Privacy Policy

This privacy policy explains which personal data are processed when you use the Shopify app “EL AI Product Images” (the “App”), for which purposes and on which legal basis.

1. Controller

Lukas Zimmermann
Clara-Schumann-Str. 15, 74889 Sinsheim, Germany
E-mail: lukastz@icloud.com

2. Categories of data

• Shop data: shop domain, shop name, admin language, app plan, credit balance and credit history
• Authentication and session data: Shopify access token, session ID, granted scopes, expiry time
• Product data loaded on demand through the Shopify Admin API: product title, product type, options and variants, product images
• Images: the product photos you choose as a template and the images the App creates from them
• Billing status: plans and credit packs you buy through Shopify (no payment details)
• Support and contact data: shop contact e-mail addresses, language, time zone, plan status, app activity and support messages
• Technical server logs (for example time of request and error messages)

The App does not access orders or customer records of your shop and does not process data of your store’s visitors.

3. Purposes and legal bases

• Providing the App, creating images and saving them to your products: Art. 6 (1) (b) GDPR (performance of the contract)
• Authentication, security and error analysis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, stable App)
• Billing through Shopify: Art. 6 (1) (b) GDPR
• In-app support and relevant product messages: Art. 6 (1) (b) and (f) GDPR (support for the App you use, legitimate interest in helping you use it)
• Answering data protection requests (GDPR webhooks): Art. 6 (1) (c) GDPR

4. Processing in detail

4.1 Shopify login and sessions

When you install and open the App, Shopify issues an access token through OAuth. The App stores the session with shop domain, token, validity and granted scopes. Sessions are deleted when you uninstall the App.

4.2 Image creation with OpenAI

When you create previews, final images or variant images, the App sends the product photo you selected, a text instruction and, for final images, the preview you kept to the OpenAI API (OpenAI, L.L.C., USA, and its affiliates) to create the image. According to OpenAI’s API data usage policies, data sent through the API is not used to train OpenAI’s models. Details: https://openai.com/policies/privacy-policy. Please only use product photos you have the rights to. If a photo shows people, their image is processed as part of the photo.

4.3 Storage of created images

Created images are stored on the App’s servers so you can review them in the studio. They are only shown to your shop through short-lived signed links. Images you save are uploaded to your Shopify product gallery and are then stored by Shopify.

4.4 Support and in-app messages (Grucky)

When you open the App, your shop identity, available shop contact e-mail addresses, language, time zone, plan status and app activity (for example app opens and saved images) are synchronized with Grucky, a support and feedback product operated by ESSYLABS. This lets you exchange support messages in the App and helps us send relevant setup help and product updates. Contact e-mail addresses are not treated as marketing consent.

4.5 Protection against misuse

Every store gets its free credits and its free first round once. To keep it that way after an uninstall, the App keeps a one-way hash (HMAC) of your shop’s myshopify domain with the dates your store received them. This record contains no other data and is kept when the rest of your shop’s data is deleted. Requests to OpenAI carry a different one-way hash of your shop (not the domain itself), which OpenAI uses to detect misuse. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in preventing misuse and fraud).

5. Recipients

• Shopify as platform and billing provider (Shopify Inc., Shopify International Ltd.)
• OpenAI for image creation (see 4.2)
• Grucky, operated by ESSYLABS, for in-app support and merchant communication
• Hosting providers in the EU/EEA that run the App’s servers

6. Transfers to third countries

OpenAI processes data in the USA. Transfers take place on the basis of appropriate safeguards, in particular the EU Standard Contractual Clauses.

7. Storage period

• Sessions and tokens: until you uninstall the App or the token expires
• Studio data and created images on the App’s servers: until your shop’s data is deleted after you uninstall the App (Shopify sends the deletion request about 48 hours after uninstalling)
• Images saved to your products: as long as they stay in your Shopify store
• Free-start record (one-way hash of the shop domain with two dates): kept to prevent repeated free starts
• Support data (Grucky): while your app account is active and as needed for the support history
• Billing records, as far as statutory retention periods require

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing where the legal requirements are met. You can also lodge a complaint with a supervisory authority.

9. Contact

Please send privacy requests to lukastz@icloud.com.

Last updated: 2026-11-05