Privacy Policy

App: BigAI SEO: Image Alt Text — Last updated: 2026-05-17

1. Who we are

BigAI SEO: Image Alt Text ("the App") is a Shopify-embedded app that helps merchants improve product image accessibility and SEO by generating AI-assisted alt text for product images. Contact: basestone.ai@outlook.com.

2. What data we access

Shop information: shop domain, owner email, plan, scopes — used only to operate the App.
Products and images: product titles, descriptions, tags, product type, image URLs and existing alt text — read via Shopify Admin GraphQL API solely to generate alt text suggestions.
App usage: counts of scans run, suggestions generated/approved/applied, token usage — used for billing quotas and rate limiting.

We do not access customer personal data, orders, or payment information.

3. How we use data

Generate alt text suggestions via Google Gemini (model: gemini-2.5-flash-lite) using the OpenAI-compatible API. Only product metadata (title, description, tags, image URL) is sent to Google. No merchant or customer PII is sent.
Track monthly quota usage per plan tier (Free / Go / Plus / Pro).
Apply approved alt text back to Shopify via the Admin GraphQL fileUpdate mutation — only after the merchant explicitly approves each suggestion.

4. Data sharing

We share data only with the following sub-processors strictly to deliver the service:

Google (Gemini API) — receives product metadata and image URLs for alt text generation. See Google AI terms.
MongoDB Atlas — stores App data (shop records, scans, suggestions) in encrypted form.
Railway — hosts the App service.

We never sell merchant data, advertise based on it, or use it to train models.

5. Data retention

Suggestions and scan history are retained while the App is installed.
On uninstall, the App responds to Shopify's mandatory app/uninstalled webhook by clearing the session and marking the shop as uninstalled.
Within 48 hours after uninstall, Shopify triggers shop/redact; the App then permanently deletes all shop-scoped data (shop record, scans, suggestions, usage counters, subscription mirror).
We respond to customers/data_request and customers/redact with HTTP 200 because the App does not store customer data; no customer-level action is required.

6. Security

All connections to Shopify, Google Gemini, MongoDB Atlas, and Railway use TLS. Access tokens are stored in the Shopify-managed session storage and never exposed in App business tables. Internal background routes are protected with a static secret header.

7. Your rights

Merchants can: (a) uninstall the App at any time from the Shopify Admin to stop further data access; (b) request deletion of any data we hold by emailing basestone.ai@outlook.com; (c) request a copy of data we hold about their shop.

8. Changes

We will update the "Last updated" date at the top whenever this policy changes. Material changes will be communicated via the App dashboard.