Privacy Policy

    Last updated: 12 October 2026

    This Privacy Policy explains how Ise AI (“Ise,” “we,” “us”) collects, uses, and protects information in connection with our Shopify application and the related service at app.ise-ai.com. By installing or using the app, you agree to this Policy.

    Ise has three parts, and they handle different data. Installing the app grants access to your products and content, which is what Search needs. Ads and Creators read orders, customers and discounts, and Search can read orders to show the sales AI assistants sent you. Each asks your permission separately, when you first open it. If you decline, that part stays switched off and the rest keeps working.

    Search

    Search is what the app can do with the permissions granted at install. Through the Shopify Admin API, we access the data needed to provide SEO and generative engine optimisation:

    • Store profile: store name, myshopify domain, and primary domain.
    • Products and collections, including titles, descriptions, and SEO metadata.
    • Content: blog articles, pages, and media metadata such as image alt text.
    • SEO and analytics data we generate or derive: audits, keyword research, proposed and applied changes, and AI answer engine (“GEO”) citation results.
    • If you connect them, third-party analytics such as Google Search Console data.

    Search can also show the orders AI assistants sent you. Opening that panel asks for permission to read your orders. With it granted, Search reads each recent order’s total, sales channel, and the referring site, campaign source and landing page of the visit behind it, and stores only the resulting counts and revenue, by the path of the page landed on.

    Search accesses no customer data. Its order permission is not granted at install, and a store that never opens that panel, Ads or Creators is never asked for it.

    Creators

    Creators helps merchants find creators, send them product, and pay them commission on the sales they generate. Paying a creator accurately requires reading the orders their discount code produced, so opening Creators asks for permission to read orders and to manage discount codes. Placing a zero-value order to ship product to a creator asks separately, at the point you ship something. With that permission granted, Creators accesses:

    • Store profile, products, and variants, used to identify the product a creator is sent.
    • Order financial totals, line items, and discount codes, used to attribute a sale to the creator whose code produced it and to calculate that creator’s commission. Our order queries do not request customer names, addresses, email addresses, or phone numbers.
    • Customer records, used only to group repeat orders by buyer, so we can report the lifetime value of the customers a given creator introduced.
    • Information creators give us directly: social handles, email address, shipping address, and, where a paid collaboration requires it, payment and tax details.

    Creators writes two things back to your store, both on your instruction:

    • Discount codes created and deactivated for individual creators.
    • Zero-value orders placed to ship product to a creator. These contain that creator’s own name, shipping address, phone number, and email address, which the creator supplied to us for that purpose.

    Creators does not use customer or order data for advertising, profiling, audience building, or resale.

    Ads

    Ads measures what your advertising returns and what a customer is worth over time. Opening it asks for permission to read your orders and customers. With that granted, it reads:

    • Store profile: store name, myshopify domain, currency, and time zone.
    • Products, used for the ad creative Ise makes and the product count Ads reports.
    • Order counts and order financial totals, used to measure revenue against ad spend.
    • Each customer’s order count and total amount spent, used to calculate customer lifetime value. Ads does not request customer names or addresses.

    To follow repeat purchases over time, Ads stores per-order figures: the order’s dates, currency, totals, and refunds. Each is filed under a keyed one-way hash of the customer’s Shopify ID, which cannot be turned back into the ID and is unique to your store.

    Ads may also use your customers’ purchases to build advertising audiences for your brand, such as a lookalike audience of people similar to your buyers. To do that, Ads reads the email address and phone number of customers who bought from you, turns each into a one-way hash, and sends only the hashes to your own ad account on a platform you have connected, such as Meta, which uses them to find matching people.

    Ads writes nothing to your store. Its customer and order data is used only for your own brand. It is never shared with another brand, used for profiling, or sold.

    How we use information

    • To analyse your store and content and produce SEO and GEO recommendations.
    • To generate drafts and proposed changes for your review and approval.
    • To publish changes you approve back to your store.
    • To attribute sales to creators and calculate the commission you owe them.
    • To place and track the shipments you send creators.
    • To measure revenue against ad spend and calculate customer lifetime value.
    • To build advertising audiences for your brand from your customers’ purchases.
    • To operate, secure, and improve the service.

