Seokai Logo
Get Started (opens in new tab)

Privacy Policy

At SeoKai, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our website and services.

Last Updated: 16 October 2026

This Privacy Policy explains how Seokai ("we", "us", "our") collects, uses, stores, shares, and protects data when you use our Shopify app and our website (seokai.ai). It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and other applicable data protection laws.

Seokai is a business tool for Shopify merchants. It does not request access to your shoppers' customer or order data, so the personal data we handle is mostly your store's contact details, anything you type into the app, and data about visitors to our website.

Who We Are

The data controller responsible for your personal data is Meta Mine, a limited liability company established in Bulgaria (European Union), registered at Burgas 8018, Bulgaria. You can reach us, including on any privacy or data protection matter, at support@seokai.ai.

Because we are established in the European Union, we are not required to appoint an EU/EEA representative under Article 27 GDPR. Our service is available internationally but is not specifically directed at the United Kingdom market, and we do not consider a UK GDPR representative to be required. Where UK GDPR applies to your use of our services, you may exercise your rights and contact us using the details above.

For personal data that appears in your store content and that we process to provide the app on your behalf, you are the controller and we are your processor. That processing is covered by our Data Processing Agreement. This policy covers everything else, and explains the data flows in either case.

1. Data We Collect

1.1 Shopify Store Access

When you install Seokai, you grant access to your store through Shopify's OAuth process. We request permission to:

  • Read and write products and online store content (products, collections, pages, and blog posts): to read your catalogue and to write back what you approve or automate, including page titles, meta descriptions, focus keywords, titles, descriptions and blog post bodies, URL handles, image alt text, product type, FAQ content, and structured-data (JSON-LD) metafields.
  • Read and write files: to replace image files with optimized versions and to restore originals.
  • Read and write store navigation: to create, list, and delete URL redirects.
  • Read locales and translations, and write translations: for multi-language SEO.
  • Read and write themes (optional): requested only if you choose a feature that edits a theme file, such as applying an llms.txt / agents.md override or a robots.txt fix.

We also store your store's contact email, primary domain, store URL, and primary language, which we use for app configuration, emails, and reports.

1.2 Store Content

We keep copies of your product, collection, page, and blog post content (titles, descriptions, handles, SEO fields, FAQ, and, for products, details such as vendor, tags and media) in our database. We use them for SEO scoring, the site audit, AI generation, internal-link suggestions, duplicate-content detection, and reports. We also keep:

  • Revision history: earlier versions of the fields we change, so you can undo changes.
  • Content embeddings: numeric representations of titles and descriptions, used to suggest internal links and spot competing content.
  • Audit results: site audit, sitemap, and robots.txt findings. To produce them, we fetch your public storefront's robots.txt, sitemap, /agents.md, /llms.txt, /llms-full.txt, and product pages.

1.3 Images

  • Image index: When you open the Images page, Seokai automatically scans your store and records the URL, alt text, file size, and dimensions of every product, collection, and blog post image. To estimate possible savings, each scan downloads a sample of images (up to 30) to our servers and runs a trial compression. Nothing is changed in your store by the scan.
  • Optimization: When you choose to optimize images, our servers compress and/or resize them. This is standard image processing, not AI. The optimized file then replaces the original in your Shopify store.
  • Backups: Before replacing an image for the first time, we store a copy of the original file in our cloud storage. If you optimize the same image again, we keep that first original. The backup is kept until you restore the image or until your store data is deleted (see Section 7).
  • Alt text: Writing alt text uses AI. We send the image's Shopify URL and the item's title to our AI provider (see Section 5.2).

Images may show people. Please only upload images you have the right to use.

1.4 AI Visibility

On paid plans you can track how an AI assistant answers shopper questions. We store:

  • the questions you track (up to 25), including questions the app suggests from your catalogue;
  • the brand names, competitors, and hidden domains you enter;
  • the full AI answers, the websites they cite, and whether your store or other businesses were mentioned or recommended;
  • your optional weekly schedule for automatic checks.

Answers can name other businesses and websites. Questions are sent to our AI provider, which uses live web search (see Section 5.2).

1.5 Brand Voice, Social Post Drafts, and Settings

  • Brand voice: the tone, audience, words to avoid, and guidance you enter. These are free text and used when the AI writes titles, descriptions, and social posts.
  • Social post drafts: the subject, goal, note, chosen product image, and captions for Instagram, Facebook, X, and LinkedIn. Seokai saves drafts for you to copy. It does not publish to any social network.
  • Settings: automation switches, image settings, weekly report schedule and time zone, notification preferences, AI assistant credit budget, and similar preferences.

