Privacy Policy

1. Information We Collect

1.5 Customer Data

Buildora does not access, collect, or store personal data about your Shopify store's customers (such as names, emails, phone numbers or addresses). To show you the sales of your pages, it reads your store's orders without those details (section 1.6).

1.6 Sales of your pages

To show you how much each page you created with Buildora sells, the app has permission to read your store's orders (the read_orders permission; Shopify protected customer data, level 1). Shopify asks you for it when you install Buildora or approve its updated permissions. We use it only to show you in your dashboard the sales of each page you created with Buildora, and to help you get and improve those sales. Until you approve it, Buildora works the same; you just won't see sales.

What we store from each order, and only for the line items of products you created with Buildora:

• Order number and date
• Product and variant sold, and quantity
• Amount and currency
• Whether the order was cancelled or refunded

What we never store:

• Your customers' names, emails, phone numbers or addresses — we don't request them, so Shopify doesn't send them to us
• Payment or card details
• Line items of products you didn't create with Buildora
• Order notes, tags or any other customer information

We delete each order 13 months after its date. If you uninstall Buildora, we delete all your stored orders within 30 days. We don't sell these data or use them for advertising or to train AI models, and only your organization can see them. They are stored in our database (Supabase), encrypted in transit and at rest.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Buildora service
• Generate AI-powered product pages based on your product data
• Publish and sync content to your connected Shopify store
• Show you the sales of the pages you create with Buildora (section 1.6)
• Process billing, manage subscriptions, and track credit usage
• Send you service emails: billing, security and notices about your account or your store
• Send you marketing emails about Buildora to the address you signed up with, such as a discount to publish your page or to come back to a plan. You can stop them at any time by replying "Unsubscribe" to any of them or writing to hello@buildoraai.com; service emails will still arrive
• Respond to your support requests
• Detect and prevent fraud, abuse, and security incidents
• Measure which ads bring us customers, only if you accept advertising cookies (see section 9)

3. AI Data Processing

Buildora uses third-party AI services (Anthropic Claude, Google Gemini) to generate product page content. When you trigger a generation:

• Your product data (name, description, images, pricing) is sent to the AI provider to generate page content
• AI providers process your data according to their own privacy policies and data processing agreements
• We do not use your data to train AI models — Anthropic and Google do not use API inputs for model training
• Generated content is stored in our database and associated with your account

4. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We share data only with:

• Shopify — to publish products and inject theme templates into your store (via Shopify Admin API), to bill paid plans through Shopify Billing, to read your store's orders for the sales of your pages, and to create in your store the discounts of the offers you set up on your pages
• Anthropic (Claude AI) — to generate product page content
• Google (Gemini AI) — to generate product images
• Firecrawl — to scrape public product pages for data extraction
• Supabase — our database and authentication provider (data stored in Supabase-hosted infrastructure)
• Vercel — hosts the website and the app; it logs requests (IP address and browser) and counts visits without cookies (Vercel Web Analytics)
• Sentry — records errors and performance so we can fix them. In one in ten visits, and in every visit with an error, it records the session (what is clicked and how the page changes) with all text, form fields and images hidden. Data is stored in the European Union (Germany)
• Resend — sends our emails, both service emails and campaigns; it receives your email address and the message
• Crisp — our support chat. In the dashboard it receives what you write, your email, your name, your plan, your credits, how many pages you have generated and whether you have a store connected, so we can help you without asking
• Apify — extracts public data (price, ratings and reviews) from the AliExpress and Amazon product pages you import; it only receives the product address
• Meta (Facebook and Instagram) — only if you accept advertising cookies, to measure our ads (see section 9)
• TikTok — only if you accept advertising cookies, to measure our ads (see section 9)
• Law enforcement — if required by law, subpoena, or court order

5. Data Security

We implement industry-standard security measures to protect your data:

• All data is transmitted over TLS/SSL (HTTPS)
• Shopify access tokens are encrypted at rest using AES-256 encryption
• Passwords are hashed using bcrypt via Supabase Auth
• Database access is secured with Row Level Security (RLS) policies
• We follow the principle of least privilege for API scope requests
• Your store's orders are encrypted in transit and at rest, and only your organization can see them

6. Data Retention

We retain your data for as long as your account is active. Specifically:

• Account data — retained until you delete your account
• Product and generated content — retained until you delete the product or your account
• Shopify store data — deleted within 30 days after you uninstall Buildora from your store
• Orders — each order is deleted 13 months after its date, and all of them within 30 days if you uninstall Buildora
• Billing records — retained as required by applicable tax and accounting laws
• AI generation logs — retained for service operation and credit reconciliation

7. Your Rights (GDPR, CCPA & Global Privacy)

Regardless of your location, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data
• Portability — request your data in a structured, machine-readable format
• Restriction — request we limit how we process your data
• Objection — object to data processing based on legitimate interests
• Withdraw consent — withdraw consent where processing is based on consent

To exercise any of these rights, contact us at hello@buildoraai.com. We will respond within 30 days.

8. Shopify Compliance

As a Shopify app, Buildora complies with Shopify's mandatory data protection requirements:

• Customer Data Request — when a store customer requests their data, we provide any data we hold within 30 days (including the orders that Shopify lists in the request)
• Customer Data Erasure — when a store customer requests data deletion, we erase their data within 30 days (including the orders that Shopify lists in the request)
• Shop Data Erasure — within 30 days after you uninstall Buildora, we erase all data associated with your store
• Page statistics — on the product pages you publish with Buildora we count visits and clicks on "Add to cart" and "Buy now", only as daily totals per page, so you can see them in your dashboard. We don't use cookies and we don't store IP addresses or anything else that identifies your store's visitors. We only count when your store's cookie banner allows statistics (Shopify Customer Privacy API). These totals are erased with the rest of your store's data after you uninstall Buildora

10. Children's Privacy

Buildora is not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us at: