Privacy Policy

1. Who we are

SourceVision is operated by Seller Apps LLC, 9777 Satellite Blvd, Ste 160, Orlando, FL 32837, USA ("SourceVision", "we", "us"). For the website and for merchant account data we are the data controller. For the store and product data we process on a merchant's instructions, the merchant is the controller and we are the processor.

Questions and requests: legal at sourcevision.com .

2. Scope

This policy covers (a) the website at sourcevision.com and (b) the SourceVision app for Shopify, including the web application at app.sourcevision.com (together, the "Service"). Shopify's own handling of your data is covered by Shopify's privacy policy.

3. What the app reads from your store

The app asks Shopify for three permissions: read products, write products and read themes. With them it reads:

Products: titles, descriptions, images and their alt text, options, variants, tags, product type and category, the Google (search engine) title and description, and metafields.
Product pages: the public product pages of your storefront, as a shopper or an AI assistant would see them.
Theme list: your themes and the structure of your product template, so the app can show you where to place the SourceVision block. The app cannot change, publish or delete a theme.
Store and account details: your store name and domain, and the Shopify user ID of each staff account that installs or opens the app.
What you tell us: the answers you give in the app's intake about your brand and products.

The app does not read customer data or orders. It does not request Shopify's customer or order permissions. Shopify still sends every app its mandatory privacy webhooks (customer data request, customer redaction and shop redaction); we answer them as described in section 7.

4. What the app writes, and only after you approve

The app proposes changes; you approve each one. Nothing is written to your store before you approve it. After approval the app may write:

the product description;
the product's Google title and description (the search engine listing fields; when one is changed, the other is re-sent unchanged, and the preview shows both);
the app's own product metafields (namespace sourcevision);
the content of the SourceVision block (What is it, Who is it for, How does it work, How is it different, Questions from shoppers), stored in those metafields and shown by the block you place in your theme.

After each write the app reads the product back to check the change landed, and records the result. The app never writes medical or outcome claims, and it does not edit fixed product text such as directions or ingredients.

5. Research and drafting

Research. To measure how AI assistants describe and recommend your products, we send shopper-style questions (for example, "a gentle soap for dry skin") to AI assistant providers and to DataForSEO for search data, and we record the answers. The questions name products and brands, not people.
Drafting. To draft a proposal we send the relevant product content and your intake answers to an AI model provider. No customer personal data is included. The AI assistants we query (OpenAI, Google Gemini and Perplexity) receive the question and your product's public page text through their APIs. Under the API terms we use, none of them trains its models on that data: OpenAI does not use API data for training by default and may keep it for up to 30 days to detect abuse; Google does not use Gemini API Paid Services prompts or responses to improve its products and logs them for a limited time to detect abuse; Perplexity does not use API data to train its models and does not retain it.
Benchmarks. We may compute category benchmarks from research answers across stores. They are aggregated; no store's product facts, ledger or account data are disclosed to another store.

6. What happens when you uninstall

At uninstall. When Shopify tells us the app was uninstalled, we immediately delete the store's access credential and revoke the store connection. Everything else waits for Shopify's redaction request or for the 30-day anonymization described below.

On Shopify's redaction request. Shopify sends a shop redaction request 48 hours after an uninstall, or when a merchant asks Shopify to erase their data. We then delete:

your intake answers: facts, competitors, channels, hero and promoted products, category, and the brand spellings you gave us;
every pending (undecided) proposal;
the staff user records Shopify gave us;
the connection's settings;
the imported product records that nothing we keep refers to;
the one-time security codes (nonces) used to install the app.

We make these deletions within 30 days of uninstall, or sooner after a redaction request from Shopify (48 hours after uninstall).

What we keep, and why. We keep the ledger of every change the app made to your store (what was sent, what it replaced, who approved it, when, and whether it was verified), the page snapshots the ledger explains, the brand context and research versions each proposal was drafted from, the questions your store was measured with, the AI assistants' answers and the scores drawn from them, and the proposals a person decided. We keep them because they are our record of the changes made on your instruction and of how AI assistants described your products. None of it is customer data.