Please avoid entering other people's personal information in these free-text fields.

1.6 Account, Billing, and Usage

  • Subscription and purchases: plan, status, and credit pack purchases, received from Shopify's billing system. We never see your payment card details.
  • Credits and usage: credit balances, credit lots and their expiry dates, credit debt, and records of each operation (what was generated, when, and the credits used).
  • Weekly reports: the stored statistics and the AI-written tip for each weekly report.

1.7 Authentication and Connected AI Assistants

  • Shopify session: the access token Shopify gives us so the app can work with your store.
  • AI assistant connections (MCP): On paid plans you can connect a third-party AI assistant (such as ChatGPT or another assistant that supports the Model Context Protocol) through an OAuth consent screen in Seokai. We store the assistant's name, its redirect address, the permissions you granted, and hashed access tokens linked to your store. Access tokens last 1 hour and can be refreshed for up to 30 days. You can revoke a connection at any time in Settings. Uninstalling Seokai ends access for all connected assistants.

1.8 Contact and Communication

  • Contact form (website): your name, email, subject, and message. These are not saved in our database. They are sent by email through Amazon Web Services (SES) to our support mailbox, hosted by Namecheap.
  • Newsletter and "Notify me" sign-ups (website): your email address. It is encrypted (AES-256-GCM) before storage, together with a one-way hash used to find duplicates. The address is kept in our own database; we do not use a third-party newsletter service.
  • Support tickets (app): the subject and the full message thread.

1.9 Technical Data

  • IP addresses for rate limiting: when you use our public forms and endpoints, your IP address is used as a short-term rate-limit key to prevent abuse.
  • Error reports: if the app or a browser page crashes, we record technical details such as the page, the error, your store, your IP address, and your browser's user agent so we can fix the problem.
  • Store event records: processing records for notifications Shopify sends us (for example, product created or billing updated).

1.10 Exported Files

  • llms.txt files: files built from your catalogue that you can download and, if you choose, publish through a theme override. We keep a short history of recent files; older files are deleted from storage when new ones are generated.
  • Meta backups: CSV exports of your page titles, meta descriptions, and focus keywords, which you can restore from.

What we do not collect: payment card details, your shoppers' names, emails or addresses, or order data. Shopify sends every app mandatory privacy notifications about shopper data requests and deletions. Because Seokai holds no shopper data, there is nothing for us to return or delete in response. We do not log or store the shopper details these notifications contain.

2. How We Use Your Data

  • Score your content, run the weekly site audit, and recommend fixes.
  • Write and rewrite page titles, meta descriptions, focus keywords, titles, descriptions, blog post bodies, FAQ, and image alt text with AI, at your request, through bulk update, or through automation.
  • Write structured-data (JSON-LD) metafields and fill an empty product type.
  • Index, compress, and resize images, keep backups, and restore originals.
  • Run AI visibility checks, manually or on your weekly schedule, and show who the AI recommends instead.
  • Suggest internal links and detect competing content.
  • Create, import, and delete redirects, including automatic redirects when a product or collection URL changes (if switched on).
  • Edit theme files only where you grant theme access and ask us to apply a change. We keep a copy of the file so you can undo.
  • Draft social media captions.
  • Translate generated SEO content into your store's published languages (multi-language SEO).
  • Generate llms.txt files and meta backup exports.
  • Answer requests from Shopify Sidekick and from AI assistants you connect (see Section 5.4).
  • Send service emails to your store contact email:
    • a welcome or welcome-back email when you install or reinstall;
    • weekly SEO and AI visibility reports, if switched on (Growth plan and above);
    • a notice when a bulk update finishes, if switched on;
    • reminders about 30 days before purchased or reward credits expire, while the app is installed.
  • Track credits and enforce plan limits.
  • Provide support, keep the service secure, prevent abuse, and fix errors.
  • With your consent, send our newsletter.

3. Automated Processing and Changes to Your Store

Some features act without you reviewing each change:

  • Automation (each switch is optional): writes search appearance (page title, meta description, focus keyword) for new products and new collections, and alt text for new product images that have none. It runs when an item is created, and uses credits.
  • Automatic redirects (optional, free): when a product or collection URL handle changes, we create a 301 redirect from the old address. This requires us to receive product update notifications.
  • Bulk update "Save automatically": saves AI suggestions across many items without one-by-one review.
  • Image scanning: runs automatically when you open the Images page (index and trial compression only).
  • Scheduled tasks: the weekly site audit, weekly internal-link scan (Scale and above), weekly AI visibility checks (if scheduled), and scheduled llms.txt generation (if set up).
  • Connected AI assistants: if you grant write permission, an assistant can write meta content, alt text, and product type directly to your store, within the daily credit budget you set.

