Privacy Policy

Last updated: 12 November 2026

ShieldKit checks online stores for problems that can lead to Google Merchant Center warnings or suspensions, and helps merchants fix them. This policy explains what data ShieldKit collects, how we use it, who we share it with, how long we keep it, and how to ask us to delete it. It covers the ShieldKit app inside your Shopify admin, the ShieldKit web app for any other store, and the public website at shieldkit.app, including the free store check.

Who runs ShieldKit

ShieldKit is responsible for the data described in this policy. Questions about this policy or your data can go to hello@shieldkit.app.

Shopify permissions we request

• read_products: read product titles, descriptions, images, prices, SKUs and variants, to check product data and find product pages to scan.
• read_content: read your store’s pages (for example About and Contact) for the contact-information and business-identity checks.
• read_legal_policies: read your store policies (refund, shipping, privacy, terms and contact information) for the policy checks.
• write_legal_policies (optional): Shopify asks you to grant this only the first time you click Apply on a policy that ShieldKit drafted for you (refund, shipping or contact information). When you click Apply, we publish that text to the matching policy in your Shopify settings, replacing its current text. We first save a copy of the text being replaced so you can undo it from ShieldKit. We never change a policy without that click.

ShieldKit does not request access to your customers, orders or payments. It never edits your products, prices, theme, checkout or Google product feed. If you installed ShieldKit before October 2026, Shopify may keep showing the broader permissions it had then until you next open the app; ShieldKit no longer uses them.

Before October 2026, ShieldKit’s paid plan could also add product identifier fields (GTIN, MPN and brand) to products, and offered optional theme blocks. Those features have been removed. Fields that were already added stay in your store unless you remove them, and our records of those writes may stay in our database until a planned clean-up (or until your store’s data is deleted, as described below).

Data we collect

From your Shopify store, when you install and use the app

• Store identity and access. Your store’s Shopify domain and the access token Shopify issues so ShieldKit can call the Shopify Admin API. The token is encrypted (AES-256-GCM) before it is saved.
• Store details. Shop name, owner name, contact email, country, province or state and city (from the store’s billing address), currency, Shopify plan, primary domain, the date the store was created, and its time zone. These are refreshed each time a scan runs.
• Store owner’s email. At your first scan we read the store owner’s email address from Shopify and save it with your store’s domain. We don't send marketing email. The only emails ShieldKit sends are monitoring alerts (below).
• Plan and billing state. Your plan, billing cycle, Shopify subscription ID and start date, your store's Shopify shop ID (used to ask Shopify which plan you are on), your scan allowance, AI usage counters, and whether you have been shown the plan page. We never see or store card details; Shopify handles all payments.
• Scan results. Your score and each check’s result (on Monitoring, also from the daily check), including the addresses of the pages we checked and what we found on them (for example, which contact details or policy wording were detected). A scan reads your public storefront pages; we keep the findings, including short quotes (up to 300 characters) of the text where we found a problem or a required detail, not copies of the pages.
• What you create in the app. If you answer the optional question before your first store check, your answer (whether your Merchant Center account is warned, suspended or fine) and any Google message you paste there. The policies ShieldKit drafts for you, the Google notice text you paste into the appeal-letter tool, and the letters it writes. Your answers to the policy questions are saved so the draft can be rewritten from them, and when you apply a policy we keep a copy of the text it replaced, for undo. The list of fixes you type for an appeal letter is sent to our AI provider to write the letter but is not saved.
• Settings from earlier versions. Settings saved in features that have since been removed (such as a support email, logo or social links) stay on your store’s record until it is deleted.

From visitors to shieldkit.app

• Free scanner. The store address you enter is used to fetch that store’s public pages and check them. We don’t keep the report. If you enter your email to see the fix steps, we save your email, the store address and the store’s score (if that store address is already saved, a new scan also updates its score). We then email you the fix steps (through Resend, see the website section below). To prevent abuse, we save your IP address with the time of each scan; these records are deleted once they are more than an hour old (the clean-up runs the next time anyone requests a scan).
• Page-view counting. Vercel Web Analytics counts page views on the public shieldkit.app pages. PostHog counts page views and when you leave a page, on the public pages and on the pages you see once signed in (never inside the Shopify admin). Neither sets cookies or stores anything in your browser, and neither identifies individual visitors: PostHog keeps its random visitor identifier in the page’s memory only, so each page load is a new visitor. PostHog receives the page address without its query string (on signed-in pages, with internal ID numbers taken out, and without the page title), the site you came from, named only when it is a search engine, an AI assistant, an app directory or a social site (any other site, such as a store, is recorded as “other”) and, when the link you followed carried them, its campaign labels (the utm_ parameters). It may also record standard technical details such as browser, device, IP address and approximate location. ShieldKit’s website does not use Google Analytics or advertising trackers.
• Free store check events. When a free check starts, finishes (with its score and the number of checks passed) or its fix steps are unlocked, we record that in PostHog under a random identifier, without your email or the store address. The start and finish also carry the site you came from and the campaign labels, as described above. We also keep a keyed fingerprint of the store address checked (not the address itself) for 90 days, so that if that store installs ShieldKit we can count that it came from the free check.
• Our Shopify App Store listing. The listing page is hosted by Shopify, and we use Google Analytics on it to see where installs come from. Shopify’s and Google’s privacy policies apply there.

