Privacy Policy

This page summarizes how SellerVisuals processes personal data when you use our website, our app and the SellerVisuals app for Shopify. The complete and legally binding version is our German privacy policy.

Controller: SellerVisuals GmbH, Pfälzer Str. 46, 50677 Cologne, Germany. Email: hello@sellervisuals.com

When you install SellerVisuals in your Shopify store, we connect the store to your SellerVisuals account as soon as you log in or sign up. Shopify gives us an access token with the permissions “read products” and “write products”, which we store encrypted. With it we read your store’s name and domains, its billing currency and the products you import: title, description, vendor, status, tags, variants with options, SKU and barcode, and product photos with alt text. When you tell us to, we add finished images to your products and variants; we never delete existing images. We have no access to orders or to data about your customers.

When you uninstall the app, we delete the access token immediately. When Shopify sends its deletion request 48 hours later, we also delete the remaining connection data and the link between your products and the store. Imported products and images stay in your SellerVisuals account until you delete them or the account.

Purchases made through the Shopify app usually run through Shopify’s billing and appear on your Shopify invoice. We receive no payment details; we store the purchase ID, plan or pack, amount, currency, status and term. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Shopify’s own processing: shopify.com/legal/privacy

For an account we process your email address, a password (stored only as a hash by our authentication provider), your name and optional details such as phone number or company. You can also sign in with Google; we then receive your email address, name, profile picture URL and Google account ID. Account data is stored with Supabase Inc.; the database is hosted in the EU. You can try SellerVisuals as a guest; guest sessions unused for 90 days are deleted with their images.

To analyze products and create images, we send the content needed for each task (brand details, product data and links, uploaded photos, chat messages) to these service providers acting on our behalf:

• Google (Gemini API): image and video generation, text and concept processing
• OpenAI: image editing and generation, text and concept processing
• fal.ai: cut-outs, background removal, video and music generation
• Anthropic: additional concept and text processing
• QuiverAI: icons from your description (text only)
• Firecrawl and Apify: reading public product and brand pages you link to

Uploaded and generated images are stored on Google Cloud Storage (EU). When you delete a product, brand or your account, the related images are permanently deleted within 14 days. Legal basis: performance of contract and our legitimate interest in providing the service (Art. 6(1)(b) and (f) GDPR).

The website and app are hosted by Vercel Inc., USA. To deliver pages, the server processes your IP address, date and time, the requested page, the referring page and browser details. The app also logs technical events (errors, timings, steps such as “account created”) for debugging, security and product improvement. Legal basis: our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Without your consent we only use cookies and storage that are strictly necessary, for example login cookies, abuse protection for free credits and your cookie choice. Vercel Web Analytics counts page views without cookies.

Only with your consent via the cookie notice do we use Google Analytics 4 with Google Ads conversion measurement, Meta Pixel and Conversions API, OpenAI ad measurement and PostHog session replay (EU servers, recordings deleted after 30 days). Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time:

Outside Shopify, payments are handled by Stripe. Stripe collects the payment details directly; we never receive full card numbers or bank details. We store your Stripe customer ID, payment method type with its last four digits, billing name, address and email, VAT ID, and the amounts and status of your payments and subscriptions. Invoices and accounting records are kept for up to ten years as required by German tax and commercial law, also after account deletion (Art. 6(1)(b) and (c) GDPR).

We send emails such as verification codes, notifications and download links via Resend. As a registered user you also receive tips, offers and short feedback requests about our own service; you can unsubscribe from each category at any time via the link in the email or in your profile (Art. 6(1)(b) and (f) GDPR). If we contacted your business without you contacting us first, section 8 of the German policy explains where your data came from and how to object.

Several providers named above are based in the USA. We have data processing agreements with them (Art. 28 GDPR). Transfers rely on the EU-US Data Privacy Framework for certified providers or on standard contractual clauses (Art. 46 GDPR).

• Account data, brands, products and images: until you delete them, then permanently after 14 days.
• Guest sessions: 90 days after last use.
• Shopify connection: access token until uninstall; remaining connection data until Shopify’s deletion request 48 hours later.
• Invoices and accounting records: up to ten years.
• Database backups: 30 days for ongoing backups, 12 months for monthly backups; a separate EU copy for disaster recovery is not deleted automatically.

Under the GDPR you have the right to access, rectification, erasure, restriction of processing and data portability, and you can withdraw consent at any time with effect for the future. Where we rely on legitimate interest, you can object to the processing; you can object to direct marketing at any time without giving reasons. An email to hello@sellervisuals.com is enough for any request.

You can lodge a complaint with a data protection authority. Ours is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), ldi.nrw.de.