Privacy Policy

Effective date: 2026-10-16

This Privacy Policy explains how YAStuning OÜ ("we", "us") processes personal data as a controller when you use shoptoai.com and the ShopToAI service (the "Service"), as required by Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

1. Controller

YAStuning OÜ (private limited company / OÜ), Pae tn 25-47, 11414 Tallinn, Estonia, registration number 14016370. Email: [email protected].

2. What data we process, why, and on what legal basis

2.1 Account data

• Data: email address, name (optional), password, preferred language and email-verification status. If you sign in with Google, Google also gives us your account identifier, email address, whether that address is verified, and your name. We use this data only to sign you in and get no access to any other data in your Google account.
• Purpose: to create your account, authenticate you and provide the Service.
• Legal basis: performance of a contract - Art. 6(1)(b) GDPR.

2.2 Workspace and billing data

• Data: workspace name, account type, billing name and address, VAT number.
• Purpose: to provide the Service, manage subscriptions and issue invoices.
• Legal basis: performance of a contract - Art. 6(1)(b); compliance with accounting and tax obligations - Art. 6(1)(c).

2.3 Payment data

• Data: subscription plan and status, payment provider identifiers.
• Purpose: to take payment and manage your subscription.
• Legal basis: performance of a contract - Art. 6(1)(b).

2.4 Store connection data

• Data: the access credentials of the store you connect.
• Purpose: to access your store's catalog as you instruct.
• Legal basis: performance of a contract - Art. 6(1)(b).

2.5 Security and technical logs

• Data: IP address, browser and request data, and error reports.
• Purpose: to secure and operate the Service, prevent abuse and fix faults.
• Legal basis: our legitimate interest in securing and operating the Service - Art. 6(1)(f).

2.6 Service communications

• Data: your email address and the messages and in-app notifications we send you.
• Purpose: to inform you about your account and the Service.
• Legal basis: performance of a contract - Art. 6(1)(b). Promotional email is sent only with your consent - Art. 6(1)(a).

2.7 Cookies and analytics

• Data: cookie identifiers and data about your use of the website.
• Purpose: to provide the Service and remember your settings; with your consent, to measure use of the website and the channels that bring visitors (see 2.9).
• Legal basis: for analytics, your consent - Art. 6(1)(a) - which you can withdraw at any time via "Cookie settings" at the bottom of our pages or in the dashboard menu; for the other cookies, performance of a contract - Art. 6(1)(b) - or our legitimate interest in providing the website - Art. 6(1)(f). Details are in the Cookie Policy.

Website analytics (PostHog). On our public pages (home page, blog, guides, pricing) we count visits without cookies or any other storage on your device: which pages are opened, how far they are scrolled, which links and buttons are clicked and where visitors came from. PostHog groups these visits only by a pseudonymous hash that changes every day, so they are not linked to you. The legal basis is our legitimate interest in knowing which content is useful - Art. 6(1)(f). You can object at any time at [email protected]. If you accept analytics cookies, we also recognise repeat visits and record click heatmaps and screen recordings of your visit, with anything you type hidden.

Product analytics in the dashboard (PostHog). When you use your account, we record key steps such as signing up, connecting a store, running an audit, applying a fix and starting a subscription. These records use a pseudonymous ID, not your name or email address. We use them to see where customers get stuck and to improve the Service, based on our legitimate interest - Art. 6(1)(f). You can object at any time at [email protected]. Only with your analytics consent, we also record how you use the dashboard pages, including screen recordings of your sessions. Text you type into forms is hidden in those recordings, and API keys, plugin secrets and the account settings page (your email, company, team and connected Google account) are not recorded at all.

2.8 Workspace invitations

• Data: the email address of the invited person.
• Source: the person who sent the invitation.
• Purpose: to send the invitation and set up access.
• Legal basis: our legitimate interest, and that of the inviting organisation, in enabling team collaboration - Art. 6(1)(f).

2.9 Channel attribution

• Data: where you came from (a campaign link or another website), the page you landed on, language and time; for the free scan, the store you checked and the result. When you register, we link this source to your account.
• Purpose: to measure which marketing channels bring visitors, scans and sign-ups.
• Legal basis: our legitimate interest in measuring our own marketing - Art. 6(1)(f). The shoptoai_attr cookie is set only with your consent (see 2.7).

2.10 Support requests

• Data: your messages to us and our replies.
• Purpose: to answer your request.
• Legal basis: performance of a contract - Art. 6(1)(b) - or our legitimate interest in answering enquiries - Art. 6(1)(f).

2.11 Google accounts you connect

• Data: if you connect a Google account so we can read Google Merchant Center and Google Search Console, we keep the email address of that account, an encrypted access token, the identifiers of your Merchant Center accounts and Search Console properties, and what Google reports about your store: product statuses and the reasons Google gives, the indexing status of your product pages and your sitemap list. Google gives us no data about your customers.
• Purpose: so your audit can show which products Google rejected and whether your product pages are indexed. We send Google only authorization requests and the addresses of the product pages we check. We never change anything in your Google accounts.
• Legal basis: performance of a contract - Art. 6(1)(b).
• How to stop: press Disconnect in Settings, or remove our access at myaccount.google.com/permissions. When you disconnect, we delete the token and everything we read from Google.
• We do not pass data received from Google to AI language models.
• ShopToAI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2.12 Store statistics

• Data: if you install our connector and share order totals, the daily number, value and refunded value of paid orders in your store that came from AI assistants, per assistant and currency, and the day's total number of paid orders. They contain no data about your customers. If you run your store as a sole trader, these totals may relate to you.
• Purpose: to show you the results of the Service.
• Legal basis: performance of a contract - Art. 6(1)(b). You can turn this off in the connector settings.

2.13 Do you have to provide data?

Account, billing and store connection data are necessary to conclude and perform the contract; without them we cannot provide the Service. Processing based on consent is optional.

3. Catalog data

When you connect a store, we process its catalog data on your behalf as a processor under our Data Processing Agreement. That processing is not covered by this policy.

4. Recipients

We disclose personal data to service providers that process it for us: hosting, content delivery and network security, payments, email, AI processing, website and product analytics and, with your consent, analytics cookies. They are listed in Sub-processors. We may also disclose data to public authorities, courts and professional advisers where the law requires it or to establish, exercise or defend legal claims.

5. International transfers

Some recipients process data outside the European Economic Area. These transfers rely on the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework (Chapter V GDPR). You can request a copy of the safeguards at [email protected].

6. How long we keep data

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal. To exercise a right, write to [email protected].

Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21 GDPR).

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State where you live or work. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

8. Automated decision-making

We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR.

9. Changes

We may update this policy. The current version is published on this page.