Privacy Policy — ecomwiz

Last updated: 2026-05-10

ecomwiz ("we", "us", "our") is operated by Ondřej Filipi, IČO: 14336561, a sole trader registered in the Czech Republic. This policy explains what data we process when you install and use our Shopify app, why we process it, where it lives, and how to exercise your GDPR rights.

1. Data we process

From your Shopify store

Product catalog metadata. Product GID, title, handle, vendor, product type, body HTML, primary image URL, status. We mirror these into our database so the studio UI can paginate and search without hitting Shopify Admin on every keystroke.
Shop metadata. Your myshopify.com domain, primary locale, shop name, OAuth scopes granted, and the OAuth access token used to call the Shopify Admin GraphQL API on your behalf.
Generated media. Each AI image we generate is stored on our infrastructure for 60 days for review/regenerate, then purged unless you push it to your store (in which case Shopify holds the file).

From Shopify customers

None. ecomwiz does not read, store, or transmit any customer-level data. We do not access read_customers, read_orders, or any customer PII scope. The mandatory GDPR webhooks (customers/data_request, customers/redact) are answered with an acknowledgement that we hold no data for the customer in question.

From you (the merchant operator)

Email and account info. When you contact support or set up billing notifications.
Usage analytics. App page views, generation actions, and Web Vitals (LCP/CLS/INP) for performance monitoring. No keystrokes, no replays, no third-party tracking pixels.

2. Why we process it

Data	Purpose	Legal basis (GDPR)
Product catalog	Provide the core service (browse + generate + push)	Contract performance
Shop metadata + OAuth token	Authenticate API calls back to your shop	Contract performance
Generated media	Let you review and re-generate within 60 days	Contract performance
Email	Customer support, billing receipts	Contract performance
Usage analytics	Performance monitoring, BfS compliance	Legitimate interest

We do not sell data, do not advertise to your customers, and do not use your catalog to train third-party AI models.

3. Subprocessors

Processor	Purpose	Region	DPA
Replicate, Inc.	AI inference	US (we route via EU endpoints when available)	Yes
Shopify Inc.	Hosting of your store; OAuth issuer	US/EU	Shopify DPA
Cloudflare R2 / EU	Image storage + CDN	EU (Frankfurt)	Cloudflare DPA
Supabase EU	Postgres database	EU (Frankfurt)	Supabase DPA
Resend	Transactional email	US	Resend DPA

Adding or removing subprocessors triggers a 30-day notice period to all active customers via in-app banner and email.

4. Where data lives

Database (Postgres): EU-Central (Frankfurt) on Supabase.
Object storage: Cloudflare R2, EU jurisdiction.
AI inference: Replicate's nearest available region. The reference image and prompt are sent to Replicate; outputs are downloaded to our EU storage immediately.

We are not subject to US Section 702 surveillance because the operator is an EU natural person processing in EU regions. When data must transit US providers (Replicate, Resend), we rely on Standard Contractual Clauses.

5. Retention

Catalog cache: while the app is installed + 48 hours (GDPR shop redact window). Hard-deleted on shop/redact webhook.
Generated images you have NOT pushed: 60 days, then purged.
Generated images you HAVE pushed: held by Shopify in your media library; we keep only a reference (ID + URL) for analytics.
Audit logs: 12 months.
Billing records: 7 years (Czech tax law).

6. Your rights (GDPR Articles 15–22)

You can request:

Access to all data we hold about you and your shop.
Correction or erasure.
Restriction of processing.
Data portability (JSON export).
Objection to processing based on legitimate interest.

Contact: founder@ecomwiz.app. We respond within 30 days.

For complaints contact the Czech Data Protection Authority (uoou.cz) or your local DPA.

7. Children

The app is not directed at children. Generated images depicting children are produced from the merchant's prompt only — we never generate identifiable real children and our AI providers' policies prohibit it.

8. Cookies

The embedded app uses session cookies set by Shopify App Bridge for authentication. We do not set any first-party tracking cookies. We do not use Google Analytics, Facebook Pixel, or similar.

9. AI disclosure (EU AI Act Article 50)

Every image generated by ecomwiz contains:

C2PA content credentials in the file metadata identifying the AI model used.
SynthID watermark when the underlying model supports it (Nano Banana / Imagen family).

We require merchants to disclose AI-generated imagery as required by local law in their storefront. ecomwiz adds an ai_generated: true metafield on every product where at least one AI image was pushed, which themes can read to render an "AI-assisted" badge.

10. Changes

Material changes are notified at least 30 days in advance via in-app banner and email to the shop owner.