Privacy Policy

Prism: AI Store Builder · Effective 13 July 2026

This policy explains what data Prism: AI Store Builder (“Prism”, “we”) collects when you install and use it on your Shopify store, why we collect it, and who we share it with. Prism helps merchants generate a complete storefront, bundles, and cart upsells from a product link.

What we collect

Prism collects data about the merchant and store only. We do not collect, store, or process your customers’ personal information.

Store information — your .myshopify.com domain, store email, and the Shopify access token needed to create products, themes, and discounts on your behalf. The access token is encrypted at rest (AES-256-GCM).
Brand settings you provide — brand name, colours, tone, trust badges, and any voice notes you enter during onboarding.
Generation inputs — the product URL or Shopify product you ask Prism to build from, and the resulting AI-generated copy, images, and videos.
Bundle & upsell configuration — the offers you create in the app.
Usage & billing records — counts of generations, photos, and videos used, for quota and subscription billing (handled by Shopify Billing; we never see your card details).

What we do NOT collect

No customer names, emails, addresses, or order data. Shopify’s mandatory customer-data webhooks are handled but store nothing, because Prism never accesses shopper data.
No payment card information — subscription billing runs entirely through Shopify.

How we use it

To generate your storefront, product page, bundles, and upsells.
To enforce plan quotas and process your subscription through Shopify Billing.
To operate, secure, and troubleshoot the app.

Third parties (subprocessors)

To generate content, Prism sends the product data you link to and generation prompts to the AI providers below. It sends no store access token or customer data to any of them.

Provider	Purpose	Region
Anthropic (Claude)	Generating store copy and structure	USA
OpenAI	Generating product photography	USA
Higgsfield	Generating product videos	USA
Oxylabs	Researching the product you link to	EU/Global
Supabase	Database hosting (your app data)	EU
Fly.io	Application hosting	EU (Stockholm)
Upstash	Background job queue	EU
Shopify	The platform the app runs on	Global

Data retention & deletion

We keep your app data while Prism is installed. When you uninstall the app, your access token is revoked immediately, and your store record and associated data are deleted. You can also request deletion at any time by emailing us. Shopify’s GDPR shop/redact request purges your data on the schedule Shopify requires.

Your rights

Depending on your location (including under the EU GDPR and California CCPA), you may have the right to access, correct, export, or delete the data we hold about your store. To exercise any of these, email akseli@markkinointiboosti.fi.

Security

Access tokens are encrypted at rest. All traffic is served over HTTPS. Access to production systems is restricted. We validate and block requests to internal network addresses to prevent server-side request forgery.

Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected here with a new effective date.

Contact

Questions about this policy or your data: akseli@markkinointiboosti.fi.