Privacy policy

Who we are

Visibilai is a Shopify app operated by [company name and address to be added]. For the store data the app processes, the merchant who installs it is the controller and we act as a processor on their behalf. For this website, we are the controller.

What the app stores

• Your store: the myshopify.com domain, the access token Shopify gives the app (with its refresh token, expiry and the permissions granted), your plan and subscription status as Shopify reports them, whether the store is a development store, the date and time you accepted the notice about prompt tracking, and store facts Shopify provides (store name, primary domain and address, currency, country, Shopify plan name, whether it is a Plus store, how many products we read).
• Your catalog: a copy of the product facts needed to recognise your products in AI answers and to suggest improvements: title, handle, vendor, product type, link, barcode, lowest price, featured image link, category, status, currency and whether it is published to the Online Store. When Shopify tells us a product changed (a signed webhook), we read only its id, mark our copy as out of date and read that product again; a deleted product is removed from our copy.
• Audit and proof data: your GEO audits (GEO Score, the result of each check and the suggested actions), a note of each change Visibilai applied or undid so later audits can show what moved, daily totals of orders and of visits that arrived from AI assistants (only if you switch the pixel on), and the Google and Bing search totals you connect. Prompt tracking also keeps your test prompts and the assistants’ answers to them (text, source links, which brands were named), the weekly totals made from them and what asking cost us (see the section on prompt tracking).
• Other features you use: GEO audit reports and product scores, article ideas and drafts, the countries you target, “Prove it” tests, structured-data settings and checks, a copy of your store’s public llms.txt, Bing indexing (IndexNow) settings and the page addresses sent, and when we asked Shopify to show its review prompt.
• Review highlights (only if you allow them): up to three reviews per product, with the reviewer’s display name as written in your review records, are copied into that product’s structured data in your store. Visibilai does not keep them.
• Improvements: each proposed change, its evidence, whether you approved, applied, undid or dismissed it, and the previous value so it can be undone.
• AI-referred orders: see the next section.
• Usage and emails: monthly counters of AI writing calls (copy, translation, article and suggestion drafts), product rewrites and what asking AI assistants cost us for your store; your store’s contact email and name (or another address you enter in Settings), your email choices, and a log of the emails we sent (type, subject, status, time).
• Feedback you send with the Feedback button: what you wrote, its type, the app page you were on, and whether we may reply.

The app’s own privacy page lists every table it keeps, one by one.

Order attribution, without customer personal data

To report orders that came from AI assistants, the app reads the last 60 days of your orders through Shopify (the read_orders permission). For an order that came from an AI assistant it keeps only: the order id and order number, when it was placed, the order total and currency, the AI channel (for example ChatGPT or Perplexity), how it was detected (Shopify’s own channel attribution, a referrer host such as chatgpt.com, or a UTM value) and the ids of the products in the order. It also keeps the sales channel names Shopify reports on your orders with how many orders carried each, daily totals of all your orders (count and revenue per currency), and a one-time total of AI and all orders for up to 60 days before you installed Visibilai.

It does not store customer names, email addresses, postal addresses, phone numbers or payment details, nor item titles, quantities or prices. Full links are not stored, only host names and UTM values.

AI visit counting (optional)

Off until you turn it on in the app. It adds Visibilai’s web pixel to your storefront; Shopify runs it in a sandbox and loads it only for shoppers who allow analytics where your store asks for consent. When a shopper arrives from an AI assistant, it sends the assistant’s name, the kind of page they landed on (for example a product handle) and a random number that lives only for that browser session, and once more if that session completes a checkout. We keep only daily totals per assistant and landing page: no IP address, browser details, cookies, customer or cart data.

Google (optional)

Only if you connect your own Google account. Visibilai asks for read-only access to Search Console (and your account’s email address, to show which account is connected) and, if you add it, Merchant Center. It stores the tokens Google gives us (encrypted) and copies daily totals Google already aggregates: search clicks, impressions and positions (up to 16 months), top searches, pages and countries, and Merchant Center free listing totals. If you also connect Google Analytics (a separate, read-only step), Visibilai lists your Google Analytics properties so you can pick your store’s, then copies that property’s daily visits, purchases and purchase revenue per traffic source (for example chatgpt.com) and per product page. Nothing about individual searchers, visitors or shoppers. Disconnecting deletes the tokens and every Google number we copied. Visibilai’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Bing (optional)

Only if you connect your own Bing Webmaster Tools account. Visibilai asks for read-only access, stores the tokens Bing gives us (encrypted) and copies totals Bing already aggregates: clicks and impressions, top searches and pages, and crawl and index counts. Nothing about individual searchers or shoppers. You can also upload Bing’s AI Performance export or Merchant Center’s AI report: we keep its aggregate rows, never the file. Disconnecting deletes the tokens and every Bing number we copied.

