Privacy Policy

This Privacy Policy explains how Surfacly (“Surfacly”, “we”, “us”) collects, uses, and protects information when you install and use the Surfacly application (the “App”) on your Shopify store, and when you visit surfacly.top. Surfacly is a tool that audits a store’s product catalogue for AI-assistant readiness and tracks how AI assistants such as ChatGPT, Copilot, Gemini, and Perplexity surface a merchant’s products.

Information we collect

Store and account data

When you install the App we receive your store’s .myshopify.com domain, basic store details, the primary contact email associated with the install, and your subscription and billing status. This lets us provision your workspace and operate the App.

Product and catalogue data

To run AI-readiness audits, we read your product catalogue through the Shopify Admin API — product titles, descriptions, images and their alt text, SEO fields, and metafields. When you approve a suggested fix, we write the approved change back to that product on your behalf. We do not modify anything without your approval.

Order data (protected customer data)

To attribute sales to the AI channel that referred them, we access order records through the Shopify Orders API. We are deliberately minimal about what we keep:

• We access the order email field, but it is hashed (SHA-256) at the moment of ingestion. The original email address is never written to our database or logs — only the irreversible hash is stored, and only to count unique customers per AI channel.
• We store order totals, line items, and product IDs, plus the AI attribution metafields (surfacly.ai_source and surfacly.ai_referrer) that the App itself writes.
• We do not access or store customer names, phone numbers, or addresses.

Usage data

We collect standard operational data such as log entries, device and browser information, and how you interact with the App’s dashboard, so we can secure, debug, and improve the service.

How we use information

• To provide the App’s core features: catalogue audits, one-click fixes, AI channel ranking, and revenue attribution.
• To operate billing through Shopify’s Billing API and manage your subscription.
• To provide support, respond to your requests, and send service notices.
• To maintain the security, integrity, and performance of the service.
• To comply with our legal obligations.

We do not sell your data, and we do not use protected customer data for advertising, profiling, or any purpose beyond the AI attribution functionality described above.

How we share information

We share data only as needed to operate the service:

• Surfacly dashboard. The App syncs audit and attribution results to the Surfacly dashboard (surfacly.top), which is operated by us as a single connected service.
• Infrastructure providers. We host the App and its PostgreSQL database on our own managed server infrastructure. These providers process data solely to host the service on our behalf.
• Shopify. Shopify is the source of the store data we process; your use of Shopify is governed by Shopify’s own privacy policy.
• Legal. We may disclose information where required by law or to protect our rights, users, or the public.

Data retention and deletion

We retain data for as long as the App is installed and your subscription is active. When you uninstall the App or a store is closed, we delete or irreversibly anonymise the associated data within 30 days. We honour Shopify’s mandatory compliance webhooks:

• customers/data_request — we compile the (hashed) data we hold for a customer on request.
• customers/redact — we erase data associated with a specific customer.
• shop/redact — we erase all data for a store 48 hours after uninstall.

Security

All data is transmitted over TLS (HTTPS). Data at rest is stored on access-controlled infrastructure, and personal identifiers are minimised by design — customer emails are one-way hashed and never persisted in raw form. Access to production systems is limited to authorised personnel on a least-privilege basis.

Your rights

Depending on your location, you may have rights to access, correct, export, or delete personal data, and to object to or restrict certain processing (including under the GDPR and CCPA). Merchants can exercise these rights by uninstalling the App or contacting us; customers of a store should contact the merchant, who can trigger the deletion flows described above. To make a request directly, email us at support@surfacly.top.

International transfers

Your data may be processed in countries other than where you are located. Where required, we take steps to ensure an adequate level of protection for such transfers.

Children

The App is a business tool for merchants and is not directed to individuals under 16. We do not knowingly collect data from children.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above, and, where appropriate, by notice within the App.

Contact

Questions about this policy or your data? Email us at support@surfacly.top.