Privacy policy: RankFlect SEO for Shopify

This policy describes how the RankFlect SEO for Shopify app ("the app", "we") handles data when a merchant installs it on a Shopify store. For the WordPress plugin and this website, see our main privacy policy.

Who we are

RankFlect SEO for Shopify is made by the team behind RankFlect SEO. Contact us at [email protected] for any privacy question or request.

Data the app accesses

With the permissions you approve at install, the app reads and updates SEO data in your store through Shopify's Admin API:

Products, collections, pages and blog posts: titles, descriptions, SEO titles and meta descriptions, URL handles, product images and files, their alt text and file names, and SEO metafields.
URL redirects.
Translations and published languages, for multi-language SEO.
Shipping profiles, read-only, when you choose to add shipping details to your structured data.
Your theme files, read-only, to check whether the app embed is switched on and to find duplicate structured data. The app never edits theme files.
Basic shop details: store name, domain, currency and plan.
Orders, read-only, limited to each order's date, total and where the visit came from (referring site, source and UTM tags), to report revenue from search and AI assistants.

The app does not store customer personal data. It never reads customer names, emails, addresses or payment details. From orders it keeps only daily totals per traffic channel (for example: AI assistants, organic search, direct), never individual orders.

Data the app stores

Session data needed to authenticate your store with Shopify.
Your settings: SEO templates, brand voice, words to avoid, schema settings, alert webhook address, report schedule and report recipient email addresses.
Connections you add: Google sign-in tokens for Search Console and Analytics, and your own AI provider key if you add one. Both are stored encrypted. AI agent connection tokens are stored only as a one-way hash, with a log of which tools each agent used.
Revenue totals: daily order counts and revenue per traffic channel and top landing pages, without any customer or order identifiers.
A change history of the SEO edits the app makes (old and new values), and changes waiting for your approval, so you can review and undo them. When the app compresses an image, it keeps a backup copy of the original as a file in your own Shopify store so it can be restored.
Scan results: your store's SEO score and the issues found on each page.
404 reports: the paths of storefront pages that were not found, the number of hits and the referring page. No IP addresses or visitor identifiers are stored.
Search and audit results: tracked keywords and positions, keyword research results, PageSpeed results, broken links, AI visibility questions and answers, and sent SEO reports.
AI usage counts per month, to apply plan limits.

AI features

When you use an AI feature, the app sends the relevant product or page text, and for alt text and file names the product image, to an AI provider to generate the suggestion. By default this is Anthropic (Claude models). If you add your own key, the app uses the provider you choose instead (Anthropic, OpenAI, Google Gemini or OpenRouter) under your own account and its terms. AI visibility checks send only your tracked questions (never store or customer data) to the AI assistants that are connected: Anthropic Claude, and when set up OpenAI ChatGPT, Google Gemini and Perplexity, each with web search. Nothing is sent unless you use an AI feature, and you can pause all AI in Settings.

If you connect an AI agent such as Claude, ChatGPT or Cursor, that agent receives the store SEO data its access allows, under the agent provider's terms. Changes it proposes wait for your approval unless you turn approval off for that connection.

Other services we use

Google: Search Console, Analytics and PageSpeed Insights, only after you connect them or run a speed test.
DataForSEO: the search terms you research, to return search volumes.
Resend: sends the SEO reports you schedule, to the recipients you enter.
IndexNow: the URLs of pages you update, so Bing and other search engines can recrawl them.
Our hosting provider: runs the app and its database.

Why we use the data

Only to provide the app's features: analysing your store's SEO, making the changes you approve, letting you undo them, and enforcing your plan. We do not sell data or use it for advertising.

Uninstalling and deletion

When you uninstall the app, its access to your store ends straight away and the storefront app embed switches off. The SEO changes you made stay in your store, because they are saved in Shopify. Shopify sends us a deletion request 48 hours after uninstall, and we then delete everything we hold about your store: settings, connections and tokens, change history, scan and audit results, 404 reports, keyword and report data, and usage counts. Image backups stay in your store's Files, where you can delete them.

We also respond to Shopify's customer data requests. Because the app stores no customer personal data and keeps orders only as daily totals, there is nothing to return or delete for an individual customer.

Where data is stored and how it is protected

Data is stored with our hosting provider in encrypted databases and sent over HTTPS. Sign-in tokens and AI keys are additionally encrypted, agent tokens are kept only as hashes, and access is limited to the people who run the service.

Your rights

Depending on where you live, you may have the right to access, correct or delete your data, or object to its use. Email us and we will respond within 30 days.

Changes

We will update this page when our practices change and note the date at the top.