Privacy policy

1. Controller

The controller for the data described here is Feedmind S.a r.l. (in formation), Luxembourg City, Grand Duchy of Luxembourg. Contact: privacy@getfeedmind.com. We have not appointed a data protection officer, because our processing does not meet the thresholds that require one. Privacy requests are handled by the managing director.

Where we process your customers' data on your behalf, you are the controller and we are the processor. That relationship is governed by the data processing addendum, which forms part of your agreement with us.

2. What we collect

Name, work email address, company name, role, store domain, sign in metadata such as device and timestamp, and your notification preferences. Provided by you.

This is the substantial category. When you connect a Shopify store we read, through the API and under the scopes you granted: products and their fields, variants, product metafields, collections, translations and locale content, product images and their alt text, availability state, and your shop locale settings.

We do not request and do not receive orders, customers, payment information, inventory levels, staff accounts or theme files. Those scopes are not part of our installation.

Scores per product, per locale and per catalog, the individual check results behind them, proposed fixes, drafted content, and the record of what you approved, when, and by which user.

For the free domain check we fetch a sample of publicly available pages from the domain you enter, plus the email address you give if you unlock the simulation. No account is required.

Company name, billing address, VAT identification number, invoice history and a payment method reference. Card numbers are entered on our payment processor's own hosted checkout and never reach our systems.

Server logs including IP address and user agent, error reports, and the content of support messages you send us.

3. Why we process it, and on what legal basis

• To provide the service (contract, Article 6(1)(b)): reading and scoring your catalog, proposing and publishing approved changes, running rules, rescoring, and giving you access to the results.
• To bill you (contract, and legal obligation for invoicing and VAT, Article 6(1)(b) and (c)).
• To support you (contract, and legitimate interest in answering questions well, Article 6(1)(b) and (f)).
• To keep the service secure and working (legitimate interest, Article 6(1)(f)): logging, abuse prevention, debugging, and the audit record of administrative actions.
• To improve the product in aggregate (legitimate interest, Article 6(1)(f)): statistics such as which checks fail most often across catalogs. These are aggregated and do not identify you.
• To send product email (contract for service email such as a completed scan, consent for anything promotional, Article 6(1)(a)).

We do not sell personal data, we do not share it with advertising networks, and we do not build profiles for advertising purposes.

4. Language models and your content

When you ask Feedmind to draft content, the relevant product data for that product is sent to a language model provider listed on the subprocessor page. Those providers are contractually prohibited from training on the content we send. We do not train any model of our own on customer content. Drafting happens only on your request and never as a background process.

5. Where your data is stored

In the European Union. Our application database, object storage and backups run in EU regions with the providers named on the subprocessor page. Where a subprocessor could route a request outside the EU, that is stated in its entry, and the transfer relies on Standard Contractual Clauses together with the supplementary measures described in the DPA.

6. How long we keep it

• Catalog content and derived scores: while the store is connected, then deleted within thirty days of disconnection or uninstall.
• Drafted content and fix history: with the account, deleted on account deletion.
• Account data: with the account, deleted on account deletion.
• Support messages: twelve months.
• Administrative audit log: twenty four months.
• Public scan results: fourteen days for reuse, then the page content is discarded and only the score record remains.
• Invoices and accounting records: ten years, as Luxembourg law requires.

7. Uninstalling from Shopify

Uninstalling revokes our access immediately. Shopify sends the mandatory shop redact and customer redact webhooks, and we act on them: catalog content, scores and drafted content for that shop are deleted within thirty days, and any active subscription is cancelled. Changes already published to your store remain in your store, because that content belongs to you. If you want deletion sooner, write to privacy@getfeedmind.com.

8. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where processing rests on consent.

Access and portability are self service: Settings, Security, Export my data returns everything we hold in a machine readable form. Erasure is self service too: Settings, Security, Delete account. Anything else, or the same requests by email, goes to privacy@getfeedmind.com and is answered within one month.

If you believe we have handled your data wrongly, we would like to hear it first, but you may lodge a complaint with the Luxembourg supervisory authority, the Commission Nationale pour la Protection des Donnees (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, or with the authority in your own country of residence.

9. Cookies and analytics

The marketing site sets no tracking cookies and runs cookieless analytics. The application sets a functional session cookie so you stay signed in. The cookie policy states this in full.

10. Children

Feedmind is a business tool and is not directed at children. We do not knowingly collect data from anyone under sixteen.

11. Changes

We update this policy when the product changes. Material changes are notified by email at least thirty days in advance, and the version and date at the top identify the text in force.