Privacy Policy

Who we are

Any reference to "we", "us", "our" or "ShopyBuilder" in this policy means ShopyBuilder and its proprietor named below, who is the data fiduciary responsible for your personal data under the Digital Personal Data Protection Act, 2023.

Data we collect

We collect only what the service actually needs to work. There is no advertising network, no data broker, and no sale of personal data.

Information you give us

• Account details. Your name and email address. If you sign in with Google, we also receive your Google account identifier and profile picture URL from Google. If you sign up with an email and password, we store a hashed version of your password, never the password itself. We also ask for the year you were born, so that we can confirm you are 18 or older; we do not ask for or store a full date of birth.
• Product and project content. Anything you enter or paste into the builder: product titles, descriptions, benefits, ingredients, review text, store URLs, brand details and the pages you generate from them.
• Images you upload. Product photos, logos and reference creatives you upload for the AI image tools.
• Support messages. The content of emails you send to us and any details you include in them.

Information collected automatically

• Usage records. Which AI actions you ran, how many credits each one used, what each one cost us to run, and when. This is how your credit balance is calculated, and how we track the running cost of the service.
• Country. The country your connection comes from, worked out from your IP address by our network provider when you first use the app. We store only the two-letter country code with your account, and use it for overall statistics.
• Technical logs. Your IP address, browser type and request timestamps, used for security, rate limiting and diagnosing errors.
• Browser storage and one essential cookie. Your sign-in token and interface preferences such as the last screen you were on are kept in your own browser's local storage. While you are signed in, we also set one strictly necessary, short-lived cookie that lets your browser load the editor's files. None of these are advertising cookies, and none are shared with anyone.

Payment information

Payments are processed by our payment gateway. We do not receive or store your card number, CVV, UPI PIN, net banking credentials or any other payment instrument details. We receive only the outcome of a transaction, the amount, the currency and a reference identifier, which we need in order to credit your account and issue refunds.

Why we use it

Each category of data is used for a specific, limited purpose.

We process this data because it is necessary to perform the contract you enter into when you create an account and buy a plan, because you have consented to it, and because we have to meet legal obligations such as keeping tax records. Where consent is the basis, you may withdraw it at any time as described in the rights section below.

AI processing of your content

ShopyBuilder generates text and images using a third party AI model provider. When you run a generation, the product information you entered and any images you uploaded for that task are transmitted to that provider so the output can be produced. This is the core function of the service and cannot be switched off while still using the AI features.

Please do not paste personal data about other people, customer lists, payment details, identity document numbers or confidential third party information into the builder. The tool is designed for product marketing content, and that is the only kind of content you should put into it.

Who we share it with

Inside ShopyBuilder. Only authorised ShopyBuilder personnel, bound by confidentiality, can see account details: your email, name, country, plan, credits, payments and which tools you used and when. This is used to answer support requests, fix problems, handle payments and refunds, and stop abuse, and every change made to an account this way is logged. We do not look at your prompts or images in this view. In-app updates record whether you have seen them, so they are not shown to you again.

We do not sell your personal data and we do not share it for anyone else's marketing. We share it only with the service providers we need in order to run ShopyBuilder, and only to the extent each one needs.

• Sign-in provider. If you choose to continue with your Google account, Google confirms your identity and shares your name, email address and profile picture with us.
• AI model providers. Text and image generation runs on third party AI model providers. The product information, text and images you submit for a generation are sent to them for processing, under their business terms.
• Cloud storage and network provider. Storing images generated or uploaded through the service, and protecting the website from abuse.
• Our payment gateway. Payment processing, refunds and the transaction records that go with them. They handle your payment details directly under their own privacy policy.
• Our hosting and database provider. Running the application servers and storing your account and project data.
• Our email provider. Sending transactional email such as password reset codes and billing notices.
• Advertising partners. Our website and app may use advertising measurement tags from social media and search advertising platforms, to measure our ads and to show our ads to people who visited ShopyBuilder. They receive the pages and tools visited and events such as signing up, buying a plan or credits (with the amount) and making a first image, along with your IP address and browser details, and they may set their own cookies. We do not send them your name, email, phone number, prompts or images. In the European Economic Area, the United Kingdom and Switzerland, this tracking is off by default. You can manage ad preferences in the settings of the platforms you use.
• Analytics provider. Our website and app use a web analytics service to understand, in aggregate, how people use ShopyBuilder: pages and tools visited, time spent, country, device and browser. It sets its own cookies and receives your IP address, which it uses for approximate location and does not store. We do not send it your name, email, prompts or images. Its advertising features may be used to measure our ads and to show our ads to people who visited ShopyBuilder (remarketing). In the European Economic Area, the United Kingdom and Switzerland, analytics and advertising cookies are off by default. You can block analytics cookies in your browser settings.

