Privacy Policy

1. Who is responsible

For information about our own users, such as the people who hold accounts with us, Datathreads is the controller.

For data we process from a merchant’s connected store, the merchant is the controller and Datathreads is a processor acting on the merchant’s instructions. If you are a shopper who bought from one of our customers, your relationship is with that merchant, and you should contact them first.

2. What we collect

Access tokens are stored encrypted. We do not store full payment card numbers; card processing is handled by our payment provider.

3. Store data we access

When you connect a store we request only the permission scopes the Service needs. Today that means reading product information and writing to the structured product fields we publish to. We do not request permission to read or write your storefront theme, your customer records, or your marketing tools unless a feature you have enabled requires it and you have granted it.

Where a feature requires order or returns information in order to report on product performance, that data is used for that reporting only. We do not use it to contact shoppers, and we do not build profiles of individual shoppers for any purpose outside your own account.

You can revoke our access at any time from your platform’s admin.

4. What we do not do

• We do not sell personal information, and we do not share it for cross-context behavioural advertising.
• We do not send marketing messages to your customers. We never contact a shopper on your behalf or on our own.
• We do not use your catalog, orders or corrections to train general-purpose models for use outside your account.
• We do not run advertising trackers, retargeting pixels or ad-network cookies. We do use Google Analytics to count visits to this website, described in section 13.

5. How we use information

We use what we collect to provide and secure the Service, to establish product facts and present them for your approval, to publish approved facts to your store, to support and bill you, to detect abuse and fraud, to meet legal obligations, and to improve the Service.

Where the GDPR or UK GDPR applies, our legal bases are: contract, for providing the Service you asked for; legitimate interests, for security, abuse prevention and product improvement, balanced against your rights; legal obligation, for tax and accounting records; and consent, where we ask for it, which you may withdraw at any time.

6. Sub-processors

We use a small number of third parties to run the Service. Each is bound by contract to protect the data, to use it only for the service they provide us, and not to train their own models on it where that is applicable.

A current list of named sub-processors is available on request from contact@datathreads.ai. We will give notice before adding a sub-processor that materially changes how merchant data is handled.

7. Automated processing and model training

The Service uses large language models to read catalog content and propose structured facts. Those proposals are reviewed by a person on your team before anything is published. No decision producing a legal or similarly significant effect on an individual is made solely by automated means.

We do not use your Customer Data to train general-purpose models. We may use aggregated and de-identified information, which cannot reasonably be linked to you, your products or any individual, to measure and improve accuracy.

8. Sharing

We disclose information only: to the sub-processors described above; to your own connected platform, as required to read and write the data you have authorised; where you instruct us to; where required by law, subpoena or court order, after notifying you unless prohibited; to protect rights, safety or property; and to a successor in a merger, acquisition or asset sale, subject to this policy.

9. Retention and deletion

We keep Customer Data for as long as your account is active. After termination you may request an export for thirty (30) days, after which we delete Customer Data in the ordinary course, subject to backup rotation and to records we must keep for tax, accounting or legal reasons.

You can ask us to delete your data sooner by writing to contact@datathreads.ai. Deletion does not remove facts already published to your own store, which remain under your control.

10. Security

We use encryption in transit and at rest, encrypt stored platform access tokens, isolate each tenant’s data, restrict internal access to those who need it, and log administrative actions. Publishing to your store requires human approval, which limits the damage any single compromised component could do.

No method of transmission or storage is completely secure. If a breach affects your personal data we will notify you and any regulator as required by law and without undue delay.

11. International transfers

We operate from the United States, and our sub-processors may process data in other countries. Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, the UK Addendum where applicable, and supplementary measures where needed.

12. Your rights

Depending on where you live you may have the right to access, correct, delete, port or restrict the personal information we hold about you, to object to certain processing, and to withdraw consent. Exercising these rights will never result in discriminatory treatment.

Under the CCPA and CPRA, California residents may request disclosure of the categories and specific pieces of personal information collected, request deletion or correction, and opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of.

To exercise any right, write to contact@datathreads.ai. We will verify your request and respond within the period the law requires. If you are a shopper whose data sits in a merchant’s store, we will refer you to that merchant, who is the controller. You may also complain to your local supervisory authority.

13. Cookies and this website

This website uses Google Analytics to understand how many people visit and which pages they read. It sets first-party cookies, typically named _ga and _ga_<id>, which distinguish one browser from another so a returning visit is not counted twice. Google Analytics 4 truncates IP addresses before storing them, and we have not enabled advertising features, remarketing or Google Signals.

