Privacy Policy

Shopstage is a service that turns your store's products into social media content you can publish, answers customer messages with AI, and lets you track sales performance. This policy explains what data is processed when you use the service. For people based in Turkey, the detailed text is in the KVKK Privacy Notice.

Data controller

• Data controller: [Company legal name]
• Address: [Address]
• Tax office / Tax ID: [Tax office] / [Tax ID]
• Phone: [Phone]
• Email: destek@shopstage.net

For data such as messages and comments from your store's customers, you, the store owner, are the data controller; we act as the data processor, handling this data on your behalf and under your instructions.

Data categories we process

• Account: full name, email address, session and security logs, plan and credit information.
• Store data (Shopify, ikas, WooCommerce, XML feeds): product name, description, price, stock, images, and order and sales summaries. We collect customer data only to the minimum extent needed for analytics or replies.
• Data from Meta (Facebook, Instagram, WhatsApp): the profile and page details you connect, posts, comments, direct messages, insights metrics, ad account and campaign information, and WhatsApp Business numbers and messages.
• Other social accounts (TikTok, YouTube, etc.): the basic identity and publishing status of the account you connect through our publishing tool, Upload-Post.
• Generated content: text, images and videos created with AI, and the instructions you send to produce them.
• Assistant conversations: messages your customers send over WhatsApp and Instagram DM, and the replies given.
• Payment: subscription and transaction status sent by the payment provider. Your card details never reach us.
• Technical data: IP address, browser information and error logs.

How we use data

• To create, schedule and publish content on your connected accounts.
• To reply to customer messages on your behalf with the AI assistant.
• To show sales and posting performance and manage ad creatives.
• To run subscriptions, credits and billing.
• To keep the service secure, prevent abuse and fix problems.
• To meet legal obligations.

We do not use data from Meta and Shopify for advertising, sell it, or train AI models with it. Only the data needed to produce the output you request is sent to AI providers.

Shopify data

Data from your Shopify store is processed in line with Shopify's protected customer data rules and used only to provide the service. Shopify's mandatory data webhooks (customers/data_request, customers/redact, shop/redact) are implemented: customer erasure requests are handled within the period Shopify sets, and store erasure requests are handled on Shopify's notification 48 hours after you uninstall the app, and the related data is deleted.

Service providers and transfers

We work with the following sub-processors to provide the service:

• Supabase: database and authentication (EU or US region).
• Vercel: application hosting.
• Anthropic: AI text generation and assistant replies.
• fal.ai, kie.ai, Higgsfield, ElevenLabs: AI image, video and audio generation.
• Upload-Post: publishing bridge for TikTok, YouTube and similar accounts.
• Meta: Facebook, Instagram and WhatsApp integrations.
• Shopify and ikas: store integrations.
• Resend: email delivery.
• Payment provider (iyzico, PayTR, Stripe or Shopify Billing; the active one is shown on the payment screen).

Most of these providers are located outside Turkey, so your data is transferred abroad. Transfers are made under Article 9 of KVKK, using standard contractual clauses and the providers' contractual safeguards. We do not sell your data.

Retention

Your data is kept while your account is open. It is deleted within 30 days after an account deletion request (Settings > Privacy and data > Delete my account, or by email as an alternative) or after you remove the connection. Invoice and payment records are kept for 10 years under tax law, and security and access logs for the legally required period. Backups are deleted automatically within their rotation cycle.

Security

Access tokens are stored encrypted. Row-level security (RLS) is enabled on database tables, and users can access only their own data. TLS is used in transit. Scheduled and background jobs run on the server side.

Your rights

You have the right to access, correct and delete your data, to object to its processing, and to get a copy of it. You can export your data from Settings > Privacy and data and delete your account in the same place. For other requests, write to destek@shopstage.net. Your rights under KVKK are listed in the Privacy Notice.

Disconnecting and revoking access

• In the app: remove the account under Settings > Connections.
• Facebook / Instagram: remove the app under Facebook Settings > Business Integrations.
• Shopify: remove the app under Apps in your Shopify admin.

To have all of your data deleted, see the Data Deletion Instructions page.

Children

The service is not directed at people under 18, and we do not knowingly collect data from anyone under 18.

Changes and contact

When we update this policy, we change the date on this page and notify you of important changes by email. Questions: destek@shopstage.net