. Cookies

This website uses no advertising or tracking cookies. Inside your Shopify admin, the app authenticates with Shopify session tokens, not third-party cookies.

10. Changes

We will tell you in the app before a material change takes effect. The current version is always at this address.

11. Contact

Elkad SAS — TODO — registered office address — support@elkad.fr