We use no other third-party scripts. The site loads no fonts and no stylesheets from anyone else, and carries no advertising or retargeting pixels.

One exception, on the report page only. A discovery report shows the products Shopify’s global catalog returned for your searches, including their pictures. Those pictures are served by Shopify from cdn.shopify.com, so your browser fetches them from Shopify directly and Shopify can see your IP address and that you were on the report page. They are part of the report you asked for rather than tracking: no cookie is involved, nothing is set, and the pictures are the merchants’ own as the catalog serves them. We request a small rendition so the page stays light. Our content rules permit pictures from that one host and nowhere else, so no other site can load anything into the page even by accident. Blocking cdn.shopify.com leaves the report fully readable: the cards keep their titles, prices and ratings.

A second item is stored in your browser, and it is not a cookie: a single local preference recording whether you chose the light or dark theme. It never leaves your device, and clearing your browser storage removes it.

If you ask for a discovery report, this site sets one more cookie, __session. It is strictly necessary: it holds the key to your report, so the key never appears in the page address and nobody can reach your report from a link. It is set by this site itself, it cannot be read by page scripts, it is never sent to another site, and it lasts 30 days. See section 16.

If you are visiting from the European Economic Area, the United Kingdom or Switzerland, no analytics are loaded and no analytics cookie is set until you choose. A banner asks first, Accept and Decline carry equal weight, and declining is remembered. We determine which visitors to ask from your browser’s own timezone setting rather than by looking up your IP address, because an IP lookup would mean sending your address to a third party in order to decide whether we may send anything to a third party.

You can also opt out of Google Analytics entirely with Google’s opt-out browser add-on, or by blocking the domain googletagmanager.com in your browser or an extension. Nothing on this site depends on analytics, so blocking it changes nothing about how the page works.

The signed-in product may use strictly necessary cookies to keep you logged in. Those are required for the Service to function.

14. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 13. If we learn we have, we will delete it promptly. Account holders must be at least 18.

15. Changes

We may update this policy. The date at the top always reflects the current version. If a change materially affects how we handle personal information, we will give notice by email or in the product before it takes effect.

16. Free discovery reports

Anyone can ask for a free discovery report on a Shopify store with the form on our home page. It shows what a shopping agent finds when it searches for that store’s products. For these requests Datathreads is the controller.

What we collect when you ask for a report:

• the store address you enter;
• the search term you enter, if you enter one;
• a keyed hash of your IP address, used only to stop abuse. We do not store the address itself.

No email address is needed to get a report. You see the result first. If you then choose to save it, we also collect:

• your email address;
• whether you ticked the follow-up box. It is never ticked for you.

What we read is public in both places. We ask Shopify’s own global catalog what it returns for a search, and we read the store’s public agent profile at /.well-known/ucp to learn which Shopify store a custom domain belongs to. We do not sign in to the store, we do not place an order or touch a basket, and we read nothing that is not public.

How we use it. We show you the report and keep it so you can return to it. If you save it, we may email you a link to it, which is the service you asked for. We contact you about Datathreads beyond that only if you ticked the follow-up box. Our team sees each request with its report, so we can answer you if you write to us.

Who processes it: Shopify, which answers the catalog search and receives the search term but not your email address, and Google, which hosts this site and its database. If we email you, our email provider delivers it (the “Email” row in section 6). No model provider is involved in a discovery report: there is no AI step in it, and we never invent a search term.

How long we keep it:

• the hash of your IP address: deleted as soon as the rate-limit window it belongs to closes, which is ten minutes, and in no case longer than 30 days;
• the key to your report, held in your browser: 30 days;
• the report itself: 90 days, and only 30 if you never saved it;
• your email address, if you saved the report: six (6) months from your last visit to it, or until you ask us to delete it.

These are enforced by a job that runs every day and deletes what has passed its date. The two clocks are independent: your report is deleted at 90 days whether or not you saved it, and your email address is deleted on its own schedule after that.

Store owners can ask us to stop reading their store by writing to contact@datathreads.ai. We keep that request, because it is how we honour it.

The rights in section 12 apply to these requests too.

17. Contact

Datathreads, Inc.
Privacy enquiries: contact@datathreads.ai

Merchants who need a Data Processing Addendum for their own compliance can request one at the same address.