You can switch automations off at any time. Most changes can be undone from the item's History, from bulk update undo, by restoring an image, or from a meta backup. None of this processing makes decisions about individuals that have legal or similarly significant effects.

4. Legal Basis for Processing (GDPR)

  • Contract performance: providing the app and its features, service emails tied to features you use (reports, bulk-update notices, credit reminders), billing, and support.
  • Legitimate interests: security, abuse prevention and rate limiting, error monitoring, welcome emails, website hosting and content delivery, reCAPTCHA spam protection, and keeping records after uninstall (see Section 7). We balance these interests against your rights, and you can object (see Section 8).
  • Consent: newsletter subscriptions, and website analytics for all visitors. You can withdraw consent at any time.
  • Legal obligation: keeping accounting and tax records, and responding to lawful requests.

5. Data Sharing and Service Providers

We do not sell your personal data. Website data is used for advertising purposes only if you accept marketing cookies, and you can withdraw that choice at any time. We rely on the service providers below, which process data on our behalf under contract. See Section 11 for where they process data.

5.1 Providers Used by the App

  • Shopify (Canada/Ireland; processes data worldwide): the platform the app runs on. Handles authentication and billing, and stores the content we write back to your store.
  • OpenAI (United States): our AI provider. See Section 5.2.
  • Supabase (database hosted on Amazon Web Services in us-east-2, Ohio, United States): our main database, holding the data described in Section 1.
  • Amazon Web Services (us-east-2, Ohio, United States): file storage (image backups, llms.txt files, meta backup CSVs) and email delivery (SES) for all emails we send, including contact form messages.
  • Hetzner Online (Finland, EU): the servers that run the app, background jobs and job queue, and store our error reports. All image compression happens here.

5.2 AI Provider (OpenAI)

Our AI features use the OpenAI API (model gpt-4o-mini, and text-embedding-3-small for embeddings). Depending on the feature, we send:

  • item titles, descriptions, handles, vendor, focus keywords, your store domain, and your brand voice settings (content writing, FAQ, product type, translations, social posts);
  • product image URLs, which OpenAI fetches to write alt text;
  • titles and descriptions, to create embeddings and link anchor text;
  • catalogue titles, to suggest AI visibility questions;
  • your AI visibility questions;
  • aggregate weekly report statistics and your store domain, to write the weekly tip.

Retention at OpenAI: we ask OpenAI not to store our requests and responses. OpenAI may still retain API inputs and outputs for up to 30 days to monitor for abuse, and then deletes them. Under OpenAI's API terms, this data is not used to train its models.

Web search: AI visibility checks use OpenAI's web search tool so that answers reflect the live web. To do this, OpenAI sends search queries based on your questions to third-party search providers. These providers handle the queries under their own terms. AI visibility results come from the OpenAI API with web search. They approximate, but are not identical to, what a shopper would see in ChatGPT.

We do not send shopper data to OpenAI. Please avoid putting personal information into fields used for AI generation.

5.3 Providers Used by the Website

  • Netlify: hosts seokai.ai and runs the contact form. It receives your IP address and the details you submit.
  • Sanity: our content system and image delivery network. Every page loads content and images from cdn.sanity.io, which receives your IP address.
  • Google: Google Tag Manager and Google Analytics 4 for analytics, and Google reCAPTCHA for spam protection. See Section 10.
  • Our support mailbox provider and newsletter tool (see Section 1.8).

5.4 Recipients You Choose

  • Shopify Sidekick: if you ask Sidekick (Shopify's AI assistant) about your SEO, Sidekick uses Seokai's read-only tools. Seokai returns store and area scores, item titles and scores, audit findings, AI visibility results (including competitor domains, on paid plans), and your plan and credits. Shopify processes this under its own terms.
  • AI assistants you connect (MCP): a connected assistant can read your site audit results, an agent-readiness review of up to 50 products, and your plan and credit status. If you grant write permission, it can also generate and save meta content, alt text, and product types. The assistant's provider is an independent company that handles this data under its own terms. Only connect assistants you trust. You can set the daily credit budget to 0 for read-only access, or revoke access, in Settings.

5.5 Legal Disclosures

We may also disclose data if required by law, to protect our rights, or to protect the safety of our users.

6. Marketing Communications

If you subscribe to our newsletter or sign up to be notified about a feature, we may send product updates, SEO tips, and promotional content. You can opt out at any time with the unsubscribe link in any email. We never share your email for third-party marketing. Service emails from the app (Section 2) are not marketing. Weekly reports and bulk-update notices can be switched off in the app's Settings.

