Effective date: 2026-04-18
Last updated: 2026-04-18
SKU Surf ("the App," "we," "our," or "us"), operated by Raj Patel (a sole proprietor based in Minneapolis, Minnesota, USA), respects your privacy and is committed to minimum-necessary data collection. This Privacy Policy explains what we collect, how we use it, and your rights. It applies to merchants who install the App from the Shopify App Store.
Shop data (collected via Shopify OAuth):
yourshop.myshopify.com)Merchant-provided data (collected when you use the App):
Scraped data (collected from third-party public sites on your behalf):
Operational data:
We explicitly do not collect the following, because we do not need it for the App to function:
read_customers, read_orders, or any other scope that exposes customer PII from your Shopify store.read_products OAuth scope, which limits our access to your product catalog.We do NOT:
To operate the App, we share limited data with the following service providers:
| Provider | What they process | Purpose |
|---|---|---|
| Shopify Inc. | OAuth token, shop domain, billing | Platform integration, billing |
| Supabase | Shop catalog, competitor URLs, settings | Database storage |
| Render | Same as Supabase | Application hosting |
| Hetzner Cloud | Scraping requests (competitor URLs only — no Shopify data) | Scraper infrastructure |
| Smartproxy/Decodo or Bright Data | Competitor URLs passed to proxy | Scraping proxy infrastructure |
| Keepa | Amazon ASINs (public identifiers, no Shopify data) | Historical price data |
| OpenAI or Perplexity | Anonymized product titles only (no shop identifiers) | AI-assisted URL discovery |
All processors are bound by data processing agreements (or equivalent) appropriate to their role. They access only what they need to perform their specific function.
During your subscription: We retain your data as long as you're actively using the App.
Upon uninstall: Shopify fires the shop/redact webhook 48 hours after uninstall. Within 30 days of receiving this webhook, we delete:
Our automated db.purge_shop_data function handles this across all shop-scoped tables. We verify deletion via our scripts/test_gdpr_purge.py round-trip test.
Customer data: Not applicable — we do not collect end-customer PII, so we have nothing to delete when Shopify fires customers/data_request or customers/redact webhooks. We still acknowledge those webhooks with a 200 OK response and log the receipt.
By using the App, you consent to the transfer of your data across jurisdictions necessary for the App to function. If you are in the EU/UK, we rely on Standard Contractual Clauses (or equivalent mechanisms) for data transfers where required.
If you are in a jurisdiction with data-protection laws (GDPR, CCPA, etc.), you have the following rights:
shop/redact)To exercise any of these rights, email us at the address below. We respond within 30 days.
We use industry-standard security practices:
No system is perfectly secure. If you believe there has been a security incident affecting your data, contact us immediately at the email below.
The App is not directed at children under 16 and we do not knowingly collect data from them. If you believe we have collected data from a child, contact us and we will delete it.
We may update this Privacy Policy as the App evolves or as regulations change. Material changes will be announced via the App's dashboard and/or by email to the contact on file at Shopify. The "Last updated" date at the top reflects the most recent material change.
For privacy questions, data requests, or to exercise your rights:
By installing SKU Surf on your Shopify store, you acknowledge that you have read, understood, and agreed to this Privacy Policy.