Your data, your control

Privacy Policy

Last updated: March 23, 2026

1. Introduction

SwiftList ("we", "our", "us") is an AI-powered product listing platform that helps sellers generate studio-quality product images, SEO-optimized copy, and publish listings to online marketplaces. This Privacy Policy explains how we collect, use, store, and protect your information.

2. Information We Collect

We collect the following categories of data:

Account information — Name, email address, and authentication data provided through our identity provider (Clerk).
Product images — Images you upload for AI processing, stored securely in Amazon S3.
Product data — Titles, descriptions, tags, pricing, and other listing details you create or that our AI generates.
Marketplace tokens — OAuth access tokens for connected marketplaces (e.g., Shopify), encrypted at rest using AES-256-GCM.
Store domain — Your Shopify store URL, used solely for API communication.

3. What We Do Not Collect

We do not access, collect, or store any customer data from your Shopify store. We only interact with your product catalog via the Shopify Admin API. We do not access orders, customer information, payment details, or any other personally identifiable information belonging to your customers.

4. How We Use Your Data

  • To analyze product images and generate AI-powered assets (photos, copy, templates).
  • To publish and manage product listings on your connected marketplaces.
  • To maintain your account and marketplace connections.
  • To improve our AI models and service quality (using aggregated, anonymized data only).

5. Data Storage & Security

Database

PostgreSQL hosted on Supabase with row-level security

File Storage

Amazon S3 with server-side encryption

Token Encryption

AES-256-GCM encryption for all OAuth tokens at rest

Transit Security

HTTPS/TLS for all communication

Data Location

Data is stored and processed in AWS ap-south-1 (Mumbai, India) and US regions. AI processing uses Google servers.

6. Cookies & Tracking

We use a minimal set of cookies required for the Service to function:

Session cookie — Set by our authentication provider (Clerk) to keep you signed in. Essential for the Service to work. Expires when your session ends.
CSRF protection cookie — A temporary, httpOnly cookie used during the Shopify OAuth flow to prevent cross-site request forgery. Expires after 10 minutes.

We do not use any analytics cookies, advertising trackers, or third-party tracking pixels. We do not track you across other websites.

7. Data Sharing

We do not sell your data to third parties. Your product images and data are sent to AI providers (Google Gemini) solely for processing your requests. Marketplace data is sent only to the platforms you explicitly connect and publish to.

8. Data Retention & Deletion

  • Product data and generated assets are retained for as long as your account is active. You can delete individual products at any time from the dashboard.
  • Marketplace OAuth tokens are retained only while your marketplace connection is active. Disconnecting a marketplace removes the stored token immediately.
  • If you uninstall SwiftList from Shopify, we automatically delete your marketplace connection and clear all Shopify-specific data within 48 hours via our GDPR-compliant webhook handler.
  • Upon account closure or deletion request, all associated data (products, images, tokens, brand profiles) is permanently deleted within 30 days.
  • AI-generated images stored in Amazon S3 are deleted when the associated product is deleted or the account is closed.

9. Your Rights

You have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your data.
  • Withdraw consent for data processing at any time.

10. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes via email or an in-app notification at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

11. Contact Us

For any privacy-related questions or data requests, contact us at contact@spectatr.ai