Privacy Policy

Effective Date: February 10, 2026

1. App Name and Overview

This privacy policy applies to SalesBoost AI, a Shopify embedded application that provides AI-powered sales recommendations to merchants. This policy describes how we collect, use, store, and protect data accessed through the Shopify platform.

2. Data Collection

2.1 Shopify API Data

We access the following data via Shopify's API using the following read-only scopes:

• Products: Product titles, descriptions, prices, inventory levels, and metadata (via read_products scope)
• Orders: Order history, line items, customer information, order values, and timestamps (via read_orders scope)
• Customers: Customer names, email addresses, order history, and purchase behavior (via read_customers scope)

2.2 Merchant Data

We store the following merchant-specific data:

• Shop domain and Shopify store URL
• Shopify API access tokens (encrypted)
• App configuration preferences and settings
• Billing subscription status

2.3 Customer Data Processing

Important: We do NOT collect data directly from your customers. We only process order and customer data that already exists in your Shopify store through API access. Your customers do not interact with SalesBoost AI directly, and we do not track their behavior outside of the data you provide through Shopify.

3. Data Usage

3.1 AI-Powered Recommendations

We use the collected data to generate AI-powered sales recommendations. Product data, order history, and customer purchase patterns are analyzed to identify sales opportunities, inventory gaps, and customer re-engagement strategies.

3.2 Third-Party Services

Your data is shared with the following third-party services for processing:

• Anthropic Claude API: Product, order, and customer data is sent to Anthropic's Claude AI service to generate recommendations. Anthropic does not use this data for training AI models. See Anthropic's privacy policy at https://www.anthropic.com/privacy
• Amazon Web Services (AWS): Infrastructure hosting for application servers, databases, and storage in the us-east-1 region
• Sentry: Error monitoring and application performance tracking (error logs only, no customer PII)

3.3 Data Sharing Practices

We do NOT:

• Sell your data or your customers' data to third parties
• Share data with advertisers or marketing companies
• Use your data to train AI models or for any purpose beyond generating your recommendations
• Provide your data to other merchants or aggregate it for commercial purposes

4. AI Processing

4.1 Data Sent to AI Services

When you use SalesBoost AI, product information, order data, and customer purchase patterns are transmitted to Anthropic's Claude API to generate personalized sales recommendations. This data transmission is necessary for the core functionality of the application.

4.2 AI Data Usage by Anthropic

Anthropic does not use data submitted to the Claude API for training their AI models. Data sent through the API is processed to generate your recommendations and is not retained beyond the processing period. For more details, see Anthropic's API data usage policy.

4.3 AI Output Disclaimer

AI-generated recommendations are suggestions only. SalesBoost AI provides recommendations based on data analysis and AI inference, but these are not guaranteed outcomes. Business decisions based on AI recommendations are the sole responsibility of the merchant. We do not guarantee specific sales increases, revenue growth, or customer engagement results.

5. Data Retention

5.1 Active Installation

Data is stored for the duration that SalesBoost AI is installed on your Shopify store. This includes shop information, access tokens, product data, order history, customer records, and generated recommendations.

5.2 App Uninstall (shop/redact)

When you uninstall SalesBoost AI, shop-level data is anonymized (not deleted) in accordance with GDPR shop/redact requirements. This means:

• Your shop domain, access tokens, and identifiable information are removed
• Aggregate analytics data (e.g., recommendation counts, feature usage) is retained for product improvement
• This anonymization process completes within 48 hours of uninstallation

5.3 Customer Data Deletion (customers/redact)

If a customer requests data deletion through your Shopify store (GDPR right to erasure), we delete all customer-specific data within 48 hours of receiving the customers/redact webhook from Shopify. This includes:

• Customer email, name, and contact information
• Order history associated with that customer
• Any recommendations generated based on that customer's data

5.4 Data Export Retention (customers/data_request)

When a customer requests a data export through your Shopify store, we generate a data export file containing all stored information about that customer. This export file is:

• Made available for download within 30 days
• Automatically deleted after 30 days
• Accessible only via a secure, expiring link

6. GDPR Rights

Under the General Data Protection Regulation (GDPR) and other privacy laws, merchants and their customers have the following rights:

6.1 Right to Access

You or your customers may request access to the data we store. Customer data export requests are handled automatically via Shopify's customers/data_request webhook. For merchant data access requests, contact us at the email below.

6.2 Right to Correction

If any data we store is inaccurate or incomplete, you may request correction by contacting us at privacy@hagglelicious.com. Note that most data syncs directly from Shopify, so updates in your Shopify Admin will automatically reflect in SalesBoost AI.

6.3 Right to Erasure (Right to be Forgotten)

You or your customers may request deletion of data. Customer erasure requests are handled automatically via Shopify's customers/redact webhook. To request erasure of shop-level data, uninstall the app or contact us directly.

6.4 Right to Restriction of Processing

If you wish to pause data processing without uninstalling the app, contact us at privacy@hagglelicious.com. We will suspend recommendation generation and data syncing while maintaining your account.

7. Data Security

7.1 Encryption

• In Transit: All data transmitted between your Shopify store and SalesBoost AI is encrypted using TLS 1.2 or higher (HTTPS)
• At Rest: All data stored in our databases (AWS RDS PostgreSQL) and file storage (AWS S3) is encrypted using AES-256 encryption

7.2 Access Controls

• API access tokens are stored encrypted in the database
• Sensitive credentials (API keys, database passwords) are stored in AWS Secrets Manager, not in code or configuration files
• Application access uses AWS IAM role-based permissions with principle of least privilege
• No shared credentials or long-lived access keys

7.3 Security Incident Response

In the event of a data breach or security incident, we will:

1. Investigate and contain the incident within 24 hours
2. Notify affected merchants within 72 hours
3. Comply with all applicable breach notification requirements under GDPR and other regulations
4. Provide details on the nature of the breach, affected data, and remediation steps

8. International Transfers

SalesBoost AI stores data in AWS data centers located in the us-east-1 region (Northern Virginia, USA). If you are located in the European Economic Area (EEA), UK, or other jurisdictions with data protection laws, your data will be transferred to the United States.

We rely on AWS's compliance with Standard Contractual Clauses (SCCs) approved by the European Commission for lawful international data transfers. AWS maintains certifications for ISO 27001, SOC 2, and other security standards. For more information on AWS's data protection practices, see https://aws.amazon.com/compliance/data-privacy/.

9. Contact Information

For privacy-related inquiries, data access requests, or questions about this policy, please contact us at the email above. We aim to respond to all privacy inquiries within 48 hours.

10. Policy Updates

This privacy policy was last updated on February 10, 2026.

We may update this policy from time to time to reflect changes in our data practices, legal requirements, or service features. Material changes to this policy will be communicated via:

• A notice in the SalesBoost AI app dashboard
• An email to the merchant's registered email address (if available)
• An updated "Last Updated" date at the top of this page

Continued use of SalesBoost AI after policy updates constitutes acceptance of the revised terms. If you do not agree with the updated policy, you may uninstall the app.