Privacy Policy

1. Who we are

SourceVision is operated by [[LEGAL ENTITY NAME]], [[registered address]] ("SourceVision", "we", "us"). We are the data controller for the website at sourcevision.com and for merchant account data in the SourceVision app. For product and store data we process on a merchant's instructions, the merchant is the controller and we are the processor.

Questions and requests: support@sourcevision.com.

2. Scope

This policy covers two things: (a) the public website, and (b) the SourceVision app for Shopify and the web application at app.sourcevision.com (together, the "Service"). Shopify's own handling of your data is governed by Shopify's privacy policy.

3. Data we collect on the website

• Email you send us. When you request an invite or contact support by email, we keep your name, email address, store URL and message so we can reply.
• Server logs and analytics. Our host, Cloudflare, records request logs (IP address, user agent, requested page, timestamp) to serve and secure the site. We may use Cloudflare Web Analytics, which does not use cookies or track you across sites.

The website sets no advertising or tracking cookies.

4. Data we collect in the app

When you install the app, Shopify shares with us, under the permissions you approve:

• Store and account data: your store name and domain, the email address of the account that installed the app, plan and billing status.
• Product data: titles, descriptions, images and their alt text, options, variants, tags, categories and metafields for the products you choose to optimize. We read them to build proposals and write to them only what you approve.
• Theme data: with the read-themes permission, the structure of your product template so the app can guide you to place the SourceVision section. Theme write access is optional and only used to stage the section when you ask for it. We never publish or delete a theme.
• Facts you confirm: product facts you enter or confirm during setup (for example, what the product is not, or its intended use).

We do not request or store your customers' personal data. If Shopify ever sends us customer data through a mandatory webhook, we honor the data request and redaction webhooks Shopify requires and delete it.

5. AI scans and generated content

• Scans. To measure visibility we send shopper-style questions (for example, "best mud soap for oily skin") to third-party AI assistants and record their answers. These questions do not contain your personal data. Answers are stored unchanged and indefinitely; they are the evidence behind your scores.
• Proposals. To draft the SourceVision section we send the relevant product data and the facts you confirmed to a large language model provider. We use providers whose terms do not permit training on our inputs. No customer data is included.
• Benchmarks. We compute category benchmarks from scan results across stores. Benchmarks are aggregated and anonymized; no store's product facts, ledger or account data are disclosed.

6. How we use data

• To provide the Service: scanning, proposing, applying approved changes, verifying and rolling back.
• To keep a ledger of every change we make to your store, with its before and after state, so changes are auditable and reversible.
• To bill you through Shopify when paid plans begin.
• To answer support requests and send service notices. We do not send marketing email without your consent.
• To secure and improve the Service, including aggregated usage statistics.

7. Legal bases (EEA and UK)

We process merchant account data to perform our contract with you; scan answers and benchmarks on the basis of our legitimate interest in providing and improving a measurement service; and email you sent us on the basis of your request. Where we act as your processor, we process product data on your instructions.

8. Sharing

We share data only with the providers we need to run the Service, under contracts that restrict their use of it: hosting and content delivery (Cloudflare), our database provider, our large language model and AI assistant providers (scan questions and product data only), our email provider, and Shopify (for installation, permissions and billing). We do not sell personal data.

9. International transfers

Our providers may process data in the United States and the European Union. Where data leaves the EEA or UK we rely on standard contractual clauses or an adequacy decision.

10. Retention

• Merchant account data: for the life of your account and 90 days after uninstall, then deleted, except records we must keep for billing or legal reasons.
• Product data and confirmed facts: deleted 90 days after uninstall, or earlier on request.
• Change ledger: kept for the life of your account so rollbacks remain possible; deleted with the account.
• Raw AI scan answers: kept indefinitely in anonymized form for benchmarking. They contain no personal data.
• Support email: up to three years.

11. Your rights

You can ask us to access, correct, export or delete your data, to restrict or object to processing, and, where consent applies, to withdraw it. Write to support@sourcevision.com. We answer within one month. You may also complain to your data protection authority.

Uninstalling the app from Shopify triggers Shopify's shop-redact request to us; we delete your store's data within the retention periods above.

12. Security

Data is encrypted in transit and at rest. Access tokens for your store are stored encrypted and referenced only by name inside our systems. Every write to your store is verified by a read-back and logged. Access to production systems is limited to the people who operate the Service.

13. Children

The Service is for businesses and is not directed at anyone under 18.

14. Changes

We will post changes on this page and update the date at the top. For material changes affecting app users we will also email the account address.