Security What the app stores, how it is protected, how to report a problem

Last reviewed on 2 November 2026. Questions go to [email protected].

What the app stores

• Your store's domain, the store details Shopify provides (such as the owner's name and e-mail address), and the name and e-mail address of the staff member who uses the app.
• The app's settings, which images belong to which option values, and your swatch settings.

When you use Auto Assign, the selected product images are sent to OpenAI, with the product's title and option values, to match them. The app does not store customer data, orders or payment information. The full list, and how long each part is kept, is in the privacy policy.

What the app can do in your store

It reads and writes products and the data it keeps on them, and reads your theme to help with setup. It cannot change your theme's code and never asks for more access than that. The key Shopify gives the app for your store is stored encrypted.

Where your data lives

The app runs on cloud servers we manage and is delivered through Cloudflare. All traffic is encrypted in transit.

How we protect it

• Encryption in transit everywhere, and the store key encrypted at rest.
• Our own administration tools sit behind single sign-on with a second factor.
• Encrypted backups, kept off the server.
• Security updates and monitoring every day.

When you uninstall

Shopify tells us, and we erase your store's account data on Shopify's deletion request, 48 hours after the uninstall. The image assignments of your products are kept so that a reinstall can restore them; they contain no personal data.

If something goes wrong

If an incident affects your store, we inform you and Shopify without delay, with what happened and what we did about it.

Reporting a security problem

Write to [email protected] with what you noticed and how to reproduce it. We read every report and fix confirmed problems as a priority.

We do not run a bounty programme and do not pay for reports. We do not authorise security testing of our systems or of any merchant's store. If you noticed something while using the app, tell us and do not go further.

Our security.txt carries the same contact.