Privacy Policy

1. Who we are

Sauron ("we", "us", "our") is a Shopify application operated by Sauron Labs. Our registered contact email is privacy@sauron.so.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you install and use the Sauron Shopify app (the "Service").

2. Information we collect

2.1 Information from Shopify

When you install Sauron from the Shopify App Store, Shopify provides us with access to your store data under the OAuth scopes you approve. This includes:

• Store URL, shop name, owner name, and owner email address
• Product titles, descriptions, images, tags, types, and variants
• Collection titles and descriptions
• Blog article titles, content, and metadata
• Published SEO meta titles and meta descriptions
• Product, collection and article metafields (where Sauron stores the JSON-LD schema its app embed renders)
• Billing subscription status

We access only the data necessary to provide the Service. We do not access your customers' personal data (orders, customer profiles, addresses, payment details).

2.2 Information you provide directly

• Brand voice settings (tone, industry, audience description, USPs, words to avoid)
• LocalBusiness details (if you configure local schema)
• Alert thresholds and notification preferences
• Onboarding survey responses

2.3 Google integrations

If you connect Google Search Console or Google Analytics 4, we store:

• OAuth access tokens and refresh tokens for your Google account
• Search Console data: queries, impressions, clicks, average positions, URL coverage
• GA4 data: sessions, organic conversions, and revenue by landing page (for stores that connect GA4)

We use this data exclusively to display rank tracking, performance dashboards, and alerts within the Service. We do not share this data with third parties except as described in Section 4.

2.4 Usage data

• AI token usage per shop (counts of API calls and estimated cost) for billing enforcement and plan limits
• SEO job status and logs (AI generation runs, scan results, error logs)
• Backlink exchange activity if you opt in to the backlink network
• Feature usage events: which features you used and when, tied to your store domain and plan — so we know what to improve, and so we can show you what the app has done for your store if you ever query a charge
• Diagnostic data: error messages and stack traces when something goes wrong. Access tokens, API keys and passwords are stripped before any error report leaves our servers

2.5 The free store audit

The free audit at /tools/shopify-seo-audit needs no signup and no install. It reads only publicly available pages of the URL you submit — the same pages any search engine crawler fetches — and never touches a Shopify admin or any private data. For each completed scan we store:

• The store domain you submitted, the platform we detected, the score, and the findings we showed you
• Public catalog counts (number of products and collections, and which product types have no collection)
• The referring page and any UTM parameters on the link you arrived through

We keep this so we can reproduce the report you were shown, publish aggregate statistics about Shopify store SEO (never naming individual stores), and improve the audit. We do not store the IP address the scan came from — rate limiting uses a short-lived counter that is not retained.

If you give us your email address on the results page, we use it for one purpose only: to tell you once when the app is available for your platform. It is not added to a marketing list or a drip sequence, and you can ask us to delete it at any time (Section 7).

2.6 The waitlist

The waitlist form (on the homepage and at /shopify) asks for your email address and, optionally, your store's address, what you sell, what you would want the app to do for your store, who looks after your SEO today, and whether you would like to be a beta tester. We store those answers together with the referring page and any campaign parameters (such as utm_ values or an ad click identifier) on the link you arrived through.

We use them to email you once when we can onboard your store, to reply with a follow-up question about what you told us if we have one, and to understand, in aggregate, who is asking for the app and why. If you tick the beta tester box we may also email you to set up early access and to ask for feedback while you use it. Your answers are not added to a marketing list or a drip sequence, and you can ask us to delete them at any time (Section 7).

Ad measurement. If you reached the waitlist from an advert we run on Meta (Facebook or Instagram), we send Meta a one-way hash of your email address together with the ad click identifier so Meta can count the signup against the advert. The hash cannot be reversed to reveal your address; Meta can only match it to an account it already holds. We do not place a Meta pixel or any advertising cookie on this site.

2.7 Information we do NOT collect

• Your customers' names, email addresses, or personal data
• Order details or transaction data
• Payment card information (Shopify handles all billing)
• Cookies on your storefront (we do not inject tracking cookies)

3. How we use your information

We use the information we collect to:

• Provide the Service: generate AI SEO titles, meta descriptions, image alt text, schema markup, and blog content for your store
• Keyword research: send product and collection names to DataForSEO to retrieve search volume data
• Rank tracking: sync keyword positions from your connected Google Search Console account
• Performance analytics: display GA4 organic traffic and revenue data in the dashboard
• Backlink exchange: if you opt in, match your published blog articles with complementary articles from other opted-in stores
• Email alerts: send weekly digests and rank-drop alerts to your store owner email via Resend
• Billing enforcement: track AI generation counts to enforce plan limits
• Service improvement: aggregate, anonymised usage patterns to improve AI prompt quality and feature development

Legal basis (GDPR)

For merchants in the UK and European Economic Area, our legal bases for processing are:

• Contract performance: processing necessary to deliver the Service you have subscribed to
• Legitimate interests: improving the Service, preventing fraud, and maintaining security
• Consent: for optional features such as the backlink exchange network and weekly digest emails

4. Third parties we share data with

We share the minimum necessary data with the following sub-processors to provide the Service:

We do not sell your data to any third party. We do not share your data with advertisers or data brokers.

5. Data retention

• Active subscription: data is retained for the duration of your subscription plus 30 days after uninstalling
• Uninstall: on uninstall, your Shopify access token is invalidated immediately. All store data is deleted within 30 days unless you reinstall
• Explicit deletion request: email privacy@sauron.so to request immediate deletion of all data associated with your store
• Google OAuth tokens: deleted immediately upon disconnecting GSC or GA4, or upon uninstalling the app
• Backlink network data: if you opt out of the backlink network, your articles are removed from the matching pool within 48 hours
• Anonymised analytics: aggregate, anonymised usage statistics may be retained indefinitely for service improvement

6. Data security

We implement the following security measures:

• All data is encrypted in transit using TLS 1.2 or higher
• Database data is encrypted at rest on Railway infrastructure
• OAuth tokens are stored encrypted using AES-256
• Access to production data is restricted to authorised personnel only
• Shopify HMAC verification on all webhook payloads

Despite these measures, no system is completely secure. We cannot guarantee absolute security of your data transmitted to or from the Service.

7. Your rights

All merchants

• Access: request a copy of the data we hold about your store
• Deletion: request deletion of all store data by emailing privacy@sauron.so or uninstalling the app
• Correction: request correction of inaccurate data we hold
• Opt-out of optional features: disconnect GSC/GA4 at any time, opt out of the backlink network, or disable weekly digest emails in settings

UK and EEA merchants (GDPR / UK GDPR)

• Portability: request your data in a machine-readable format
• Restriction: request that we restrict processing of your data in certain circumstances
• Objection: object to processing based on legitimate interests
• Lodge a complaint: you have the right to lodge a complaint with your national data protection authority (UK: ICO at ico.org.uk)

California merchants (CCPA)

California residents have the right to know what personal information we collect, request deletion, and opt out of sale. We do not sell personal information. To exercise your rights, email privacy@sauron.so.

8. Children's privacy

The Service is intended for use by business owners and is not directed at individuals under 18. We do not knowingly collect data from anyone under 18.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify active merchants of material changes by email to the store owner address on file. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after a policy update constitutes acceptance of the revised policy.

10. Contact us

For privacy-related questions, data requests, or to exercise your rights:

• Email: privacy@sauron.so
• Response time: within 5 business days for general enquiries; within 30 days for formal GDPR requests