Inside the app: product analytics and error reports

• Product analytics (PostHog). We record a small set of events to understand how ShieldKit is used: install and uninstall, a scan started, ran or failed (with the score and the number of issues by severity), scan results were viewed, the suggested next step was shown (with your plan, not your answer to the first question), the plan page was opened, an upgrade button was clicked (and which one), a plan was bought (plan, billing cycle and price), a paid plan ended (the plan and the status Shopify reported), the Recovery page was viewed or 30 days of Recovery started (how, and on which plan), the number of Merchant Center account issues found, and a policy was applied or undone (which type). Events are linked to your store’s Shopify domain. PostHog’s browser library stores a random identifier in a cookie and in your browser’s local storage, and may record standard technical details such as browser, device, page address, IP address and approximate location.
• Error reports (Sentry). When something fails, we send an error report so we can fix it. Reports can include your store’s Shopify domain, internal IDs and technical details of the failed request. Sentry is set up not to collect personal data by default.

Records we keep about the service itself

• A log of installs, uninstalls and deletions: your store’s Shopify domain, the event, your plan tier at the time, and when it happened. It contains no personal data.
• Summaries of our scheduled background jobs, which can list the Shopify domains a job worked on, and small technical progress records keyed by store domain.
• If saving your uninstall fails on our side, we keep the uninstall message Shopify sent us so we can fix it. Shopify includes your store’s contact details in that message.

ShieldKit does not access your customers’ records, orders or payment data. Because we hold no customer data, Shopify’s customer data request and customer deletion webhooks have nothing to return or delete.

How we use the data

• Run scans and show you the results and how to fix them.
• Draft store policies and appeal letters when you ask for them.
• Publish a drafted policy to your store, only when you click Apply.
• Work out your plan, billing state and what you can use.
• If you're on Monitoring, email you an alert when the daily check finds something new (see “Monitoring alerts”).
• Understand how ShieldKit is used, so we can improve it.
• Keep the service secure, fix errors and prevent abuse.
• Meet legal obligations.

We do not sell your data, and we do not use it for advertising.

Google Merchant Center connection

Connecting your Google Merchant Center account to ShieldKit is optional, and ShieldKit only reads it. The connection becomes available to all stores once Google completes its review of ShieldKit, so it may not be available to your store yet. Nothing in this section applies unless you connect an account.

• How you connect. In ShieldKit you click Connect Google Merchant Center, sign in with Google and approve ShieldKit’s request. Google shows you the request before anything is shared. ShieldKit asks for one Merchant Center permission (https://www.googleapis.com/auth/content, which Google lists as “Manage your product listings and accounts for Google Shopping”), plus your Google account’s email address and account ID (openid and email). Alternatively, you add ShieldKit’s email address as a Read-only user in your Merchant Center settings; ShieldKit then only connects to an account whose verified website matches your store.
• What we read. Your Merchant Center account ID and name, the issues Google has raised on the account (for example a warning or suspension and its reason), your products’ statuses and product-level issues (with the ID and title of each product an issue affects), and the website address registered on the account, which we use to check it matches your Shopify store. If you signed in with Google, we also receive that Google account’s ID and email address.
• Read-only. Google’s permission also allows changes, because Google offers no read-only version of it, but ShieldKit only reads. It doesn’t change your products, feeds or account settings, and doesn’t request a review on your behalf.
• What we store. If you signed in with Google: an encrypted refresh token (so we can keep reading without asking you to sign in again) and the Google account’s ID and email address (so disconnecting one store never cuts off another store you connected with the same login). For every connection: your account ID and name, and snapshots of the issues we read, including the ID and title of each product an issue affects, so we can show what changed over time.
• How we use it. Only to show you your account and product issues in ShieldKit, explain how to fix them, track whether they are resolved and, on the Monitoring plan, alert you when Google reports a new or worse issue or the connection stops working.
• Who receives it. Supabase stores it and Vercel runs the app that reads it (see “Who we share data with”). If you’re on Monitoring and alert emails are on, Resend delivers the alert email, which includes Google’s short description of each new or worse issue. Merchant Center data is not sent to our AI provider, and it is not shared with anyone else except as required by law.
• What we never do with it. We don’t sell it, use it for advertising, share it with data brokers, use it to judge creditworthiness or for lending, or use it to train AI models. People at ShieldKit don’t read it unless you ask us to (for example in a support request), it is needed to investigate security issues or abuse, or the law requires it. Our product analytics record that you connected an account (and how many Merchant Center accounts that login can see) and how many account issues were found, never the issue details, product information or account ID.
• Disconnecting and deletion. You can disconnect at any time on ShieldKit’s Google Merchant Center page. When you disconnect, we delete the refresh token and the Merchant Center data we stored, and ask Google to revoke ShieldKit’s access (unless another store you connected uses the same Google login). Uninstalling ShieldKit disconnects the same way, and anything left is deleted with your store’s data (see “How long we keep data”). You can also remove ShieldKit’s access from your Google Account at myaccount.google.com/permissions.
• Changes. If we want to use Google data in a way not described here, we will ask for your consent in the app before doing so.