Prompt tracking: what is sent to AI providers

To check how AI assistants answer shopper questions about your products, Visibilai sends test questions (and product names from your catalog) to OpenAI, and to Perplexity and Anthropic on plans that include them. We do not send customer or order data.

• Before the first question: the app shows this notice on its Welcome page, with a link to this page, and asks you to click to accept it. We record the date and time. Until you do, no assistant is asked and no test prompt is written.
• Who is asked, by plan: OpenAI (ChatGPT) on every plan, Perplexity on Growth and Enterprise, Anthropic (Claude) on Enterprise, through their official, paid business APIs with web search. Gemini and Copilot are never asked, and no consumer app is scraped.
• What is sent: one test question at a time, as written in your prompt panel (a few wordings of each), and your country as an approximate location. A question can contain a category name, a price range or a product type from your catalog, and it names your store only in the brand check, which asks about your store by name. The prompts are written from your catalog, your order product types, your Search Console searches and the phrases your reviews use; they are cleaned of anything that looks like an email address, link or phone number.
• What comes back and how long we keep it: the answer text, the links it cited, which brands it named and which searches it ran. We keep it while the app is installed so the history works, and delete the provider’s untouched raw response after 90 days. Assistants answer differently each time and for each person, so Visibilai shows what it finds as a range from a sample of answers, never as a ranking or as what every shopper sees.
• Writing and research: to write your prompt panel and the drafts you ask for, OpenAI also receives the product and store details they are about, as listed in the table below.
• Never sent: customer data, order data, access tokens or your contact email.
• Deletion: pausing or deleting a prompt in the app stops it being asked; everything we keep from tracking is deleted with the rest of your store’s data after you uninstall.

AI providers and other subprocessors

We use the AI providers through their business APIs. Under their API terms they do not use this data to train their models by default, and they may keep it for a limited time for abuse monitoring; we also switch off any data-sharing option in our accounts.

Please do not put personal data into text you write yourself in the app, such as a note or an article brief.

What we do not do

• We do not sell your data or use it for advertising.
• We do not use your store’s data to train AI models.
• We do not share one store’s data with another store.

Retention and deletion

• Finished background tasks are deleted after 90 days. Email log rows are deleted after 180 days, except unsubscribe and resubscribe records, which we keep as proof of your choice. GEO audit reports and the log of pages sent to IndexNow are kept for 90 days. The clean-up runs once a day.
• Audit results, daily traffic totals, improvements, AI-referred orders, test prompts and the assistants’ answers to them are kept while the app is installed, so you can see trends and undo improvements. The providers’ untouched raw responses are deleted after 90 days.
• When you uninstall, audits and emails stop at once, queued work is cancelled, and the access tokens (Shopify’s, and Google’s if you connected it) are deleted. Shopify then asks us to delete your store’s data, and we delete everything we hold about your store within 48 hours of that request. Deleted data can stay in our database provider’s encrypted backups until those expire (at most 30 days).
• Improvements you approved are ordinary product data in your store and stay there unless you undo them before uninstalling.

The check-your-store page

The page Check your store has a free technical check. Once it is open, the store address you type is sent to our server, which reads that store’s public pages (robots.txt, sitemap, home page and up to three product pages) as VisibilaiBot, only the pages robots.txt allows. The check asks no AI assistant anything and uses no AI provider. We keep the store address, the result shown and a scrambled hash of your IP address (never the address itself) for 30 days, only to limit abuse and to avoid repeating the same check within 24 hours. We ask for no email address and set no cookies. An earlier version of the check, which was never switched on, also took a category, a country and an optional email; any records it could have produced are deleted automatically after the same 30 days. To have anything deleted sooner, email support@visibilai.app.

This website

This website sets no cookies and uses no analytics, advertising trackers or third-party fonts. Our hosting provider keeps standard server logs (such as IP address, page requested and time) for security and troubleshooting.

Your rights and requests

Merchants can delete their store’s data by uninstalling the app, or write to us for a copy or deletion. Shopify forwards customer data requests to us. We hold no customer names, emails, phone numbers or addresses. Of the data we keep, just the AI-order rows described above are linked to a customer’s orders. On an erasure request we delete them, and on a data request we give them to the store. You can ask us for access to, correction of or deletion of your own personal data at any time.

Contact

Questions or requests: support@visibilai.app