Privacy policy

Last updated 5 October 2026

Shopicraft Solutions ("we") makes a set of small Shopify apps that share one backend:

This policy covers all of them. The short version: we keep little, and nothing that identifies one of your customers.

1. What we store

When you install one of the apps we store an install record for your store: the store's myshopify domain, the app you installed, the plan you are on and the dates it changed, and the dates of install, last use and uninstall. We also store the Shopify access token the app needs to read your plan, encrypted at rest. The record also notes when the app first worked for your store (a widget switched on in your theme, a first report opened) and when Shopify's review window was shown to you and what it answered. If you answer the question the app asks when you first open it, we keep your answer; if you tick the box that lets us email you, we keep the address you type, only to help you set the app up. Withdraw it in the app's Help card, or write to us, and the address is deleted.

Floating Video additionally stores the video links and captions you add in the app.

Mystery Shopper stores the walks it makes of your own storefront: the score, what each of its checks measured, the report written from that, and the screenshots the shopper took of your pages. On the phone it runs an automated accessibility check of each page it visits and keeps which rules failed, with a few short lines of your pages' own code as examples. It also keeps a count per day, for your store as a whole, of eight storefront events: page views, product views, adds to cart, cart views, products taken back out of the cart, checkouts started, payment details entered and orders. Five of those are also counted per product, so the app can say which products are carried to the checkout and not bought; a product is your catalogue, not your visitor. If your storefront is password protected it stores that password, encrypted at rest, because otherwise the shopper cannot get in. Nothing in any of it is about one visitor.

When you ask Mystery Shopper to fix something (Fix it, Autopilot or Fix my top 5), it also keeps, for each change, what the field said before and what it wrote: a photo's alt text, a product's search title, search description or description, a policy page. That record is what lets you undo a fix. With the nightly watchdog on, it keeps the result of each night's walk for fourteen nights, and the walk itself only when something broke. Store health keeps, per walk, what it found: broken links on your pages and menus, heavy images, and automatic discounts that overlap. If you compare your store with a competitor, the walk of that other store is kept apart from yours, never in your history or score, and another Mystery Shopper merchant who names the same store in the same week sees that same walk.

If you connect Google Search Console to Mystery Shopper, it stores the connection: the email address of the Google account you connected, the Search Console property you chose for your store, the permissions Google granted, the date, and the refresh token Google issues, encrypted at rest. Of the numbers Search Console returns it keeps only two things, so it can tell you later what happened: for each page a fix changed, that page's clicks, impressions, click rate and average position over the 28 days before the change and the 28 days after it, with the searches the fix was for; and the Google alerts it raised (the page or search, and its numbers for the two weeks compared). See "Google user data" below.

Product Reviews stores the reviews your shoppers write on your product pages: the star rating, the title, the text, the name the shopper typed, the product it is about and the date. The name is the one piece of personal data in it. We do not ask for an email address and we do not read your orders, so a review is never tied to a customer record; a shopper who wants their review removed writes to you, and you delete it in the app.

Appointment Booking stores the bookings your shoppers make on your product pages: the time, the service, the name, email address and, if you ask for it, the phone number the shopper typed, the note they left, their time zone and the storefront language, and for a paid booking the number of the order that paid for it. This is personal data about your customers, kept so the app can confirm the booking, remind them of it, let them cancel it and show it to you. It also keeps your calendar settings and the name, email address, domain and time zone of your store as Shopify reports them.

Bought Together stores the pairs you choose in the app (a product and the products shown with it), your set discount, and a count per product per day of how often its block was seen, clicked and added to the cart, and of the orders and revenue from the lines it added. Nothing in it is about one shopper.

Back in Stock stores the requests your shoppers make on a sold-out product: the email address the shopper typed, the product and option, whether they ticked the box to also get your news, the date, and whether the email was sent, clicked and followed by a purchase of that option. The email address is personal data about your customers, kept only to send the one email they asked for and to let you see who asked.

That is the complete list. The settings of the other apps live in your theme, inside Shopify, and never reach our servers.

2. What we read but do not keep

Sales Popup reads your recent paid orders to show a notification such as "Anna from Girona just bought a mug". From each order it reads the first name and city of the shipping address, the product title and image, and the time of the order. It never reads a surname, email, phone number, street address or payment detail. Orders are read live, cached in memory for five minutes, and not written anywhere. On the free plan even the first name and city are dropped before the notification is sent to your storefront.

Appointment Booking reads each new, paid or cancelled order to find the booking it pays for: the order number, its payment status, and for each line the product and the booking reference the calendar put on it. It does not read the customer, the address or the payment details of an order. It reads the title and price of the product a booking is made on, so a price cannot be changed from the page.

Bought Together and Back in Stock read each new order only for its lines: Bought Together the lines its block added, to count the revenue, and Back in Stock the line of an option one of its emails brought back, found by a code the email's link puts on the cart. Neither reads the customer, the address or the payment details. Back in Stock reads the product, option, price, picture and stock of what a shopper waits for, to know when it is back and to write the email.

Mystery Shopper reads your storefront during a walk the way a visitor would, and reads your products through Shopify's API to check your catalogue, and your theme (its name, and its files to say where a fix goes). Neither is kept beyond the report it writes. If you grant it, Store health reads your navigation menus and your automatic discounts to check them, and Autopilot is told by Shopify when a product is created or changed, and reads that product to see what it lacks.

The "watch a shopper on your store" page on our website walks the public storefront whose address a visitor types, on our servers, and shows the screenshots and three findings. It keeps the walk and its screenshots for thirty days so a shared link keeps working, and the visitor's address only as a keyed hash, for a day, to limit how many walks one address can ask for. To tell people from robots, the page uses Cloudflare Turnstile, which reads signals from the visitor's browser under Cloudflare's own privacy policy. It walks only stores that are open to the public, and a store owner who wants a walk taken down writes to us.