We may also disclose data where we are legally required to, for example in response to a valid order from a court or a competent authority, or where it is necessary to establish, exercise or defend a legal claim. If ShopyBuilder is ever transferred to another operator, your data may transfer with it, and we will tell you before that happens.

Where your data is stored

Our service providers operate infrastructure in multiple countries, so your data may be stored or processed outside India. Where that happens, it is handled under the contractual terms and safeguards offered by each provider. By using the service you acknowledge that this cross border processing takes place. If the Government of India restricts transfers to a particular country under the Digital Personal Data Protection Act, 2023, we will stop transferring data to that country.

How long we keep it

• Account and project data. Kept while your account exists. You can delete your account at any time from My Account in the app; your account record, projects and gallery images are deleted immediately. If you write to us instead, we do the same within 30 days. You can also download a copy of your data from My Account.
• Social Posts brand details. The brand details you choose to save in Social Posts (name, usernames, what you sell, and any logo, phone number, address or website you add) are kept only when you tick “Save these details to my account”. You can edit or delete a brand at any time; deleting it, or your account, removes these details and the saved logo.
• Generated and uploaded images. Images in your AI Gallery are deleted automatically 90 days after they are created. Images you add to a tool (for example a product photo or a reference) are saved for 90 days so you can use them again, then deleted automatically. Images you move to the bin are deleted 30 days later. A saved brand logo is kept until you delete the brand or your account.
• Storage limit. Each plan includes a set amount of storage for your generated images, uploads and logos, shown in My Account. When it is full, new images and uploads pause until you delete some or upgrade; nothing is deleted for you before its normal time.
• Unused accounts. An account that has never had a paid plan is deleted automatically, with its projects and images, 180 days after it was created.
• Transaction and invoice records. Kept for as long as required by Indian tax and accounting law, even after your account is deleted. These records are retained in a limited form, containing only what the law requires.
• Technical logs. Kept for a short period, normally not more than 90 days, and then discarded.
• Image generation records. For tools that use a reference image, we record your account, the time, your confirmation that you have the rights to the images, and fingerprints (hashes) of the images used and produced. We never keep the images in this record. It is kept for up to three years, including after your account is deleted, so that we can answer copyright, likeness or takedown complaints.
• Support email. Kept for as long as needed to resolve the matter and for a reasonable period afterwards in case the issue recurs.

Your rights

You can ask us to do any of the following, free of charge, by writing to [email protected] from the email address on your account.

• Access. Get a copy of the personal data we hold about you and a summary of how it is being processed.
• Correction. Have inaccurate or incomplete data corrected or completed.
• Erasure. Have your account and associated data deleted, subject to records we must keep by law.
• Withdraw consent. Withdraw consent where processing is based on it. This does not affect anything done before you withdrew it, and it may mean you can no longer use parts of the service.
• Nominate. Nominate another person to exercise these rights on your behalf if you die or become unable to act, as provided under the Digital Personal Data Protection Act, 2023.
• Complain. Raise a grievance with us, and if you are not satisfied with our response, escalate it to the Data Protection Board of India.

We will verify that a request genuinely comes from you before acting on it, and we will respond within 30 days.

Security

We take reasonable technical and organisational measures to protect your data. Traffic between your browser and our servers is encrypted in transit using HTTPS. Passwords are stored as hashes, not as readable text. Access to the production database and storage is restricted to authorised personnel. Sign-in is protected by expiring tokens.

No online service can promise perfect security, and we do not. If a personal data breach occurs that affects you, we will notify you and the Data Protection Board of India as required by law, and tell you plainly what happened and what you should do.

Children

ShopyBuilder is a business tool and is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, write to us and we will delete it.

Changes to this policy

We may update this policy as the service changes or as the law changes. The version in force is always the one published on this page, with the date at the top. If a change materially affects your rights, we will tell you by email or through a notice inside the application before it takes effect. Continuing to use the service after a change means you accept the updated policy.

Grievance officer

In line with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023, the contact for privacy questions, complaints and data rights requests is: