Seokai Logo
Get Started (opens in new tab)

Privacy Policy

At SeoKai, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our website and services.

Last Updated: 11th July, 2026

This Privacy Policy explains how Seokai ("we", "us", "our") collects, uses, stores, and protects your data when you use our Shopify application and our website (seokai.ai). We comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and other applicable data protection laws.

Who We Are

The data controller responsible for your personal data is Meta Mine, a limited liability company established in Bulgaria (European Union), registered at Burgas 8018, Bulgaria. You can reach us, including on any privacy or data protection matter, at support@seokai.ai.

Because we are established in the European Union, we are not required to appoint an EU/EEA representative under Article 27 GDPR. Our service is available internationally but is not specifically directed at the United Kingdom market, and we do not consider a UK GDPR representative to be required. Where UK GDPR applies to your use of our services, you may exercise your rights and contact us using the details above.

1. Data We Collect

1.1 Shopify Store Data

When you install Seokai, we access your Shopify store through Shopify’s secure OAuth process. We request permission to:

  • Read and write product, collection, page, and article metadata (titles, descriptions, tags, images, alt text).
  • Read and write store navigation and files (for LLMs.txt exports).
  • Read locales and translations; write translated SEO content.

We also collect your store domain, contact email, and language settings for app configuration and reporting.

1.2 Store Content

We store copies of your product, collection, page, and article metadata in our database to perform SEO analysis, scoring, and AI optimization.

1.3 Image Data

  • Image backups: When you optimize an image, we store a backup copy of the original image file in our secure cloud storage so you can restore it at any time.
  • Image metadata: We collect image dimensions, file size, format, and quality information to provide optimization analysis and recommendations.

We only process images that you explicitly select for optimization or analysis. Image backups are associated with your store and the corresponding Shopify media identifiers.

1.4 Account and Billing

  • Subscription: Plan name, status, and purchase history — managed through Shopify’s billing system.
  • Usage: Credit balance and records of AI operations (what was generated, when, credits consumed).
  • Settings: Automation preferences, weekly report settings, and feature configurations.

1.5 Authentication

We store secure session tokens provided by Shopify. These are deleted when you uninstall the app.

1.6 Contact and Communication

  • Contact form: Name, email, subject, and message — forwarded to our team via email, not stored in our database.
  • Newsletter: Your email address is encrypted (AES-256-GCM) before storage. You can unsubscribe at any time.
  • Support tickets: Messages and conversation history, stored to provide ongoing assistance.

1.7 Technical Data

  • IP addresses: Temporarily collected for rate limiting on public forms. Automatically deleted within minutes.
  • Operational events: Processing status of store events — automatically deleted after a short period.

1.8 Exported Files

  • LLMs.txt files: Aggregated store content to help AI search platforms discover your store.
  • Meta backups: CSV exports of your SEO metadata for backup and portability.

These files are stored securely and can be deleted by you at any time.

We do not collect payment card details, customer order data, or your end-customers’ personal information. All billing is handled by Shopify.

2. How We Use Your Data

  • Perform SEO analysis, scoring, and optimization recommendations.
  • Generate and optimize meta titles, descriptions, keywords, tags, and image alt text using AI.
  • Analyze image quality, dimensions, and file size to provide optimization recommendations using AI.
  • Compress, resize, and convert images to optimized formats (JPEG, PNG, WebP, AVIF) to improve store performance.
  • Create and manage backup copies of original images before optimization, and restore them on request.
  • Automatically generate SEO metadata for new products and collections when automation is enabled.
  • Generate translated SEO content for multi-language stores.
  • Generate LLMs.txt files and meta backup exports.
  • Send transactional emails (welcome messages, update notifications, weekly SEO reports).
  • Track credit usage and enforce plan limits.
  • Provide customer support.
  • With your consent, send marketing communications.

3. Automated Processing

When you enable automation, Seokai automatically processes new products and collections:

  • Metadata automation: Generates optimized meta titles, descriptions, and keywords for new products and collections.
  • Alt text automation: Generates descriptive alt text for new product images.

You can enable or disable each automation independently at any time. Automated processing consumes credits from your plan.

Image optimization (compression, resizing, format conversion, and AI analysis) is not automated — it is only performed when you explicitly select and process images. Each optimization operation consumes credits from your plan.

4. Legal Basis for Processing (GDPR)

  • Contract performance: Processing necessary to deliver Seokai’s features as part of your subscription.
  • Consent: Marketing communications and newsletter subscriptions. Withdrawable at any time.
  • Legitimate interests: Service improvement, security, and abuse prevention — balanced against your rights.
  • Legal obligation: Where required by applicable law.

5. Data Sharing and Service Providers

We do not sell your personal data and we do not share it for cross-context behavioural advertising. To run Seokai we rely on a limited number of service providers that process data on our behalf, under our instructions and appropriate safeguards. Some process data in the United States (see Section 11). They fall into these categories:

  • Shopify — the platform the app runs on: authentication, billing, and read/write access to your store data (generated metadata is written back to your store).
  • OpenAI — our AI provider, for content generation. See Section 5.1.
  • Google — website analytics and anti-spam protection, loaded only with your consent. See Section 10.
  • Cloud infrastructure providers — hosting, database, storage, email delivery, and error monitoring used to operate the app and website.

5.1 AI Provider

Our AI features are powered by OpenAI, accessed through the OpenAI API. To generate content we send business data such as your store domain, catalogue content, and brand voice settings. This is business content rather than personal data, and data sent through the OpenAI API is not used to train its models. We do not send shopper or end-customer personal data for AI processing; please avoid entering personal information into fields used for content generation.

