Privacy Policy
1. Who this covers
This policy describes how Rudy AI ("the app", "we") handles information when a Shopify merchant installs it on their store. It concerns merchants, not their shoppers. See §3.
2. What the app accesses
When you install Rudy AI, Shopify grants it these permissions, and it requests no others:
| Permission | Why the app needs it |
|---|---|
Read and write productsread_products, write_products | To review product content for SEO and write improvements you approve |
Read content (pages)read_content | To read your store's pages for the llms.txt file the app generates. It does not create or change pages |
| Themes, customers, orders and payments | Not requested. The app can neither read nor change them. What it shows on your storefront goes through app embeds you switch on in the theme editor |
The app does not request access to customers, orders, or payment information, and does not read them.
3. Shopper data
The app does not collect, store, or process personal information about your customers. It works
with your store's design, product content and pages. Per Shopify's App Store requirements, the app
still implements Shopify's mandatory compliance webhooks
(customers/data_request, customers/redact, shop/redact) to
respond to any data-subject requests Shopify forwards.
On your storefront. The app's two app embeds, Rudy AEO and Rudy Faces, run in your shoppers' browsers once you switch them on, and send nothing to us. Rudy AEO only adds structured data to the page. Rudy Faces remembers which face a shopper arrived with in that browser tab's session storage, for 30 minutes of inactivity, so the face stays while they browse; it is not a cookie and it never leaves the device. If a face you design uses a Google font, the shopper's browser loads that font from Google Fonts, which receives the shopper's IP address as part of serving it, under Google's own privacy policy. A face that keeps your theme's fonts loads nothing from Google.
4. What is stored
| Data | Why |
|---|---|
| Your store domain and Shopify access token | To act on your store when you ask it to |
| Your account details as Shopify provides them: store name, email address, phone number, country and currency | To identify your store, contact you about the app, and apply the right currency to usage and billing |
| Product titles, descriptions and related content | To review and improve them |
| Keyword and search-performance data, where you connect it | To report on how your store is found |
| Your AI provider credential — no longer stored | You cannot connect one; AI runs on our credentials (§5) |
| Credentials for any search-data service you connect (Google Search Console, SerpAPI, DataForSEO) | To fetch your own search data on your account rather than ours |
| Usage records — how much processing each task consumed | For your plan's limits and billing |
Themes and other sites
The app does not build, install or change themes, and does not retrieve other websites to copy them. Earlier versions could build a theme from a site you owned; that feature was withdrawn on 14 October 2026, and anything it stored is deleted with the rest of your store's data (§7).
5. AI processing
This changed on 16 September 2026, and it changed who is responsible. Until then you connected your own AI provider account, your key made the requests, and that provider was your supplier — we only transmitted on your instruction. You can no longer connect a key, and there is no setting for one.
Rudy AI now includes AI processing. We hold the provider credentials, we pay for the usage, and your plan's monthly token allowance is what bounds it.
- Content is sent to an AI provider to be processed — product text and descriptions, page content and your store's name.
- Those providers are our sub-processors, not your suppliers. They act on our instructions under our agreement with them. The current list, and how we tell you before it changes, is in the Data Processing Addendum.
- We do not use your content to train or fine-tune any model, and we do not permit our providers to train theirs on it. Your data is processed only in response to the requests you make.
- Which model runs a given job is our choice, made per task rather than one model for everything. It affects cost and speed, not what leaves your store.
- You are not billed for AI usage separately. It is included in your plan and metered against its allowance.
What this does not change. We still do not access customers, orders or payment information (§2), and we still send no shopper personal data to any AI provider (§3).
6. Who else receives data
| Recipient | What they receive | Why |
|---|---|---|
| Shopify | Requests made on your behalf | The app runs on your store |
| Our AI providers — see the DPA for the current list | Content submitted for processing | The app's core function |
| Our hosting provider | Everything stored, at rest | The app must run somewhere |
| Google Search Console and DataForSEO | The queries needed to fetch your search data, sent with the accounts you connect in Settings, and only when you use a feature that needs them | Keyword and rank reporting |
| SerpAPI | The search queries behind web searches the app makes for you, sent with our own account | Search results and image search |
Your information is not sold, and is not shared for advertising.
6.1 Where data is stored
Data is stored with our hosting provider in the United States (Ashburn, Virginia). Our infrastructure provider is Tencent Cloud, a company based in China. We disclose both facts because both may matter to you. AI processing happens in our providers’ regions, under our agreements with them, not in Ashburn; the Data Processing Addendum names each one.
6.2 Generated design structure
Nothing from your store is added to a shared design library. Earlier versions could contribute the structure of pages and themes they generated; the app no longer generates either. To have any structure an earlier version contributed removed, write to support@getrudy.ai.
6.3 Website analytics
This privacy policy concerns the Rudy AI Shopify app, which does not collect or process your customers' data (see §3). This section covers visitors to our marketing website, getrudy.ai.
Our website uses Google Analytics to understand how visitors use the site. Google Analytics sets cookies and collects aggregate, non-personally-identifiable information such as pages visited, time on site, device and browser type, and general geographic region. This data is transmitted to and processed by Google under Google's own Terms of Service and Privacy Policy. We do not use it to identify individual visitors, and it is not used for advertising or shared for advertising.
Visitors can opt out of Google Analytics by using the Google Analytics opt-out browser add-on or their browser's cookie controls.
7. Retention and deletion
- Data is kept while the app is installed.
- When you uninstall, we receive Shopify's uninstall notification and delete your store's data
within 30 days. Consistent with Shopify's requirements,
shop/redactfires 48 hours after uninstall and redaction is completed within 30 days (unless legally required to retain). - You may request deletion at any time by writing to support@getrudy.ai, and we will confirm when it is done.
- Changes the app made to your products stay on your products after you uninstall, because they are your store's data. Use Restore originals in the app first if you want them back as they were.
8. Security
- The credentials you connect — your Google Search Console tokens and your DataForSEO API key — are encrypted at rest using authenticated encryption.
- Access to stored data is limited to what is needed to operate the service.
- Data in transit is protected with TLS. No system is perfectly secure, and we do not claim otherwise. If you believe an account has been compromised, write to support@getrudy.ai and rotate the affected key at your provider.
9. Your rights
Depending on where you are, you may have the right to access, correct, export or delete your
information, and to object to certain processing. Write to
support@getrudy.ai and we will respond within 30 days. For
requests Shopify forwards on a merchant's behalf, we respond through Shopify's required channels
(the customers/data_request, customers/redact, and
shop/redact webhooks).
California residents: You may have additional rights under the California Consumer Privacy Act (CCPA), such as the right to know what personal information is collected and to request deletion. We do not sell personal information. Write to support@getrudy.ai to exercise any of these rights.
10. Changes
If this policy changes materially, we will update the date above and notify merchants with the app installed before the change takes effect.
11. Contact
Tunabear Inc., d/b/a Rudy AI
11711 Hillcrest Rd, Dallas, TX 75230
support@getrudy.ai