NextApps Product Audit — Privacy policy draft

Draft for legal review · 28 October 2026

NEXTAPPS.TECH (SMC-PRIVATE) LIMITED operates NextApps Product Audit. Contact: contact@nextapps.tech.

What we process

We use Shopify authentication and read_products access to read product IDs, titles, handles, descriptions, image presence, SEO fields, product status and update times, and the store identity and product count. We store product titles and derived audit facts to provide scores and recommendations. We do not store full descriptions or image files. We do not request customers, orders, or payment data.

Storage and retention

Shopify session access and refresh tokens are encrypted on the server. Audit results and preferences are scoped to each store. We keep at most two catalog snapshots, up to 90 compact catalog summaries within 90 days, daily Pro product scores for up to 30 days, and report previews for up to 30 days. Optional email preferences use your verified Shopify user email; no email is sent in this development release. Production operation must run the supplied maintenance task daily to delete catalog snapshots older than 30 days, compact history older than 90 days, email jobs and report previews older than 30 days, and webhook receipts older than seven days. Backups and log retention must be configured before launch.

Sharing

Shopify provides the platform and API. No AI provider receives product data in this MVP. Hosting and database providers, processing locations, subprocessors, backup retention and international transfer terms must be documented before publication. We do not sell merchant data.

Access and deletion

Contact support for access, correction or deletion requests. Shopify compliance webhooks handle customer-data requests, customer redaction and shop redaction; no customer records are held. Uninstall cleanup deletes stored audit results, history, monitoring jobs, email preferences and jobs, settings and sessions when the verified webhook arrives.

Before publication

This draft requires legal review, the registered company address, selected hosting/subprocessor disclosures, retention schedules, applicable rights and a final effective date. It is not a finalized public policy.