Privacy Policy

Code Magic: Altify AI — Last updated: 28 July 2026

1. Overview

Code Magic: Altify AI (“the App”, “we”, “us”) is a Shopify embedded application that helps merchants manage alt text and SEO metadata across their store media, and audit their public storefront for WCAG 2.1 accessibility issues. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

2. Data We Collect

We collect and store only the data required to operate the App's features:

Data type	Purpose
Shop domain (myshopify.com)	Identifies the merchant account; required for Shopify OAuth
Shopify OAuth session token	Maintains authenticated access to your store's Admin API
Media metadata (image URLs, Shopify media GIDs, alt text, product/collection/article titles)	Powers the Media Library, alt-tag editor, templates, and CSV export features
SEO metadata (meta titles/descriptions and audit findings for products, collections, pages, articles, and blogs)	Powers the SEO Meta Editor and its duplicate/broken-metadata detection
Scan job records	Tracks the progress and status of store media scans
Alt-text templates and template apply job records	Stores reusable templates and tracks background bulk-apply jobs
Alt-text translations	Stores merchant-entered (and, when enabled, AI-generated) translations of your alt text
Accessibility scan results (your storefront's own public page URLs, WCAG 2.1 violation details, and scores)	Powers the Accessibility Audit, its score history, and exported reports
AI provider selection, model choice, and API key (encrypted at rest — see Security below)	Lets the AI Generator and AI-assisted translation call the provider you configure, using your own key
Storefront password, if your store is password-protected (encrypted at rest — see Security below)	Lets the Accessibility Audit unlock and scan a pre-launch or private storefront
Other shop settings (target languages, scan schedule, onboarding progress)	Remembers your configuration choices across sessions
Activity log entries	Records bulk operations (scans, imports, exports, template applies, AI generations) for the merchant's history view

We do not collect, store, or process any personal data about your customers (shoppers). The App only accesses your store's media catalogue and metadata — no order data, customer names, emails, or payment information is ever read or stored. The Accessibility Audit only reads the publicly-visible pages of your own storefront (the same content any visitor's browser would load) — it never accesses gated customer accounts, checkout, or order data.

3. How We Use Your Data

To authenticate and maintain your session with the Shopify Admin API
To scan and display your store's media in the App's Media Library
To write updated alt text back to your Shopify store via the Admin API
To apply and manage alt-text templates across your media catalogue
To edit and audit SEO meta titles and descriptions across your store's products, collections, pages, articles, and blogs
To crawl and audit your own live storefront's public pages for WCAG 2.1 accessibility issues, using an automated browser that loads pages the same way a visitor's browser would
To provide CSV import and export functionality
To generate AI-powered alt text and translations using the AI provider and API key you configure (Pro plan; see Section 4)

We do not sell, share, or rent your data to any third party for marketing purposes.

4. Third-Party Services

The App uses the following third-party services:

Shopify Admin API — to read and write media, SEO, and store data
Your chosen AI provider — OpenAI, Anthropic, Google Gemini, Kimi/Moonshot, or OpenRouter (Pro plan only, and only if you supply your own API key for that provider). Image and product data is sent directly to that provider using your key; we do not proxy, inspect, or store the content of those requests. That provider's own privacy policy governs how they process the data.
Railway — cloud hosting provider where the App server and database run. See Railway's Privacy Policy.

5. Data Retention & Deletion

All data associated with your shop — session tokens, media and SEO records, scan jobs, templates and template-apply jobs, activity logs, AI provider settings (including any saved API key and storefront password), accessibility scan results, and alt-text translations — is permanently deleted automatically when you uninstall the App or when Shopify's mandatory shop/redact webhook fires, whichever happens first.

To request early deletion of your data, contact us at the email address below and we will process the request within 7 business days.

6. GDPR Compliance

The App implements all mandatory Shopify GDPR webhooks:

customers/data_request — We store no personal customer data. Requests receive a confirmation response.
customers/redact — We store no personal customer data. Requests receive a confirmation response.
shop/redact — All shop data across every feature of the App (see Section 5) is permanently purged from our database.

7. CCPA (California Consumer Privacy Act)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights regarding your personal information:

Right to Know — You have the right to know what personal information we collect, use, and disclose. This is described in Section 2 above.
Right to Delete — You have the right to request deletion of your personal information. Contact us at the email below and we will process the request within 7 business days.
Right to Opt-Out of Sale — We do not sell, rent, or trade your personal information to any third parties. There is nothing to opt out of.
Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights.

Note: Code Magic: Altify AI is a business-to-business application. The personal information we collect relates to merchant (business) accounts, not end consumers. We do not collect or store any personal information about your store's customers.

8. Security

All data is transmitted over HTTPS. Access to the App requires a valid Shopify OAuth session. Your AI provider API keys and storefront password are encrypted at rest (AES-256-GCM) before being stored in our database — even in the unlikely event of a database compromise, these values are not stored in plain text. Other secrets and database credentials used to run the App itself are stored as environment variables and are never exposed to the browser.

9. Contact

If you have questions about this Privacy Policy or wish to request data deletion, please contact us:

Email: info@mycodemagic.com