Smitty — Privacy Policy

Last updated: July 7, 2026

Who we are

Smitty (“the App”) is a Shopify app operated by FinA Wellness GmbH, Austria (“we”). Contact: support@smittyapp.com.

What the App does

Smitty turns manufacturer product pages and PDFs that you, the merchant, provide into draft products in your own Shopify store, using AI-generated descriptions, titles and image alt texts. Nothing is published without your review: all products are created as drafts.

Data we process

• Store identity: your .myshopify.com domain, Shopify store ID, Shopify plan label and primary store language.
• Access token: the offline API token Shopify issues to the App, stored encrypted at rest (AES-256-GCM).
• Merchant-provided content: the manufacturer URLs/PDFs you submit, the product content and images generated from them, and your curation edits.
• Usage and cost records: per-job usage events and AI-cost entries used for allowance metering and accounting.
• Staff account basics (name, email) from your Shopify login session, as provided by Shopify for authentication.

Data we do NOT process

Smitty requests no access to your customers or orders and stores no end-customer personal data. Shopify’s mandatory customers/data_request and customers/redact requests are acknowledged accordingly: there is nothing to export or delete.

Sub-processors

• Anthropic (Claude API, USA): the manufacturer content you submit is sent to Anthropic to generate product content. It is not used to train models.
• Hetzner Online GmbH (Germany/EU): hosting of the App and its database.

Retention and deletion

When you uninstall the App, its access tokens and sessions are deleted immediately and all processing stops. 48 hours after uninstall, Shopify sends the shop/redact request; the App then deletes your content — source inputs, generated product data, images and job logs. What remains is a minimal, pseudonymized record: a hashed store identifier (not reversible to your store domain), your lifetime usage counters (free allowance and product generations) and the Shopify plan label. We keep this remnant to prevent free-quota abuse through uninstall/reinstall cycles (legitimate interest). Usage and cost ledger entries are retained as accounting records (legal obligation).

Your rights

Under the GDPR you have the right to access, rectify, erase and port your personal data, and to object to processing. Contact support@smittyapp.com — we answer within 30 days. You may also lodge a complaint with your local data protection authority.