7. Data Retention

While the app is installed: we keep your data for as long as you use Seokai, so we can provide the service.

When you uninstall: we immediately delete your Shopify session and access token, so the app can no longer access your store, and we delete all AI assistant (MCP) tokens, which ends access for connected assistants. Your paid plan is scheduled to end at the close of the current billing period. Your other data stays in place for now.

About 48 hours after uninstall, Shopify sends us a store data deletion request (shop/redact). When we receive it, we delete:

  • stored copies of your products, collections, pages, and blog posts, and their revision history;
  • the image index, trial-compression results, image settings, and image backups held in cloud storage;
  • all llms.txt files and meta backup CSVs held in cloud storage;
  • any remaining AI assistant (MCP) connection records and tokens;
  • content embeddings, internal-link suggestions, and competing-content results;
  • support tickets and their message threads;
  • AI visibility settings (brand names, competitors, hidden domains) and your weekly AI visibility schedule;
  • social post drafts;
  • redirect records, sitemap URL lists, site audit runs, and fix history;
  • copies of theme files kept for undo;
  • bulk update, background job, and store event records;
  • your store's contact email, primary domain, and store URL. We also switch off automation, weekly reports, multi-language SEO, and scheduled llms.txt generation.

Kept after the deletion request. We keep the following for accounting, tax, legal, fraud-prevention, and service analytics purposes, and so that a reinstall can restore your plan and credit history:

  • subscription, purchase, credit lot, credit debt, and usage records;
  • weekly reports;
  • SEO audit and sitemap audit history;
  • AI visibility questions and check results, including the full AI answers and cited websites;
  • a minimal store record with your store's myshopify domain, plan, primary language, brand voice settings, assistant credit budget, and similar settings;
  • AI usage metrics (deleted after 90 days) and processing metrics (deleted after 30 days).

We keep billing, credit and usage records for as long as Bulgarian accounting and tax law requires. We keep the other records only as long as we need them to restore your history if you reinstall, to handle questions or disputes about your account, and to protect our legal rights, and we review them regularly. You can ask us to delete them sooner (see Section 8). We will do so unless we must keep them by law.

Other retention periods:

  • Image backups: kept until you restore the image or your store data is deleted, whichever comes first.
  • Newsletter: kept encrypted while you are subscribed. When you unsubscribe, we delete your email address record.
  • llms.txt files: older files are deleted from storage when a new file is generated; your recent files are kept until your store data is deleted.
  • Store event records: deleted 30 days after they have been processed.
  • Contact form messages: not stored in our database. They are kept in our support mailbox for as long as needed to handle your request and any follow-up, and we delete old messages regularly.
  • Rate-limit IP addresses: deleted by a daily clean-up, normally within about a day.
  • Error reports (including IP address and user agent): deleted automatically after 30 days. Summaries of resolved errors are deleted after 90 days.
  • Data held by OpenAI: up to 30 days (see Section 5.2).
  • Database backups: our database provider may keep backup copies for a limited time. Deleted data disappears from backups when they roll over.

8. Your Rights

EU/EEA (GDPR) and UK (UK GDPR). Depending on your location, you have the right to:

  • Access: request a copy of your data. You can also export data yourself (meta backup CSV, llms.txt files, and the Statistics activity log as CSV).
  • Correction: request correction of inaccurate data, or edit it directly in the app.
  • Deletion ("right to be forgotten"): request deletion of your data. Uninstalling triggers deletion of most store data but not all of it (see Section 7). To erase retained records, or to have data deleted without uninstalling, send us a request. We will comply except where we must keep records for legal or accounting reasons.
  • Portability: request your data in a structured, machine-readable format (CSV).
  • Objection: object to processing based on legitimate interests, including analytics.
  • Restriction: ask us to limit processing. You can also switch off automations, reports, schedules, and connected assistants yourself.
  • Withdraw consent: at any time, without affecting the lawfulness of earlier processing. For website cookies, use the "Cookie settings" link in the footer.
  • Complaint: lodge a complaint with your local supervisory authority. Our lead supervisory authority is the Bulgarian Commission for Personal Data Protection (CPDP). In the UK, it is the Information Commissioner's Office (ICO).

California (CCPA/CPRA). If you are a California resident, you have the right to:

  • know what personal information we collect and how we use it;
  • request access to that information and its deletion;
  • correct inaccurate information;
  • opt out of the "sale" or "sharing" of personal information.

