Privacy Policy

Last updated: 2026-11-02

Complyft (“the App”) helps Shopify merchants display product compliance information required by EU regulations. This policy explains what data the App accesses, why, and how long it is kept.

1. Data we access

When a merchant installs the App, Shopify grants access to:

• Products — titles, descriptions, product types, vendors, tags, images, and metafields, so the App can read and write compliance fields (manufacturer, EU responsible person, warnings, identifiers), and product SKUs and barcodes, which are shown as product identification.
• Metaobjects and metaobject definitions — where compliance master data is stored.
• Store languages — to determine which languages compliance text is required in.
• Store profile — the store domain, used to identify the installation.

2. Data we do not access

The App does not request or receive access to customer records, orders, payment information, or checkout data. It never sees buyer personal data.

3. Where data is stored

Compliance data that merchants enter is stored in the merchant’s own Shopify store as metafields and metaobjects — not on our servers. If the App is uninstalled, that data stays with the merchant.

On our own infrastructure we store only the Shopify session record required to authenticate API calls: the store domain, the access token, and its scopes.

4. Retention and deletion

Session records are deleted when the App is uninstalled, and on receipt of Shopify’s shop/redact webhook. Because we hold no customer data, the customers/data_request and customers/redact webhooks return no personal data.

5. Third parties

The App runs on Render (hosting) and uses a managed PostgreSQL database (Neon) for session storage. No data is sold, rented, or shared for advertising.

AI features. When a merchant chooses to use warning translation or warning suggestions, the App sends the relevant text to Anthropic (Claude API) for processing: warning text to be translated, or product titles, descriptions, product types, vendors, and tags to be matched against warnings. This happens only when the merchant starts the action, and no customer data is ever included. Anthropic processes this data under its commercial terms, which do not allow it to be used to train AI models. AI output is only a suggestion — nothing is saved to the store until the merchant reviews and approves it.

Free GPSR checker. The public checker at /gpsr-checker reads the product page address you enter, once, to analyse it. We do not store the address or the result. To prevent abuse, the visitor's IP address is held in memory for up to 10 minutes and then discarded.

6. Not legal advice

The App provides tooling to display regulatory information. It does not provide legal advice, and responsibility for the accuracy and completeness of published compliance information remains with the merchant.

7. Contact

Questions about this policy: rewilee12@gmail.com