Privacy policy
This policy describes what data Wubs processes, why and for how long, both in the Shopify app and in the Wubs web workspace. It describes what the service does today, not what it might do later.
Who is responsible
Wubs Agency AB (Swedish reg. no. 559428-5628), Bondegatan 9, 702 25 Örebro, Sweden, operates Wubs and is the data controller for the data about you as a user of the service. Contact: hej@wubs.se.
What the Shopify app reads from your store
The app requests the access scopes read_products, read_orders, write_products,read_online_store_navigation, write_themes and write_files. Shopify shows them to you before you approve. What the app can change is described under Changes to your store below. When syncing, it reads:
- The store: name, myshopify domain, currency, time zone and the scopes the app has been granted.
- Products: title, handle, total inventory, online store URL and lowest price.
- Orders: for each order only the creation time, any cancellation time, the financial status and the current total with currency, for the last 60 calendar days including today. The amounts are summed per day into an order count and an order value. Individual orders are not stored.
When you work with the assistant, it can also read what the task needs and the scopes allow: product descriptions, SEO fields, product metafields, variants, collections, theme files and the published product page as a visitor sees it.
The app fetches no customer data: no names, email addresses, phone numbers, addresses or other details about the store's customers.
Changes to your store
Once the store has granted the app the write scopes above, the assistant can prepare changes to the store. If the store has only approved read access, nothing can be changed until the new scopes have been approved in Shopify.
Nothing is sent to the store on its own. The assistant prepares a draft, and the change is carried out only after a person with the owner or approver role in the workspace has reviewed the before and after and pressed Implementera ändringar (Implement changes). The approval covers exactly the reviewed version, and the result is read back from Shopify afterwards. What can be changed:
- product title, description, SEO fields and URL handle (with an automatic redirect from the old address)
- product metafields of text, link and list types
- variant prices
- collections and which products they contain
- existing theme files and images in the theme, including images the assistant has created, which are uploaded to the store's files
- online store pages and menus, but only in the web version when the store is connected through its own Shopify app holding those scopes
The app does not create, change or delete orders, customers or payments.
Data about you as a user
- Signing in through Shopify admin: Shopify identifies you with a session token. Wubs stores an internal id derived from your Shopify user id, and your role in the workspace. Wubs does not receive your name or email address from Shopify.
- Signing in with email and password (the web version, by invitation only): name, email address and the password in hashed form. The password is never stored in plain text.
- Sessions: a sign-in lasts 14 days. Only a hash of the session key is stored. Failed sign-in attempts are counted per email address for 15 minutes to stop password guessing.
- What you write in the workspace: chats, attached files, drafts and approvals are stored, along with an event log of who did what.
- AI usage: for each question to the assistant, Wubs stores who asked it, which model was used, the number of tokens and the cost, to keep usage within its limits.
Cookies
The web version uses a single necessary cookie, __Host-wubs_session, which keeps you signed in. Inside Shopify admin no cookie is used at all. Wubs uses no analytics or marketing cookies and no third-party tracking.
Why the data is processed
- To provide the service you installed or were invited to: showing your store's products and sales, answering your questions in the chat and letting you work in the workspace. Legal basis: contract.
- To protect the service, for example through sign-in throttling and the event log. Legal basis: legitimate interest.
The data is not sold and is not used for advertising.
The AI assistant
The assistant uses language models from OpenAI, which Wubs reaches through Vercel AI Gateway. When you ask a question, the following is sent to the model:
- your question and up to twelve earlier messages in the same chat
- files you attach to the question, such as images, PDFs and text
- a selection of the store's data: product and campaign details, summed sales and advertising figures, search queries from Search Console and what the assistant reads in the store for the task
- if the assistant reviews a product page: the page's public text and screenshots of it, taken in an isolated browser at Vercel. The screenshots are not stored.
No access keys are sent to the model, and no data about the store's customers. Do not write personal data or passwords in the chat. Images the assistant creates are made with an OpenAI image model through the same route and are stored encrypted by Wubs.
Wubs asks Vercel not to let the content be used to train models, and asks OpenAI not to store the responses. These are settings Wubs requests from the providers.
Other sources in the web version
If you connect another source in the web version, such as Google Ads, Google Analytics, Search Console or Meta, Wubs reads report data from it: read-only, with the access key stored encrypted. From Meta, Wubs reads the ad account's name and id, currency, time zone, daily ad spend and the purchase value Meta attributes to the ads. Wubs changes nothing at Google or Meta.
Storage and security
- The database is hosted by Neon in Frankfurt and the app runs on Vercel in Frankfurt.
- Access keys for Shopify and other sources are encrypted with AES-256-GCM and bound to your organisation and store. They are never shown in the interface, in logs or in error messages.
- All traffic uses https. Who can see what is decided on the server from your membership, never by the browser.
Sub-processors
- Vercel: hosting the app. Technical request logs, such as IP addresses, may occur there.
- Neon: database.
- Vercel (AI Gateway): relays questions to the AI models and runs the isolated browser that reviews product pages.
- OpenAI: the language and image models the assistant uses.
- Shopify: the platform you install the app through.
Vercel, Neon and OpenAI are US companies. The database and the app are in the EU. What is sent to the AI models may be processed outside the EU, including in the United States.
How long data is kept
- When you uninstall the app the access key is deleted at once, the connection is closed, the sales figures are reset and the products are hidden.
- When Shopify sends its erasure request for the store (normally 48 hours after uninstalling) everything read from Shopify is deleted, including the products. The workspace with your chats and history remains until you ask for it to be deleted.
- Customer data requests and customer erasure requests from Shopify are recorded without any customer details. Wubs holds no customer data to hand over or erase.
- Your account is kept for as long as you use the service. Email hej@wubs.se and we will delete it within one month.
Your rights
You have the right to know what data we hold about you, to have it corrected or erased, to restrict or object to the processing, and to receive it in a machine-readable format. Email hej@wubs.se. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
Changes
If this policy changes, the date at the top of the page is updated.