Privacy policy

Moddi Apps Ltd ("Moddi", "we", "us") makes Moddi, an app for Shopify merchants. This policy explains what information we handle when you visit moddi.app or use the Moddi app, why we handle it, who we share it with, and the choices you have. We have tried to keep it plain. If something here is unclear, email us at support@moddi.app.

Who is responsible for your data

Moddi Apps Ltd is a company registered in England and Wales (company number 17537806), with its registered office at 124 City Road, London, EC1V 2NX, United Kingdom.

For information about you and your use of Moddi (your account, usage, billing and support requests), we are the controller.
For your store's catalog data (products, files, collections, translations and so on) that we process to run Moddi for you, you are the controller and we are your processor. Our Data Processing Addendum covers this.

What we collect

From Shopify, when you install and use Moddi

Store details: your store's domain, name, store email, time zone, currency, languages and markets.
The staff member signed in: their name, email and Shopify user ID, and their permissions in your store. We use these to greet you, to record who made a change, and to respect what that person is allowed to do.
Your catalog: products, variants, collections, files, metafields, metaobjects, translations and similar data. We keep a working copy so the editor is fast and so we can show you drafts and history.
Plan and billing status: which plan you are on and your AI credit usage. Shopify handles payments, and we never see card details.
Access tokens: Shopify gives us tokens to act on your store. We store them to run edits and background jobs, and delete them when you uninstall.

What you do in Moddi

Edits, drafts, bulk edits, saved views, automations and their results, AI runs and credits used, settings, and the history of changes (the old and new value of each field). We keep these so we can show them back to you and let you undo changes.

What you send us

Messages in the in-app chat, emails to support, feature requests, and feedback. This includes anything you choose to share, such as screenshots.

Collected automatically

Our servers keep technical logs (IP address, browser and device type, pages and actions requested, errors and timing). We use them to keep Moddi secure and working.

When Moddi crashes or a background job fails, an error report goes to our error-tracking provider, Sentry. It contains the error and its location in our code, the page path, and your store's domain, so we can match a crash to a support request. We configure it not to send cookies, request contents, query strings, user details or anything you entered.

What we do not collect

Moddi does not sync your store's customers or orders, and we do not ask for them. If personal data about your customers ends up inside a field you edit, for example in a metafield, we treat it as part of your catalog data and handle it as your processor.

How we use it, and our legal bases

If you are in the UK or EEA, the law requires us to have a legal basis for each use of your information.

To provide Moddi (sync your catalog, run edits, drafts, automations and AI tasks, bill your plan): needed to perform our contract with you.
To give support and respond to your messages: contract, and our legitimate interest in helping our customers.
To keep Moddi secure and reliable, prevent misuse, and fix problems: legitimate interests.
To improve Moddi using aggregated, non-identifying usage patterns: legitimate interests.
To email you: service emails (alerts about failed scheduled edits, AI credit usage, reconnecting your store, billing changes) are part of providing Moddi. We may also send a welcome email and occasionally ask for a review. Marketing-style emails always include a way to stop them.
To meet legal obligations, such as tax and accounting records, and to respond to lawful requests.

We do not sell your personal information, and we do not share it for advertising.

AI features

When you run an AI task (for example writing an SEO title, translating a description or writing alt text), Moddi sends only what that task needs to our AI provider, currently Anthropic, and receives the result. Depending on the task this can include a product's title, brand, type, tags, the start of its description, selected metafields, an image, your store's language, and any writing guidance you have set. We do not send other parts of your catalog, and we do not send customer data.

Under Anthropic's commercial API terms, inputs and outputs are not used to train its models. Results come back as drafts for you to review, and you decide what is sent to Shopify. We keep a record of each AI run (what it was for, how many credits it used and the result) so we can show your usage and history. If we add another AI provider, we will list it below first.

Who we share it with

We share information only as follows:

Service providers (sub-processors) who help us run Moddi, listed below. We give them only what they need and they may use it only for us.
Shopify, because Moddi works with your store through Shopify's APIs.
Authorities and advisers, where the law requires it, to protect rights or safety, or to our professional advisers under confidentiality.
A buyer or successor, if Moddi is part of a merger, sale or reorganization. We would tell you first and the same protections would continue.
Anyone else, with your agreement.

Provider	What for	Data involved	Location
Fly.io	Hosts the Moddi app and its background jobs	Everything the app handles while running (store data in memory, request logs)	United Kingdom (London)
Supabase	Hosts the Moddi database (Postgres)	Your catalog copy, drafts, history, settings, AI usage records	United Kingdom (London)
Anthropic	AI writing, translation and alt text (Claude models)	Only the text or image a task needs, for example a product title and description to translate	United States
Sentry	Error tracking, so we can find and fix crashes	Technical error reports: the error, where in the code it happened, the page path (no query strings), and your store's domain. No cookies, request data, or what you typed	European Union (Germany)
Resend	Sends Moddi's emails (alerts, welcome and review requests)	Store email address and the notice being sent	United States
Featurebase	In-app support chat, help center, changelog and feature requests	Staff name and email, store domain, and what you write to us	United States
Google Workspace	Our support email inbox	Emails you send to support@moddi.app	United States / EU

Moving data between countries

Some of our providers are in the United States or elsewhere outside the UK and EEA. When personal data leaves the UK or EEA we rely on an approved safeguard, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or an adequacy decision such as the UK-US data bridge, as appropriate for each provider.

How long we keep it

While Moddi is installed: we keep your catalog copy, drafts, settings and history so Moddi works. History entries are shown for the number of days your plan includes.
When you uninstall: we delete your access tokens straight away and stop syncing. We keep your data for a short grace period so a reinstall picks up where you left off. Shopify then sends us a request to erase the store's data (about 48 hours after uninstall), and we delete the store's data and everything linked to it. If you reinstall first, the request is ignored.
Backups: deleted data can remain in encrypted database backups for a limited time before they are overwritten. We do not restore them except to recover from a failure.
Support messages and emails: kept while they are useful for helping you, usually up to 2 years after our last contact.
Server logs: usually up to 30 days.
Billing and accounting records: up to 7 years, as the law requires.

Security

We protect information with encryption in transit, access limited to the people who need it, separation between stores' data, and monitoring and updates. No system is perfectly secure. If we learn of a breach that affects your information, we will tell you and the authorities as the law requires.

Your rights

Depending on where you live, you can ask us to: tell you what we hold about you; correct it; delete it; give you a copy in a portable format; limit or object to how we use it; and withdraw consent you gave. To make a request, email support@moddi.app. We may need to confirm who you are first, and we aim to reply within one month.

UK and EEA: you have the rights above under data protection law. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
California and other US states: you can ask to know, access, correct and delete your personal information, and we will not discriminate against you for doing so. We do not sell or share personal information, as those terms are defined in US state laws.
If you are a merchant's customer: Moddi acts for the merchant, not for you, and does not sync customer data. Please send requests about your data to the store you bought from. We will help them respond.

Cookies and our website

This website does not use advertising or analytics cookies. The Moddi app, which runs inside your Shopify admin, uses only the cookies and browser storage that are strictly necessary to keep you signed in and remember settings such as table views. Our support chat, help center and feature board are provided by Featurebase and may set their own cookies under its policy. If we add analytics later, we will update this policy first.

Children

Moddi is a business tool and is not for people under 18. We do not knowingly collect information from children.

Changes to this policy

We will post any changes here with a new date at the top. For significant changes we will also tell you by email or in the app before they take effect.

Contact

Moddi Apps Ltd, 124 City Road, London, EC1V 2NX, United Kingdom. Email: support@moddi.app.