Privacy Policy — LabelAI

Last updated: 2026-07-15

This Privacy Policy describes what data the LabelAI Shopify app (“LabelAI”, “the app”, “we”) collects, why, and how it is handled when a merchant installs LabelAI on their Shopify store.

1. Who we are

LabelAI is operated by BEK Service GmbH. Contact for privacy questions: info@bekservice.de.

2. What data we collect

LabelAI is designed to collect the minimum data needed to operate the disclosure workflow. We do not collect or process your customers’ personal data (no names, emails, addresses, order details, or payment information ever pass through LabelAI).

Specifically, we store:

Shop domain (*.myshopify.com)	Identify your store’s installation and settings
Image URLs, filenames, and alt text from your shop’s product/file images	Run detection heuristics and display the image gallery
Labeling status per image and detection metadata (confidence score, reason)	Power the gallery, quota counter, and storefront badge
Shopify session/access tokens (via Shopify’s managed installation)	Authenticate API requests to your store on your behalf
Plan/subscription state (free or Pro)	Enforce the free-plan quota and unlock Pro features

We do not store the actual image files — only references (URLs) to images already hosted on Shopify’s CDN, along with the filename/alt-text strings needed for matching and detection.

3. How we use data

To run the auto-scan detection heuristics against your shop’s images.
To display the gallery, quota, and labeling controls in the admin UI.
To publish the list of labeled image filenames to a shop metafield ($app:labelai / ai_images) so the storefront theme extension can render the “AI-generated” badge.
To check and enforce your subscription plan (free vs. Pro).
To respond to support requests you send us directly.

We do not sell shop or usage data, and we do not use it for advertising.

4. Data sharing

We do not share your data with third parties except:

Shopify, as the platform the app runs on and to process billing.
Our hosting and database providers (Vercel, and a PostgreSQL provider such as Neon), acting solely as data processors to run the app’s infrastructure.

We do not sell, rent, or otherwise disclose your data to advertisers, data brokers, or unrelated third parties.

5. GDPR / Shopify mandatory compliance webhooks

LabelAI implements the Shopify-mandated compliance webhooks for all installs, regardless of merchant location:

customers/data_request — since LabelAI never stores customer personal data, we have nothing to provide beyond confirming this.
customers/redact — same as above: no customer personal data is stored, so this webhook is acknowledged with no further action needed.
shop/redact — sent by Shopify roughly 48 hours after a shop uninstalls the app. On receipt, we permanently delete all data associated with that shop: session tokens, labeled/suggested image records, scan state, and plan cache.

All three webhooks are HMAC-verified (rejecting invalid signatures with 401 Unauthorized) and acknowledged within Shopify’s required response time.

6. Data deletion on uninstall

Your Shopify access tokens are invalidated immediately (app/uninstalled webhook).
All shop-specific data we hold is deleted upon receipt of the shop/redact webhook, sent by Shopify approximately 48 hours after uninstall.
The shop metafield written to your store ($app:labelai / ai_images) remains on your store as your own data unless you remove it; it contains no data about your customers.

You may also request earlier deletion by emailing info@bekservice.de.

7. Hosting and data location

LabelAI’s application infrastructure runs on Vercel, with a managed PostgreSQL database hosted in the EU (Frankfurt, eu-central-1), consistent with GDPR data-residency preferences.

8. Your rights

Depending on your jurisdiction, you may have rights to access, correct, or delete data we hold about your shop, and to object to certain processing. Contact info@bekservice.de to exercise these rights.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above. Continued use of LabelAI after changes constitutes acceptance of the revised policy.

10. Contact

Questions about this policy or your data: info@bekservice.de.

Kurzfassung (Deutsch)

LabelAI speichert ausschließlich shopbezogene Daten, die für den Kennzeichnungs-Workflow nötig sind: Ihre Shop-Domain, Bild-URLs, Dateinamen und Alt-Texte, den Kennzeichnungsstatus je Bild, Session-/Zugriffstoken sowie Ihren Tarifstatus (Free/Pro). Es werden keine personenbezogenen Kundendaten (Namen, E-Mails, Bestelldaten, Zahlungsdaten) verarbeitet. Die von Shopify vorgeschriebenen DSGVO-Webhooks (customers/data_request, customers/redact, shop/redact) werden unterstützt; nach Deinstallation werden alle shopbezogenen Daten nach Erhalt des shop/redact-Webhooks (ca. 48 Stunden nach Deinstallation) gelöscht. Hosting erfolgt über Vercel mit einer verwalteten PostgreSQL-Datenbank in der EU. Fragen zum Datenschutz richten Sie bitte an info@bekservice.de.