Privacy policy

Last updated 19 October 2026

Catalog Audit is a Shopify app. It checks how Google Shopping and AI shopping agents read your products, and fixes what it finds. It works with your product data. It does not collect or store anything about your customers or orders, and we do not sell data.

What the app stores, and why

Your store

Your .myshopify.com domain, store name and web address, and Shopify's ID for your store. We use these to know which store the data belongs to and to show your results.

Access to your store

The access tokens Shopify gives the app when you install it. We use them to read and update your products, nothing else. They are stored encrypted and deleted the moment you uninstall.

Product data and audit results

To run the audit the app reads your active products: titles, descriptions, brand, product type, tags, options, images and their alt text, category, and each variant's SKU, barcode, price and availability. We keep the results of every audit: the scores, and the problems found for each product (with its title, link and main image). That lets you compare before and after.

A log of fixes

Every fix the app prepares or applies is recorded with the product, what it changes, the value before and after, its status and the dates. The log is what lets you review a fix before it is applied and undo it afterwards.

Your storefront password (optional)

If your online store is password-protected, Google, AI agents and the audit cannot read it. You can save the storefront password in Settings so the audit can read your pages as they will look after launch. It is stored encrypted, and only used to load your own storefront. You can remove it in Settings at any time.

How many products used AI

The IDs of the products AI fixes were prepared for, to apply the free allowance of 10 products per store.

Contact requests

When you ask our team for help from inside the app (the Help page, "Get help with this", the expert review or the agency program), we keep what you send: the email address you give us, your name if you add one, your reason and message, which page you sent it from, and a snapshot of your results at that moment (catalog size, your two scores, and the issue or product it is about). We use it only to reply to you. The form suggests your store's contact email, but nothing is kept unless you send the form: this is the only personal data the app stores, and you give it on purpose. Each request is also forwarded to our team by email and a private notification. It is deleted with the rest of your store's data at shop/redact, 48 hours after you uninstall, or sooner if you email us.

What the app does not collect

• No customer data and no order data. The app does not ask for access to customers or orders, so it cannot see them.
• No information about the staff who open the app.
• No cookies, no analytics and no advertising trackers. The app remembers in your browser (local storage) only that you dismissed the setup guide or a help card.

Your public storefront

The audit also loads public pages of your online store, such as product pages, robots.txt and policy pages, the way a search engine would. It identifies itself as CatalogAudit. See catalogaudit.app/bot. If you saved a storefront password, it uses that to load them.

AI processing

Some fixes (attributes, Google fields, specification lists, and rewritten titles and descriptions) are written by AI. This happens only when you choose to prepare them, and only for the products you prepare them for. For each product the app sends:

• up to three of its photos (as links to the images on Shopify's servers), and
• its text: title, brand, product type, tags, options, description, and attributes already in its structured data.

It does not send prices, customer data or your storefront password. The request goes through OpenRouter to an AI model provider (Anthropic's Claude, with Google's Gemini as a fallback), which reads the photos and text and returns the suggested values. These providers process the data under their own terms and privacy policies. Nothing the AI writes is applied until you review it and confirm, and you can undo any fix.

Who else handles the data

• Cloudflare hosts the app and its database. It also keeps technical logs for debugging. They contain your store domain and error details, such as a product handle, but not access tokens or passwords.
• OpenRouter and its model providers, for AI fixes only, as described above.
• Our team's email and notification service, for contact requests only: a request you send reaches us by email and as a private notification, so we can reply quickly.
• Shopify, the platform the app runs on.

We do not sell your data or share it for advertising.

How long we keep it

• While the app is installed: your audits, fixes and settings are kept so you can compare results and undo fixes.
• When you uninstall: the access tokens and the storefront password are deleted immediately.
• 48 hours after you uninstall, Shopify sends us a shop/redact request, and we delete everything else stored for your store: the store record, audits, fix log, AI usage and contact requests.
• Changes the app already made to your products stay in your store. They are ordinary product edits.
• Want it gone sooner? Email hello@catalogaudit.app and we will delete it.

Shopify's privacy requests

The app handles Shopify's three mandatory privacy webhooks. Because it stores no customer data, customers/data_request and customers/redact have nothing to return or erase, and are acknowledged. shop/redact deletes the data described above.

Security

Everything travels over HTTPS. Access tokens and storefront passwords are encrypted before they are stored. Requests from Shopify are verified, and merchants sign in through Shopify, not with a password of ours.

Your rights and contact

You can ask us what we hold about your store, to correct it, or to delete it. Email hello@catalogaudit.app. For help using the app, see support.

If we change this policy, we will update this page and its date.