Privacy policy

{{COMPANY_NAME}} ("we", "us", "Videlia") operates the Videlia app ("the App") for the Shopify platform. This policy explains what data the App collects, why, and how it is handled.

The short version. Videlia reads your product data and the photos you select, generates media from them, and stores the results. It holds no permission to read orders, checkouts or customer records, so it collects no shopper personal data at all.

What we collect

From your store

Store identifier (shopDomain) and store name
Store contact email, used only to send job-completion and credit-low notifications
Product data the App needs to generate media: product titles, product types, tags, vendor, handles and image URLs, read via the read_products scope
The specific product photo you select for a generation
The AI model you choose from our gallery, and any custom model image you upload
Generated videos and images, their thumbnails, and any brand assets you upload such as a logo or watermark preferences
Usage data: credit balance and ledger, generations run, job status and plan tier

From Shopify, at install and auth time

An OAuth access token scoped to your store, and standard session metadata (the installing staff account's email, first name, last name and locale) that Shopify's session library requires to keep your session authenticated. This is Shopify merchant and staff account data, not shopper data.

We do not collect end-customer (shopper) personal data. The App does not read orders, checkouts or customer records, and holds no scope that would allow it to. It reads product data and writes media to your product pages. This is why the App responds to Shopify's mandatory customers/data_request and customers/redact webhooks by acknowledging them without further action: there is no shopper data to compile or erase.

How we use it

To generate on-model images and videos from the product photo you select
To let you preview, download and publish the result to your product page
To enforce your plan's entitlements (monthly credits, output resolution, available AI models, aspect ratios) and to account for credits spent and refunded
To email you about job completion, failures or low credits, if notifications are enabled and you have not disabled them

Third parties we share data with

Generating media means sending your selected product photo to an AI processing provider. The App is currently configured to use:

FASHN (fashn.ai), virtual try-on. Receives the product photo and the AI model image, and returns an on-model still.
Kling (Kuaishou Technology), video generation. Receives the on-model still produced above plus a text description of the motion, and returns a video.
Cloudflare R2, object storage. Holds your uploaded images, the AI models you upload, and every generated image and video.
Railway, application hosting and the PostgreSQL database holding the records described above.
Resend, delivery of transactional email notifications.

We send these providers only the image, video and prompt data needed to fulfil your request. We never send them your Shopify access token, and we do not send them your store's contact details.

The App also contains an unused integration with Google Veo as an alternative video provider. It is not enabled, and no data reaches Google unless we switch to it, in which case this policy will be updated before the change goes live.

If we add any further processor, whether analytics, error tracking or a different AI provider, this list is updated before that processor receives any data.

Data retention and deletion

Your data is retained for as long as the App is installed on your store.
When you uninstall, Shopify notifies us via the app/uninstalled webhook, and approximately 48 hours later via the mandatory shop/redact webhook. On shop/redact we permanently delete every stored file (generated videos and images, thumbnails, uploaded model images, brand assets) from object storage, and then every database record tied to your store: products, try-on jobs, video jobs, videos, the credit ledger, your custom AI models and your sessions.
To request earlier deletion, uninstall the App from your Shopify admin, or contact us at {{SUPPORT_EMAIL}}.

Security

All data in transit is encrypted with HTTPS and TLS.
Access tokens and provider API credentials are held server-side only and are never exposed to the browser.
Every database query is scoped to the store that made the request, so one store cannot read another's products, jobs or media.
Stored files and database contents are encrypted at rest by our storage and hosting providers.

Your rights

Depending on your jurisdiction, for example GDPR in the EU and UK, or CCPA in California, you may have the right to access, correct, export or delete the data we hold about your store. Because the App stores no shopper data, these rights apply to your merchant account data only. To exercise them, contact us at {{SUPPORT_EMAIL}}.

Changes to this policy

We will update the "Last updated" date above when this policy changes. Material changes will be communicated to the store contact email on file.