We do not sell your personal information. Website data is shared with Google for advertising purposes only if you accept marketing cookies in our cookie banner, which is off by default. You can withdraw that choice, or switch off analytics, at any time through "Cookie settings", and you can contact us to opt out of any sharing. We will not discriminate against you for exercising any of these rights.

To exercise any right, contact us (see Section 14). We respond within 30 days under GDPR and UK GDPR, and within 45 days under CCPA/CPRA. These periods can be extended where the law permits.

9. Data Security

  • Encryption in transit (TLS) for all connections.
  • Encryption at rest for our database and cloud file storage, provided by our database and storage providers.
  • Additional field-level encryption (AES-256-GCM) for newsletter email addresses.
  • AI assistant tokens stored only as hashes, scoped to one store, short-lived, and revocable.
  • Verification of every incoming Shopify notification.
  • Signed unsubscribe links, so only the recipient can unsubscribe.
  • Rotation of server logs.
  • Rate limiting on public endpoints and AI usage.
  • Restricted access to production systems on a need-to-know basis.

No system is 100% secure. If you discover a security issue, please contact us immediately.

10. Cookies and Tracking

On our website (seokai.ai):

  • Google Tag Manager and Google Analytics 4: GA4 is the only tag in our Tag Manager container. It measures visits and how the site is used, and can set Google Analytics cookies (such as _ga). We have no advertising pixels or tags installed.
  • Google Consent Mode v2 ("advanced"): Tag Manager loads on every page for every visitor, before you make a choice. While analytics is not allowed, Google receives cookieless measurement pings. These include your IP address, browser details, and the page you visited, but no analytics cookies are set.
  • Default settings: for every visitor, wherever you are, analytics and advertising signals are off by default. GA4 cookies are set only if you accept in the cookie banner. You can change your choice at any time with the "Cookie settings" link in the footer.
  • Marketing category: the banner's "Marketing" option controls Google's advertising consent signals. We currently use no advertising tags, so no marketing cookies are set.
  • Google reCAPTCHA: protects our contact form and our newsletter and "Notify me" forms. It loads only once you start filling in one of these forms. reCAPTCHA sets Google cookies and processes signals such as your IP address and device and browser information to tell humans from bots. We rely on our legitimate interest in keeping the forms secure. See Google's Privacy Policy and Terms of Service.
  • Local storage: we do not set our own cookies. We use your browser's local storage to remember your cookie choice (until you change it or clear your browser data) and your light or dark theme. We also use session storage so that a page view is not counted twice after you accept analytics.
  • Content delivery: pages and images are delivered by Netlify and Sanity, which receive your IP address as part of serving the site (see Section 5.3).

In the Shopify app: Seokai does not set its own cookies and uses no analytics or advertising trackers. Authentication is handled by Shopify. The app uses your browser's local storage to remember your language and session storage for temporary screen state.

11. International Data Transfers

Seokai's main database (Supabase) and our file storage and email (Amazon Web Services) are hosted in the United States (us-east-2, Ohio). OpenAI processes data in the United States. Our application servers are provided by Hetzner Online in Finland (EU). Our support mailbox is hosted by Namecheap, which may process messages in the United States. Google, Netlify, Sanity, and Shopify may process website and platform data in the United States and other countries.

If you are in the EU/EEA, the UK, or Switzerland, this means your data is transferred outside your home region. For these transfers we rely on the EU Standard Contractual Clauses (SCCs) included in each provider's data processing terms, with the UK International Data Transfer Addendum and Swiss amendments where relevant. Where a provider is certified under the EU-U.S. Data Privacy Framework (DPF) and its UK and Swiss extensions, we also rely on that certification. Contact us for more information about these safeguards.

12. Children's Privacy

Seokai is a business tool intended for Shopify merchants. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. You must be at least 18 years old (or the age of majority in your jurisdiction) to use Seokai. Consistent with the US Children's Online Privacy Protection Act (COPPA), we do not knowingly collect information from children under 13. If we learn that we have, we will delete it. If you believe a child has provided us with personal data, please contact us.

13. Changes to This Policy

We may update this policy as Seokai changes. The "Last Updated" date at the top shows when it was last revised. We will tell you about material changes by email or in-app notice before they take effect.

14. Contact Us and Complaints

For questions, privacy concerns, or to exercise your data rights, contact us at support@seokai.ai or through our Contact page.

If you are in the EU/EEA or the UK, you also have the right to lodge a complaint with your local data protection supervisory authority if you are unhappy with how we have handled your data. Our lead authority is the Bulgarian Commission for Personal Data Protection. In the UK, it is the Information Commissioner's Office.