We may also disclose data if required by law or to protect our rights and the safety of our users.

6. Marketing Communications

If you subscribe to our newsletter, we may send product updates, SEO tips, and promotional content. You can opt out at any time via the unsubscribe link in any email. We never share your email for third-party marketing.

7. Data Retention

While your account is active: we retain your data for the duration of your subscription so we can provide the service.

When you uninstall Seokai, we do not delete everything. To be transparent, here is exactly what happens:

Deleted on uninstall. The following are deleted promptly when we receive the uninstall/redact signal from Shopify:

  • Shopify session records and access tokens (authentication is immediately revoked).
  • Your staff/merchant identity and contact details on your store record (contact email, primary domain, and store URL are cleared).
  • Stored copies of your store content — products, collections, pages, and articles.
  • Image backups and exported files (LLMs.txt files and meta backup CSVs) held in cloud storage.
  • Operational and processing records such as webhook events and background job records.
  • Automation, weekly report, and feature settings (automation is disabled).

Retained after uninstall. We intentionally keep certain records for accounting, legal, tax, security, and analytics purposes. These include billing, subscription, and usage/credit history, service metrics, content embeddings, support tickets and conversation history, internal link suggestions, sitemap audits, and AI-visibility data. Where these records are no longer needed for those purposes we delete or anonymise them, and you can ask us to delete them sooner (see Section 8), subject to legal retention obligations. A minimal store record is kept so that a re-install can restore your plan history.

  • Newsletter: Retained in encrypted form (AES-256-GCM) until you unsubscribe or request deletion.
  • Contact form: Not stored — forwarded to our team by email and not retained in our database.
  • IP addresses: Transient only — used as short-lived rate-limit keys and automatically expired within minutes.

8. Your Rights

EU/EEA (GDPR) and UK (UK GDPR). Depending on your location, you have the right to:

  • Access: Request a copy of your data. You can also export via meta backup (CSV) and LLMs.txt.
  • Correction: Request correction of inaccurate data, or edit directly in the app.
  • Deletion ("right to be forgotten"): Request deletion of your data. Note that uninstalling deletes some data automatically but not all of it (see Section 7); to have retained records erased, send us a deletion request and we will comply except where we must keep records for legal or accounting reasons.
  • Portability: Request data in a structured, machine-readable format (CSV).
  • Objection: Object to processing based on legitimate interests.
  • Restriction: Limit processing. You can disable automations and reports at any time.
  • Withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing.
  • Complaint: Lodge a complaint with your local supervisory authority. Our lead supervisory authority is the Bulgarian Commission for Personal Data Protection (CPDP); in the UK this is the Information Commissioner's Office (ICO).

California (CCPA/CPRA). If you are a California resident, you have the right to: know what personal information we collect and how we use it; request access to and deletion of that information; correct inaccurate information; and opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information (including for cross-context behavioural advertising), so no "Do Not Sell or Share My Personal Information" action is required — but you may still contact us to confirm this. We will not discriminate against you for exercising any of these rights.

To exercise any right, contact us via Section 14. We respond within 30 days (GDPR/UK GDPR) or 45 days (CCPA/CPRA), extendable where permitted by law.

9. Data Security

  • Encryption in transit (TLS/SSL) and at rest for all data.
  • Additional encryption for sensitive data such as email addresses.
  • Verification of all incoming Shopify webhooks.
  • Rate limiting on public endpoints.
  • Restricted access on a need-to-know basis.

No system is 100% secure. If you discover a security issue, please contact us immediately.

10. Cookies and Tracking

Our website uses:

  • Essential: Required for site functionality. Cannot be disabled.
  • Analytics: Google Tag Manager and Google Analytics 4. Only set with your consent.
  • Marketing: Ad campaign measurement. Only set with your consent.

A cookie consent banner appears on your first visit. We use Google Consent Mode v2 — analytics and marketing data is only collected after you grant consent.

Google reCAPTCHA: Our contact form is protected by Google reCAPTCHA to prevent spam and abuse. reCAPTCHA sets Google cookies and processes signals such as your IP address and device/browser information to distinguish humans from bots. This is necessary for the security of the form and operates under Google's terms. See Google's Privacy Policy and Terms of Service.

The Shopify app does not set its own cookies. Authentication is handled by Shopify.

11. International Data Transfers

Seokai and its sub-processors (see Section 5) process and store data in the United States. If you are in the EU/EEA or the UK, this means your data is transferred outside your home region. For these transfers we rely on appropriate safeguards, including the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, and — where a provider is certified — the EU-U.S. Data Privacy Framework (DPF) and its UK extension. You may contact us for more information about these safeguards.

12. Children's Privacy

Seokai is a business tool intended for Shopify merchants. It is not directed to children and we do not knowingly collect personal data from anyone under 18. You must be at least 18 years old (or the age of majority in your jurisdiction) to use Seokai. Consistent with the US Children's Online Privacy Protection Act (COPPA), we do not knowingly collect information from children under 13; if we learn that we have, we will delete it. If you believe a child has provided us with personal data, please contact us.

13. Changes to This Policy

We may update this policy. Material changes will be communicated via email or in-app notice before taking effect.

14. Contact Us and Complaints

For questions, privacy concerns, or to exercise your data rights, contact us at support@seokai.ai or via our Contact page.

If you are in the EU/EEA or the UK, you also have the right to lodge a complaint with your local data protection supervisory authority (our lead authority is the Bulgarian Commission for Personal Data Protection; in the UK, the Information Commissioner's Office) if you are unhappy with how we have handled your data.