No app tracks your visitors. The storefront widgets read the page and the cart in the visitor's browser and send nothing to us, except for Sales Popup, Floating Video and Product Reviews, which fetch their content through Shopify's App Proxy without any visitor identifier, and Appointment Booking, which fetches the free times the same way and sends us a booking only when the shopper makes one. Bought Together sends a count when its block is seen, clicked or used, with no visitor identifier. Back in Stock sends us the shopper's email only when they submit its form. A request address is used, hashed, for a day (an hour for Back in Stock), to limit how many bookings, reviews or requests one address can send. Mystery Shopper's pixel does send something, and this is all of it: your store's id, which of the five events happened, whether the screen was narrow or wide, and the time. No visitor identifier, no cookie, no cart, no price. The server adds it to that day's total for your store and forgets the request.

3. What we do with it

Only run the app: know which plan you are on, show the right settings, and answer Shopify's webhooks. We do not sell the data, we do not use it for marketing, and we do not analyse it across stores. Our hosting provider (Microsoft Azure, EU region) processes it on our behalf.

Mystery Shopper is the one app that sends anything to a third party, and it does it twice. To write the report as sentences rather than a list of failed checks, the measurements from a walk and up to four of its screenshots go to Google's Gemini API, which writes the text and returns it; the findings themselves are decided by our own rubric before the model sees anything. And if you connect your own AI client to the app, that client reads the walks you point it at: you make that connection, and you can revoke it in the app at any time. Neither carries anything about your customers. When you ask it to fix something, the product's title, description, options and photos, or the facts you type for a policy, go to Gemini too, so it can draft the new text; nothing is written to your store until it passes our own check and, except for Autopilot and Fix my top 5, which you switch on or pay for, until you approve it.

Google user data

Mystery Shopper can read Google Search Console for your store, only if you connect it. It asks Google for read-only access (webmasters.readonly), plus your Google account's email address so the app can show which account is connected. It cannot change anything in Search Console. It reads, for the one property that is your store's own domain: search performance (clicks, impressions, click rate and average position per search, page, country and device), URL Inspection of the pages its walk read or that lost their search traffic, and your sitemaps. It reads when you open the Search Console section or ask your AI connector, before each walk to start where Google sends people, and once a day for the Google alerts and, if you switch it on, for Autopilot's Google rewrites. Other sites your Google account can see are listed once, to find your store's property, and never read or kept. Apart from the before and after of a fix and the alerts described above, what Search Console answers is held in our server's memory for at most an hour, then discarded. None of it is ever used to compare stores.

Mystery Shopper's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use that data only to show you, in the app and through the AI connector you connect, your store's search numbers, the search traffic at stake on each of the app's fixes, what changed after a fix, alerts about your own pages and searches, the page a walk starts from, and which of your pages Autopilot rewrites when you switch it on. We do not sell it, do not use it for advertising, do not use it to train any AI model, do not let anyone read it, and do not transfer it to anyone, except our hosting provider processing it on our behalf, as the law requires, or when you ask your own AI client to read it. Disconnecting in the app revokes the access at Google and deletes the stored connection, the kept before and after of your fixes and the alerts at once; you can also remove the access from your Google Account's security settings at any time.

The nightly watchdog emails you, through Microsoft Azure Communication Services, only on a night when something broke, at the address you gave the app.

Appointment Booking sends emails on your behalf through Microsoft Azure Communication Services: the confirmation, the cancellation and, on Pro, the reminder to your shopper, with your store's email as the reply address, and the notice of each new or cancelled booking to you. On Pro you can subscribe your own calendar to a private link that lists your bookings with the shopper's name and contact; anyone you give that link to can read it, and a new link in the app stops the old one.

Back in Stock sends, through the same service, one email to each shopper who asked, when the option is back, in your store's name. Every email carries a link that deletes the request at once. Whether a shopper ticked the box for your news is shown to you in the app and its export; we never write to them for anything else.

4. How long we keep it

While the app is installed. Mystery Shopper keeps your last three walks on the free plan and your last twenty-six on Pro; as new ones arrive the older ones go, and their screenshots are deleted with them. Uninstalling deletes every walk, every screenshot, the daily counts, the storefront password, the record of every fix, the watchdog's nights and the store health results, and revokes and deletes the Google Search Console connection. Uninstalling Product Reviews deletes every review, including the names on them.

Appointment Booking deletes a booking twelve months after its time has passed, and a booking whose order never came (a shopper who left the checkout) after seven days. Uninstalling it deletes every booking at once.

Back in Stock deletes a request 180 days after its email was sent, and a request that was never answered after a year. Its requests and Bought Together's counts are deleted when Shopify sends its redaction request, 48 hours after you uninstall, so a reinstall the same week still finds them.

When you uninstall, the access token is deleted immediately and the install record is deleted when Shopify sends its redaction request, 48 hours later. Shopify's customer data requests and redaction requests are answered automatically. Appointment Booking and Back in Stock are the apps that hold customer data: a redaction request deletes every booking made with that customer's email address or paid by one of their orders, and every back-in-stock request with that email address; a data request is answered from the lists in those apps. The other apps hold none, so there is nothing to return or erase, and we say so in our reply.

5. Your rights

You can ask what we hold for your store, ask for it to be corrected or deleted, or object to its processing, by writing to support@shopicraft-solutions.com. We answer within a working day and delete within 30 days at most.

6. Changes

If this policy changes in a way that matters, the date at the top changes and we tell you inside the app.

7. Contact

support@shopicraft-solutions.com