ShieldKit’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share data with

We share data only with the service providers that run ShieldKit for us, and only what each one needs:

• Supabase, our database. Store records, scan results, drafts, saved emails and encrypted tokens are stored here, in Mumbai, India.
• Vercel, which hosts the app and website, runs our scheduled jobs, and provides the page-view counting described above.
• Anthropic, the AI provider that writes drafts. For a policy draft we send your store name, currency, country and contact email, and your answers to the policy questions. For an appeal letter we send your store name and country, the Google notice text you paste, and the fixes you list. Under Anthropic’s commercial terms, this content is not used to train its models.
• PostHog, for the product analytics and page-view counting described above.
• Sentry, for the error reports described above.
• Resend, which delivers monitoring alert emails: it receives your store's email address and the alert text (for a Merchant Center alert, Google's short description of each new or worse issue).
• Shopify, the platform ShieldKit runs on. Shopify sends us the store data described above and handles all billing. We ask Shopify which plan your store is on, so we know what your plan includes. Shopify bills every plan; we send it no payment details.
• Google, only if you connect Merchant Center: we request your account data from Google’s API as described above.

We may also disclose data if the law requires it, or to a buyer if ShieldKit is sold or merged; Google data would only be transferred in that case with your explicit prior consent. Our providers may process data outside your country, including in India, the United States and the European Union.

How long we keep data

• While ShieldKit is installed, we keep your store’s data so the app works.
• When you uninstall, we delete your Shopify session (including the access token) straight away and mark your store as uninstalled.
• About 48 hours later, Shopify sends us a request to delete your store’s data, and we permanently delete your store record and everything linked to it: scan results (including Monitoring's daily checks), drafted policies, your policy answers and the saved copies used for undo, appeal letters, monitoring alerts, settings, usage counters, Google Merchant Center connection data, and our records of past product field writes.

Some records are not deleted at that point:

• The install/uninstall/deletion log described above (store domain, event, plan tier, time). We keep it as a business record. It contains no personal data.
• Saved emails: the store owner’s email saved at your first scan, and emails, store addresses and scores from the free scanner. We keep these until you ask us to delete them.
• The uninstall message described above, if saving your uninstall failed. It includes your store’s contact details.
• Background job summaries and technical progress records that can include your store’s domain.
• Purchase records: for each paid plan and each included 30 days of Recovery, your store's domain and Shopify shop ID, the plan, the price, the dates, and whether Shopify confirmed the charge. We keep them as billing records, and so that 30 days of Recovery you have started still work if you reinstall. They contain no personal data.
• Copies held by PostHog and Sentry, which are kept under those services’ own retention periods.

You can ask us to delete any of these by emailing hello@shieldkit.app.

Your rights

• Access: ask for a copy of the data we hold about you or your store.
• Deletion: uninstall the app (see “How long we keep data”), or email us to delete your data sooner or to delete the records that uninstalling does not remove.
• Correction: ask us to fix data that is wrong.
• Objection: ask us to stop using your data for a particular purpose, such as contacting you.

Email hello@shieldkit.app to use any of these rights. Depending on where you live (for example the EEA, the UK or California), you may have further rights under local law, including the right to complain to your data protection authority. We do not sell personal information or share it for cross-context behavioural advertising.

Security

Shopify access tokens are encrypted (AES-256-GCM) before they are saved; Google refresh tokens are encrypted the same way. All traffic to ShieldKit uses HTTPS. Database keys are kept on our servers and never sent to the browser. We request only the Shopify permissions listed above; you can see them on your store’s Apps and sales channels page.

Monitoring alerts

If your store is on the Monitoring plan, ShieldKit checks it every day and, when something new or worse is found (a store check that starts failing, a new Merchant Center issue, or a broken Google connection), records an alert you can see in the app and emails it to your store's email address in Shopify. Nothing is emailed when nothing has changed. Every email has a link to stop these emails, and you can turn them off or back on from the dashboard. We keep alerts with your store's other data and delete them with it.

Changes to this policy

We post any changes on this page and update the “Last updated” date at the top. Please check this page for changes. If a change affects how we use Google data, we will ask for your consent in the app first.