Privacy policy

Effective date: 7 October 2026

Who operates VelvetDock

Hakan Tombak, trading as VelvetDock. Triq il ftieh, Malta Contact: destekvelvet@gmail.com.

We act as controller for our merchant relationship, support and service-security information. For store content processed on a merchant's instructions, the merchant determines its purpose and we act as service provider/processor. Contact us for data-processing terms before using the app to process personal information.

Information processed and purposes

We process your myshopify.com domain, authenticated staff identifier and owner status to secure access. Shopify access tokens are held in server memory, not in our application database. Product IDs, titles, status, descriptions, SEO fields, image URLs, supplied product facts, generated drafts and before/after snapshots are used to scan, prepare changes, apply approved updates and offer restoration. One-time purchase IDs, amounts, currency and status are used to verify payment and resume work. Shopify processes payments; we do not receive card numbers.

We do not request Customer or Order API scopes, install tracking pixels, or add advertising cookies. Product text may nevertheless contain personal information supplied by a merchant. Do not include customer details, sensitive data or secrets in product facts or descriptions sent for AI generation. We receive limited customer identifiers when Shopify sends a privacy request and use them only to handle that request. Support messages and hosting security logs may also contain personal information.

AI and other recipients

AI generation is optional. When you select it, approve payment and request generation, the selected product identifier, name, plain-text excerpt of its description and your supplied facts are sent to Groq. Generated text must be reviewed before applying it. No customer/order API records or Shopify access tokens are sent to Groq.

Groq processes inference requests under its data policy. Reliability/abuse logs can contain inputs and outputs for up to 30 days, or longer if legally required, unless Zero Data Retention is enabled for the account. We do not promise zero provider retention. Railway hosts the application and database. Shopify handles authentication, product/file storage and billing. Checking external description images contacts their source hosts, which receive the requested URL and our server network information. Providers may process data outside your country, including the United States. Contact us for the applicable processor terms and transfer safeguards; provider controls are separate from deletion in this app.

Retention and deletion

Saved scans, drafts, runs, original-content backups and privacy-request records are accessible for up to 30 days from creation, or until deleted earlier. Expired records are blocked from access; background cleanup runs hourly when no store action is in progress, and on startup. Active work can delay physical cleanup, but cannot extend access to expired records. Only the five latest scans per staff account are kept. Usage counters and pseudonymous deletion/delivery receipts are retained for up to 30 days. Pending requests must be handled within that period.

Use Data & privacy in the app to download or permanently delete the working records associated with your authenticated staff account. Other staff members' records are separate. Uninstalling the app requests removal of all store records on receipt of Shopify's uninstall webhook; shop/redact is also supported. In-progress work is allowed to settle before erasure, and new work is blocked during erasure. Removing app records destroys the corresponding restore history; it does not undo product edits, delete copied Shopify files, cancel charges, issue refunds or delete Shopify's own billing records. Downloaded exports are under your control.

Application payloads are encrypted in the database when the deployment encryption key is configured (required for production). Ownership metadata is still stored for access control. Deleted database pages are cleared and the active write-ahead log is checkpointed. Infrastructure snapshots, provider logs, support correspondence and merchant-downloaded backups are separate: contact us for deletion requests concerning these copies. We will restrict retained copies and coordinate deletion subject to applicable law and provider capabilities.

Your rights and requests

You may request access, correction, deletion, restriction, portability or object to processing where applicable, and withdraw consent where processing relies on consent. Email destekvelvet@gmail.com with your store domain and the nature of the request; do not send passwords or API keys. We verify identity and authority before disclosing or deleting information. We aim to respond within one month; if a lawful extension or retention exception applies, we explain it. Customers should normally contact the merchant controlling their store data. Shopify privacy notifications are verified and made available to the store owner. Matching email/phone references in retained product records are removed for customer-redaction requests; the merchant and operator must also review references that cannot be matched automatically and related support/provider records.

Where GDPR applies, merchant-service processing relies on performance of a contract, service security on legitimate interests, and required compliance records on legal obligations, as appropriate. You may complain to your competent data protection authority, including Malta's Information and Data Protection Commissioner. We do not sell personal information or use it for targeted advertising.

Security and changes

We use authenticated store/staff isolation, HTTPS, limited API permissions, verified webhook signatures and server-side payment checks. No system is risk-free. Material changes to purposes or recipients will be reflected in this policy and communicated when required. Contact destekvelvet@gmail.com for privacy, security or data-processing questions.