After 30 days. Thirty days after an uninstall, your store's identity is anonymized: the store name, store domain, brand name and brand spellings are removed from our account records and replaced by a neutral marker. The records we keep of changes and research can still contain your product text, and that text may name your brand.

Deleting sooner. To ask us to delete your data sooner, send us a message through the contact form. Every deletion and every retention is recorded, so we can tell you exactly what was removed.

7. Other records and customer requests

Website analytics and app usage events: see section 9.
Support email: Support emails are kept until you ask us to delete them. We keep them to resolve your request, to improve customer service, and to improve the app's performance and features.
Customer requests. We hold no customer personal data. When Shopify forwards a customer data request or a customer redaction request, we record it and confirm there is nothing to return or delete. A shop redaction request is answered as section 6 describes.

8. Who processes data for us

We use these processors to run the Service, under contracts that restrict their use of the data. We do not send customer personal data to any of them.

Shopify: installation, permissions, the store data the app reads and writes, and billing.
Cloudflare: hosting of the website and the app, content delivery and request logs.
Supabase: our database, where account, product, proposal, ledger and research data are stored.
DataForSEO: search data for the research questions.
OpenAI, Google and Perplexity: AI model providers, for research (asking shopper-style questions) and for drafting proposals. Google also provides Google Analytics (section 9).
Hetzner (Germany): the provider hosting our background job server.
Resend: our email provider.

We do not sell or share personal information for advertising.

9. Website and app analytics

Website. Cloudflare records request logs (IP address, user agent, page, time) to serve and secure the site. We use Google Analytics 4 to see which pages visitors find useful: pages viewed, referring site, approximate location, device and browser. It sets first-party cookies (_ga and _ga_*) that last up to 13 months. In the EEA, the UK and Switzerland these cookies are set only if you accept them in the banner; elsewhere you can decline in the same banner. The website sets no advertising cookies.
App. Our servers send a small, fixed set of usage events to Google Analytics (for example, a proposal approved or a change applied). Each event carries only a random installation identifier we generate: no names, emails, IP addresses, product content or customer data. Because that identifier maps to one store in our database, the events are pseudonymous. The app sets no analytics cookies in your Shopify admin. Google Analytics event retention: 2 months.

10. Legal bases (EEA and UK)

We process merchant account data to perform our contract with you; research answers and benchmarks on our legitimate interest in providing and improving a measurement service; website analytics cookies in the EEA, UK and Switzerland on your consent; and email you send us on your request. Where we act as your processor, we process store data on your instructions.

11. International transfers

Our processors may handle data in the United States and the European Union. Where data leaves the EEA or the UK we rely on an adequacy decision or standard contractual clauses. Supabase project region: us-east-1 (N. Virginia, USA).

12. Your rights (GDPR and UK GDPR)

You can ask us to access, correct, export or delete your personal data, to restrict or object to processing, and to withdraw consent where we rely on it. Write to legal at sourcevision.com with "Privacy request" in the subject. We answer within one month. You can also complain to your data protection authority. We have not appointed an EU or UK representative.

13. California residents (CCPA)

We collect the business contact details and usage information described above for the purposes in sections 3 to 9. We do not sell personal information and do not share it for cross-context behavioral advertising. You can ask to know, correct or delete the personal information we hold about you by writing to legal at sourcevision.com . We verify a request against the email on the Shopify account, and we will not treat you differently for using these rights.

14. Security

Data is encrypted in transit. Store access credentials are kept in an encrypted vault and referred to by name inside our systems. Every write to your store is read back and logged. Access to production systems is limited to the people who operate the Service.

15. Children

The Service is for businesses and is not directed at anyone under 18.

16. Changes

We post changes on this page and update the date at the top. For material changes affecting app users we also email the account address.

17. Contact

Seller Apps LLC, 9777 Satellite Blvd, Ste 160, Orlando, FL 32837, USA. Privacy and support: legal at sourcevision.com .