    How information is shared

    We do not sell your data. We share data with subprocessors only as needed to run the service:

    • Supabase, application database and storage hosting.
    • Vercel, application hosting.
    • AI providers used to analyze content and track answer engine citations, including Anthropic, Google, OpenAI, Perplexity, and xAI.
    • DataForSEO, keyword and ranking data.
    • SendGrid, email sent to creators. Customer personal data is never included.
    • Stripe, subscription billing and creator payouts. Creators enter their bank details and tax information directly with Stripe. We never receive them.
    • Google Search Console, only if you connect it.
    • Meta, and any other ad platform you connect, receives hashed customer email addresses and phone numbers when Ads builds an audience, sent only to your own ad account.

    We may also disclose information where required by law.

    Google user data

    Search can connect to Google Search Console. If you connect it, Ise asks Google for one permission, and only this one:

    • https://www.googleapis.com/auth/webmasters.readonly, to view the Search Console data for the sites your Google account can see. It is read only, so Ise cannot change anything in Search Console.

    With it, Ise reads the list of sites your Google account has in Search Console, so you can choose your store’s, and that site’s search performance: the search queries, the pages they led to, and their clicks, impressions, click-through rate and average position. Ise uses these figures to show your search performance in Search, to track how your rankings move, and to plan and prioritise the SEO and content recommendations it makes for your site. To write those recommendations, Ise sends the figures to the AI model providers that generate them.

    Ise’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

    • We use Google user data only to provide and improve the Search features described above, which you see in the app.
    • We transfer it only as needed to provide those features, to comply with the law, or as part of a merger, acquisition or sale of assets after asking for your explicit consent.
    • We never use or transfer it for advertising, including retargeting and personalised or interest-based ads, and we never sell it or pass it to advertising platforms, data brokers or other information resellers.
    • No one at Ise reads it unless you ask us to, it is needed for security such as investigating a bug or abuse, the law requires it, or it has been aggregated for internal operations.
    • We do not use it to develop, improve or train generalised AI or machine-learning models.

    You can remove Ise’s access at any time from your Google Account’s third-party connections. To have the Search Console data Ise has stored deleted, email privacy@ise-ai.com.

    Data retention and deletion

    We retain store data while the app is installed and you have an active account. Records of orders attributed to a creator are kept for the life of your account, because they are the audit trail behind creator payouts. Creator shipping addresses are held only as long as needed to fulfil the shipment.

    For creator payouts we hold an amount, a date, and a Stripe account reference. Bank account numbers, Social Security numbers and taxpayer identification numbers are collected by Stripe and are never stored by us. Payment records are kept for as long as tax law requires us to keep them.

    We honour Shopify’s mandatory data protection webhooks:

    • customers/data_request, we provide the store owner with the order records we hold for that customer. If you use only Search there are none, because it holds no customer data and keeps orders only as totals. For Ads, they are the order figures filed under that customer’s hashed ID.
    • customers/redact, we erase the personal data we hold for that customer. If you use only Search there is none to erase. For Ads, we delete that customer’s order figures and keep a record of the hash so a later sync cannot add them back.
    • shop/redact, approximately 48 hours after the app is uninstalled, we permanently delete the data it holds for your store, across all three parts.

    You may also request access to or deletion of your data at any time by emailing privacy@ise-ai.com.

    Security

    Data is encrypted in transit and at rest. Shopify access tokens are additionally sealed with AES-256-GCM and are unreadable through our API layer. Store data is isolated per organization with row-level security, access is restricted, and API requests are authenticated and signature verified.

    International users

    We process data in accordance with applicable data protection laws, including the GDPR, UK GDPR, and CCPA/CPRA. Depending on your location you may have rights to access, correct, or delete your personal data; contact us to exercise them.

    Changes to this Policy

    We may update this Policy from time to time. Material changes will be reflected by the “Last updated” date above.

    Contact

    Questions about this Policy or your data? Email privacy@ise-ai.com.