Last updated: October 8, 2026.
Data controller
Dropstore
Contact: support@dropstore.pro
Information we collect
We process account details, Shopify user and store identifiers, store name and domains, granted access scopes, subscription status, saved prompts, AI responses, audit results, proposed changes, and support communications.
Through Shopify's APIs, we access product and collection content, catalog fields, and store legal policies needed for audits and merchant-approved updates. We do not request order or customer data, place cookies on merchant storefronts, or track buyer behavior.
How and why we use information
We use this information to authenticate users, connect stores, provide audits and AI features, apply changes requested by merchants, manage subscriptions, maintain security, prevent abuse, provide support, and improve service reliability.
Where the GDPR applies, these activities rely on performance of our contract, compliance with legal obligations, and our legitimate interests in securing, operating, and improving Dropstore. We do not sell personal information or use it for third-party advertising.
Analytics and service providers
We use Shopify for store access and billing, Google for optional sign-in and performance data, Umami for cookie-free product analytics, OpenAI and OpenRouter for AI features, and infrastructure providers for hosting and database services. We share information only as needed to provide these functions or comply with law.
Analytics can include page paths, referrers, device metadata, and product interaction events. URL search parameters are excluded and browser Do Not Track settings are respected. Recognized search and AI crawlers are recorded by requested path and crawler category based on their user-agent header.
Some providers may process data outside the EEA. Where required, transfers are subject to an adequacy decision or appropriate contractual safeguards.
Retention and deletion
Temporary storefront and catalog page data is retained for up to 30 days, audits and AI cache entries for up to 90 days, and proposed changes and catalog observations for up to 180 days. Account, prompt, result, and subscription records are kept while needed to provide the service and meet legal obligations.
Store-scoped data is deleted after Shopify sends a valid shop-redaction request. Backup deletion may follow the infrastructure provider's normal rotation schedule.
Security
Shopify access credentials are encrypted at rest, data is transmitted over HTTPS, and access is limited to people and systems that need it to operate Dropstore.
Your rights
Depending on applicable law, you can request access, correction, deletion, restriction, or export of your personal data, and object to certain processing. You may also complain to your local data protection authority.
Send requests to support@dropstore.pro. We may need to verify your identity before responding. Shopify customers should normally contact the merchant that controls their information.