SEO Rating
Install on Shopify

Draft — requires legal review

This document is built from the app's actual code and access scopes (see the facts cited throughout), but it still needs the legal entity name, registered address, governing law, and a qualified privacy-counsel review before publishing. Bracketed items are placeholders — nothing else on this page is invented.

Legal

Privacy Policy

Last updated: [date placeholder — set when this is finalized and published]

1. Who we are

SEO Rating (seorating.net), distributed on the Shopify App Store as “TNS SEO & AI Visibility”, is built and operated by TheNextSprout. This policy explains what data the app collects from a merchant’s store, why, who it is shared with, and how it can be deleted. Legal entity and registered address: [placeholder — legal entity name, country of incorporation/operation, and registered address pending].

2. What we collect

Shopify store data

Store details (domain, shop name, plan) and the catalogue and content data the app needs to do its job, under the access scopes granted at install:

  • read_products / write_products — product titles, descriptions and images, to generate and save meta tags, image alt text, and handle/URL updates.
  • read_content / write_content — pages, blog posts and articles, for the same meta-tag tooling.
  • read_files / write_files — standalone uploaded files, for image alt text.
  • read_themes — read-only scan of your active theme to find image references missing alt text.
  • write_themes — reserved for an in-progress robots.txt publishing path; currently falls back to a manual setup step.
  • write_online_store_navigation — creates URL redirects when a page handle changes, and supports IndexNow URL-ownership verification.
  • read_publications — checks whether a collection is published, for the sitemap and broken-link tools.

Google account data (only if you connect it)

If you connect Google Search Console, we request these OAuth scopes: your email address (openid, userinfo.email) to identify the connected account; webmasters to read your Search Console property data (queries, impressions, clicks, indexing status); and siteverification.verify_only to confirm you own the property you’re connecting. Connecting Google is optional and can be disconnected at any time from inside the app, which permanently deletes the stored connection.

Usage and account data

Which features you use, AI credit consumption and history, audit and optimization records, review/publish actions, plan and billing status from Shopify, support correspondence, and technical logs (timestamps, IP address, user agent, errors) used for security and debugging.

Customer personal data

The app’s features work on store content, not on your shoppers’ personal data — it does not read or write customer or order records, and no customer PII is stored by the app. See section 6 for exactly how the mandatory GDPR webhooks are handled given this.

3. Why we collect it

  • To run the features you asked for: audits, tag and alt-text generation, structured data, discovery files, keyword research, performance reports.
  • To generate AI drafts you review before publishing.
  • To meter and display AI credit usage accurately, and to apply plan limits.
  • To provide support and diagnose problems you report.
  • To keep the service secure, prevent abuse, and comply with legal and platform obligations.

We do not sell your data, and we do not use it to advertise to your shoppers. Lawful bases (contract performance, legitimate interests, consent for optional integrations): [to be confirmed with counsel].

4. Who we share it with

ShopifyThe platform the app runs on and bills through. Store and content data is read from and written back to Shopify; subscription charges go through Shopify's Billing API.
AnthropicAI generation (meta tags, alt text, content drafts, article ideas). We send the specific product/page fields needed for that request — title, vendor, type, tags, price range, stripped description. No customer data is sent.
GoogleSearch Console data retrieval and site-verification, only if you connect the integration; PageSpeed Insights audits of your public store URLs when you run a performance check. PageSpeed requests send only the public URL being tested.
DataForSEOKeyword research. Keyword terms plus location/language parameters are sent to retrieve volume and related-term data, funded by our own account, not billed to you directly.
ResendTransactional email. Used to deliver support/contact-form messages you send us.
Bing IndexNowIf enabled, submits your store's public URLs (plus a verification key) so participating search engines can re-crawl faster. Google does not currently participate in IndexNow.
SentryError monitoring, only if configured. Receives error details and minimal context (such as which shop triggered an error) to help us fix bugs — not raw customer data.
VercelHosting and scheduled job infrastructure for the app itself.

Our database (Postgres, via Prisma) is hosted by our infrastructure provider and is not a separate data recipient — it stores the data described in section 2. Data may be processed outside your country; transfer safeguards: [placeholder — confirm with counsel].

5. Credentials and security

Google OAuth access and refresh tokens are encrypted at rest using AES-256-GCM before being stored, and are never displayed back to you in full or shared with other merchants. They are deleted immediately and completely when you disconnect Google or when Google reports the connection revoked. Your Shopify access token is stored using Shopify’s standard app-session-storage library, which is how Shopify itself recommends apps store it; it is deleted when you uninstall the app.

Data is transmitted over TLS. Access to production systems is restricted to personnel who need it. Additional technical and organisational measures: [placeholder].

6. Retention, deletion and your rights

  • GDPR webhooks. The app implements Shopify’s three mandatory privacy webhooks. Because the app never stores customer personal data, customers/data_request and customers/redact are acknowledged with no data to return or delete, since none is held. shop/redact deletes your store’s session data immediately and your full store record shortly after (see below), which cascades to every record tied to your store — products, generation jobs, usage history, and any connected Google account.
  • Uninstalling. The moment you uninstall, your active session is deleted. Shopify sends us a shop-redaction request on its own schedule (typically within about 48 hours of uninstall), at which point your store’s data is fully deleted. Between uninstall and that redaction, your store record is marked uninstalled but not yet purged.
  • Direct requests. Merchants and their customers can ask us directly to access, correct, export or delete data by emailing apps@thenextsprout.com. Depending on where you live you may also have rights to object, restrict processing, or complain to a supervisory authority.
  • Logs. Technical logs are kept for a limited period for security and debugging, then deleted. Log retention: [placeholder].

7. Google API Services disclosure

SEO Rating’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Search Console data only to show you your own store’s search performance inside the app, and we do not use it to train AI/ML models, nor share it except as described in section 4.

8. Cookies and this website

The app itself uses cookies or equivalent session storage needed to keep you signed in inside Shopify admin. This marketing website (seorating.net) does not set cookies or load any analytics or tracking script as currently built; if that changes, this section will be updated first.

9. Changes and contact

We will update this policy as the app changes, and revise the “last updated” date; material changes will be communicated in the app or by email. Privacy inquiries: apps@thenextsprout.com. Data protection contact / representative, where required: [placeholder].