Privacy Policy
Last updated: October 20, 2026
1. Who we are
Get Picked: AI Visibility (“Get Picked”, “we”) is a Shopify app provided by Ruslan Horbenko, self-employed (autónomo), NIF Z2628996D, Oviedo, Asturias, Spain. We are the data controller for the data described here. Contact: support@getpickedapp.com.
This policy covers merchants who install the app and visitors to getpickedapp.com.
2. What data we process
From your Shopify store (read-only access):
- Store details: shop domain, store name, primary domain, time zone, and the country code of the store address (we don’t read or store the rest of the address).
- Product catalog data: the names of up to 25 collections and the product types of up to 100 products, to suggest categories; and the IDs, titles, types and lowest variant prices (with currency) of up to 250 active products, to match your products to your categories and keep the generated questions within your price range. For each category we store the matched product IDs, up to 15 example product titles and its price range (lowest, median and highest price).
What you enter in the app: brand name and other names, store description, product categories, competitors, and your market and question language.
Scan results: the shopper questions we generate, the answers AI assistants give to them, the brands those answers mention and their positions, the sources they cite, and your scores and scan history. We keep the full answer text for your last 10 completed scans; older scans keep the brands, positions, sources and scores.
Subscription status: from Shopify: your plan, whether it’s set to cancel, when the current billing period ends, and the subscription’s ID. We store the plan and the subscription ID with each scan. Shopify handles all payments; we never see card or bank details.
Authentication: Shopify session data, including the access and refresh tokens that let the app call Shopify’s API for your store.
Technical data: server logs and error reports. Request logs record the method, the path without query parameters, the status and the timing; logs of app events (scans, webhooks, question generation) record the shop domain, the shopper questions and categories involved, the outcome, timing and cost. Error reports are scrubbed of tokens and contact details and sent without user details or IP addresses; the app’s logs don’t record IP addresses. Our hosting provider’s network logs may contain IP addresses for a short period.
Support messages you send to support@getpickedapp.com.
What we don’t access: your customers’ or orders’ data, payment details, or the store owner’s contact details. Shopify’s install screen lists “store owner” access for every app; we don’t use it. We don’t use advertising or tracking cookies.
3. Why we process it (legal bases)
- To provide the service you installed: profiles, scans, results, plan limits (performance of a contract, GDPR art. 6(1)(b)).
- Security, debugging and preventing abuse: logs and error reports (legitimate interests, art. 6(1)(f)).
- Support: answering your messages (contract / legitimate interests).
4. Who we share it with
We use these service providers, only to run Get Picked:
| Provider | What for | Data | Location |
|---|---|---|---|
| Shopify | App platform, billing | Store and subscription data | Canada / global |
| Railway | Hosting and database | All app data, server logs | EU (Netherlands) |
| OpenAI | Generating shopper questions, answering them with web search, analysing answers, matching products to categories | Brand name, store description, competitors, categories with example product titles and price ranges; product IDs, titles and types (for matching); the generated questions with your market’s country and time zone; the answers and their cited links (for analysis) | United States |
| Perplexity | Answering shopper questions | The generated questions and your market’s country | United States |
| Sentry | Error monitoring | Scrubbed error reports from the app’s server and pages | EU |
| Cloudflare | DNS and hosting of getpickedapp.com | Website visitors’ technical data (such as IP address and browser) | Global |
| Zoho | Support messages | EU |
Transfers outside the EU are protected by appropriate safeguards: the EU–US Data Privacy Framework where the provider is certified under it, and otherwise the European Commission’s Standard Contractual Clauses in the provider’s data processing terms. We send AI providers only what a scan needs; they don’t receive your customers’ data, and under their API terms they don’t use it to train their models.
We don’t sell your data or share it for advertising.
5. How long we keep it
- While the app is installed: your profile and scan history. Full answer text: last 10 completed scans.
- When you uninstall: we stop any running scan and delete your Shopify session (access tokens) right away. Shopify sends us a data deletion request 48 hours later, and we then delete all data for your store: profile, questions, scans and results. Deleted data may remain in encrypted database backups for up to 30 days before it is overwritten.
- Logs and error reports: kept by our providers for a limited period: up to 30 days for server logs and up to 90 days for error reports.
- Support emails: as long as needed to handle your request.
6. Your rights
Under the GDPR you can ask to access, correct, delete or export your data, restrict or object to its processing. Write to support@getpickedapp.com. You can also complain to the Spanish data protection authority (AEPD, aepd.es).
7. Security
Data is encrypted in transit (TLS), hosted in the EU, and accessible only to us. Secrets are kept out of code and logs, and we collect only what the service needs.
8. Children
Get Picked is a service for businesses and isn’t intended for anyone under 18.
9. Changes
We may update this policy. We’ll change the date above and tell you in the app or by email about significant changes.