Xpert AI Platform Privacy Policy

Effective date: August 24, 2026
Last updated: August 25, 2026

This Privacy Policy explains how Xpert Developerz ("Xpert Developerz," "we," "us," or "our") handles information when a merchant installs or uses Xpert AI Platform (the "App") with a Shopify store. The App provides store synchronization, operational dashboards, analytics, a searchable knowledge base, and AI-assisted store management features.

1. Information we collect

The information available to the App depends on the permissions granted by the merchant and the features the merchant uses.

Shop and merchant information

• Shop domain, shop identifiers, store settings, currency, locale, and timezone.
• Merchant contact and account information provided through Shopify or directly to us.
• App installation status, granted access scopes, authentication credentials, and technical connection data.

Store operational data

• Products, variants, inventory, collections, tags, vendors, prices, and related catalog information.
• Orders, draft orders, fulfillment, payment and refund status, line items, and transaction-related information.
• Customer information needed for enabled App features, including names, email addresses, phone numbers, customer tags, and relevant purchase or order information such as order counts and amounts spent. The App does not routinely retain customer physical addresses in its local customer synchronization cache.
• Policies, files, metaobjects, navigation information, analytics, and other store content used by enabled App features.

App usage and uploaded content

• Questions, instructions, confirmations, conversation history, and results generated through the AI assistant.
• Documents and other files a merchant uploads to the knowledge base.
• Diagnostic information such as webhook events, synchronization activity, errors, timestamps, and security logs.

2. How we use information

We use and retain information only to the extent reasonably necessary to operate, secure, support, and improve the App. We seek to minimize customer personal information synchronized into the App and use authorized Shopify data only for enabled features, including to:

• Authenticate the merchant and connect the App to the correct Shopify store.
• Synchronize and display authorized store information.
• Answer merchant questions, provide operational insights, search uploaded knowledge, and prepare supported store actions.
• Execute a store change only after the confirmation required by the App's workflow.
• Maintain conversation context and App preferences.
• Monitor reliability, prevent abuse, troubleshoot errors, and protect the App and its users.
• Respond to support requests and comply with applicable legal obligations.

3. AI processing

Xpert AI Platform uses the Google Gemini API to generate responses and assist with supported App features. When a merchant uses an AI feature, the App may send the merchant's prompt and the minimum relevant store context or uploaded content needed to answer the request to Google for processing.

Google processes this information under its own terms and privacy practices. Depending on the Gemini service tier and enabled features, Google may retain prompts, contextual information, and generated responses for security, abuse monitoring, service operation, or other purposes described in its terms. Merchants should avoid entering information that is not necessary for the requested task and should not submit highly sensitive information through AI prompts.

4. When we share information

We do not sell merchant or customer personal information. We may disclose information in the following limited circumstances:

• Shopify: to operate the App within Shopify and communicate through Shopify APIs and webhooks.
• Google Gemini: to process AI requests as described above.
• Infrastructure providers: to host the App, database, backups, monitoring, email, and security services.
• Professional advisers or authorities: when reasonably necessary to comply with law, enforce agreements, protect rights and safety, or respond to valid legal process.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality protections.

Service providers are permitted to process information only for the services they provide to us and subject to their applicable contractual and legal obligations.

5. Data retention and deletion

We retain information only for as long as reasonably necessary to provide the App, maintain security, comply with legal obligations, and resolve disputes. Operational store data is retained while the App is installed and the relevant feature is in use.

When a merchant uninstalls the App, we disable the store connection and remove active access credentials. Store and customer personal information is deleted or anonymized within 30 days after uninstall or a verified deletion request, unless limited retention is required by law or is necessary to prevent fraud, maintain security, or resolve a dispute. Residual copies may remain temporarily in restricted backups until the applicable backup expires or is overwritten.

6. Privacy requests and Shopify compliance webhooks

Merchants and individuals may request access to, correction of, or deletion of personal information, subject to applicable law. If you are a customer of a Shopify merchant, please contact that merchant first because the merchant controls its customer relationship and can submit the appropriate request through Shopify.

The App supports Shopify's mandatory privacy processes for customer data requests, customer erasure requests, and shop erasure requests. We verify applicable webhook requests before processing them. Valid requests are handled in accordance with Shopify requirements and applicable law, including providing requested information to the merchant and completing required deletion or anonymization within the applicable response period.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information, including role-restricted access, key-based administrative access, HTTPS/TLS network connections, credential restrictions, signed-request verification, service monitoring, separate development and production environments, and confirmation controls for supported write actions. No system is completely secure, and we cannot guarantee absolute security.

8. International processing

We and our service providers may process information in countries other than the country where a merchant or customer is located. Where required, we use appropriate safeguards for international transfers and process information in accordance with applicable law.

9. Children's privacy

The App is a business tool intended for Shopify merchants and their authorized staff. It is not directed to children, and we do not knowingly collect personal information directly from children through the App.

10. Merchant choices and responsibilities

Merchants control which authorized users access the App, which documents are uploaded, which prompts are submitted, and whether a proposed store action is confirmed. Merchants are responsible for using the App lawfully, providing required notices to their customers, and obtaining any consent required for their own collection and use of personal information.

11. Merchant Data Processing Terms

This section forms the data processing terms between Xpert Developerz and each merchant that installs or uses Xpert AI Platform. It applies when we process personal information on the merchant's behalf through the App.

Roles and instructions

The merchant is the controller or business responsible for its customers' personal information. Xpert Developerz acts as the merchant's processor or service provider for that information. We process it only to provide, secure, support, and improve the App; to follow the merchant's documented actions and settings; and to meet legal obligations.

Scope and purpose

Processing may include collecting, receiving, organizing, storing, consulting, displaying, analyzing, synchronizing, transmitting, deleting, or otherwise using the categories described in Section 1. The people concerned may include the merchant's customers, prospective customers, staff, and authorized App users. Processing continues while the App is installed and for the limited deletion period described in Section 5.

Confidentiality and access

We limit access to personal information to authorized personnel and service providers who need it to operate or support the App and who are subject to confidentiality or data-protection obligations.

Service providers and international transfers

The merchant authorizes us to use service providers needed to operate the App, including infrastructure hosting and Google Gemini for enabled AI features. We remain responsible for selecting providers appropriate to their role and requiring them to protect personal information. Processing may occur outside the merchant's country, subject to appropriate safeguards where required by law.

Assistance with requests and incidents

Taking into account the nature of the processing, we will reasonably assist merchants with verified privacy requests, Shopify compliance requests, and information needed for their data-protection obligations. If we confirm a security incident involving merchant personal information, we will notify the affected merchant without undue delay and provide available information reasonably needed for the merchant's response.

Deletion, return, and audits

At the end of App use, we delete or anonymize merchant personal information as described in Section 5 unless applicable law requires retention. On reasonable request, we will provide information necessary to demonstrate compliance with these terms, subject to confidentiality, security, and proportionality limitations.

Acceptance and priority

By installing or continuing to use Xpert AI Platform, the merchant instructs us to process information as described here and accepts these Merchant Data Processing Terms. If a separate signed data processing agreement applies, that agreement controls to the extent of any conflict.

12. Changes to this policy

We may update this Privacy Policy to reflect changes to the App, our practices, service providers, or legal requirements. We will publish the revised policy on this page and update the date above. Material changes may also be communicated through the App or another appropriate channel.