Privacy Policy

1. Introduction

Your privacy matters to us. Winsletapps (“we,” “us,” or “our”) develops and operates the Shopify app Winslet AI Portraits (the “App”). The App lets a merchant offer personalized, AI-generated portrait and artwork products: a shopper uploads their own photo, chooses options such as print size, framing, and mat color, and the App generates a personalized piece of artwork for that order using an AI image provider the merchant has configured.

This Privacy Policy explains how we collect, use, store, share, and protect information when a merchant installs and uses the App, and when a shopper uses the App’s storefront personalization widget to upload a photo and generate artwork.

Scope: This Privacy Policy applies only to information collected through the App.

Roles: When a Shopify merchant installs the App, that merchant is the data controller of its store, product, and customer data, including any photos shoppers upload through the App. We act as a data processor, handling this data on the merchant’s behalf to provide the App’s features.

2. Information We Collect

2.1 Store data accessed through Shopify

The App requests the following access scopes: write_products, write_publications, read_files, read_cart_transforms, write_cart_transforms. write_products lets the App create and update the Shopify product behind each personalization design the merchant publishes (title, description, price, and the small set of internal, never-customer-facing products the App uses to apply the correct price and shipping at checkout). write_publications lets the App publish those products to the online store sales channel. read_files lets the App upload AI-generated example images to Shopify’s file storage and attach them to a product’s media gallery. read_cart_transforms and write_cart_transforms let the App connect a Shopify Cart Transform Function, which applies the correct price — and, where a shopper’s framing choice requires it, physical shipping — for the options a shopper selects, at checkout. The App does not access checkout, payment, or shipping-address details beyond what Shopify’s cart transform platform exposes for this purpose, and does not use any scope beyond what is listed here.

2.2 Design and pricing configuration

Merchants configure each personalization design through the App — its transformation prompt, print sizes, framing and color options, and pricing. This configuration is store-level and is not personal information about any individual shopper.

2.3 Photos a shopper uploads

To generate personalized artwork, a shopper uploads a photo through the App’s storefront widget. That photo is sent to the AI image provider the merchant has configured for their store — currently OpenAI, Google (Gemini), or Black Forest Labs (FLUX) — solely to produce the requested transformation, and is stored by us so the resulting artwork can be displayed, added to the shopper’s cart, reordered from their own generation history, and fulfilled as part of the order. We do not use a shopper’s uploaded photo to train any model, and we do not share it with any party other than the merchant’s chosen AI provider for this purpose.

2.4 Generated artwork and generation records

The App stores the artwork it generates for each request, along with the design used, the options selected (size, framing, mat color, and similar), and any optional personalization note a shopper typed alongside their photo, so the order can be fulfilled correctly and the shopper can view or reorder their own past generations.

2.5 Shopify customer ID (logged-in shoppers only)

If a shopper is logged in to their Shopify customer account when they generate artwork, the App records their Shopify customer ID against that generation so their own generation history can follow them across devices and browsers. This is not collected for a shopper who is not logged in; in that case, generation history is kept only in that shopper’s own browser.

2.6 Subscription and billing data

Shopify’s Managed Pricing and Partner API report which plan (Free or Pro) and subscription status a shop has selected, and, where a merchant is on the Free plan, how many AI generations the shop has used. We store this to enforce the merchant’s selected plan’s features and limits. This is store-level billing information, not personal information about any individual shopper.

2.7 Information you provide to us directly

If you contact us for support, we collect the details you provide, such as your name, email address, and message.

3. How We Use Information

• Generate a shopper’s personalized artwork by sending their uploaded photo to the merchant’s configured AI image provider
• Display generated artwork on the storefront, in the shopper’s cart, and in their own generation history
• Apply the correct price, and physical shipping where needed, at checkout through Shopify’s Cart Transform platform
• Publish and maintain each personalization design as a Shopify product
• Enforce the merchant’s selected plan’s feature access and generation limits
• Respond to support requests
• Monitor, troubleshoot, and improve the App
• Meet legal and regulatory obligations, including Shopify’s compliance webhook requirements

We do not sell personal information. The App does not collect a shopper’s email address and does not send any emails to shoppers.

4. Legal Bases for Processing (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract, to generate and deliver the personalized artwork a shopper requests; legitimate interests, to operate and secure the App; and legal obligation. For store, shopper, and photo data processed on a merchant’s behalf, the merchant determines the legal basis as data controller — including obtaining any consent needed to upload a photo for this purpose.

5. How We Share Information

• Shopify — the App runs on the Shopify platform and exchanges data with Shopify’s APIs, including the Admin, webhook, and Partner APIs, to function.
• The merchant’s configured AI image provider — a shopper’s uploaded photo is sent to whichever provider (OpenAI, Google, or Black Forest Labs/FLUX) the merchant has configured, solely to generate the requested artwork.
• Service providers (subprocessors) — we use Fly.io and Neon to host the App and its data. These providers process data only under our instructions.
• Legal and safety — we may disclose information where required by law.
• Business transfers — if we are involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction.

We do not disclose personal information, including uploaded photos or generated artwork, to any third party for their own marketing.

6. Data Retention and Deletion

Design configuration, uploaded photos, generated artwork, and generation records are retained for as long as the merchant uses the App, so orders can be fulfilled and a shopper’s own generation history remains available.

When a merchant uninstalls the App, we delete the shop’s data within 48 hours, unless a longer period is required by law.

We comply with Shopify’s mandatory compliance webhooks:

• customers/data_request — where a generation is linked to a logged-in shopper’s Shopify customer ID (see Section 2.5), we can provide the merchant with that shopper’s uploaded photos and generated artwork on request.
• customers/redact — we permanently delete any uploaded photos and generated artwork linked to that shopper’s Shopify customer ID.
• shop/redact — we delete all of the shop’s stored data (designs, uploaded photos, generated artwork, and subscription history) after uninstall.

7. Data Security

We take reasonable technical and organizational measures to protect information, including HTTPS encryption in transit, encrypted database storage at rest, and environment-secured credentials restricting system access. A shopper’s uploaded photo is transmitted to the merchant’s configured AI provider only over an encrypted connection. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International Data Transfers

We may process and store information in the United States. A shopper’s uploaded photo is also transferred to whichever AI image provider the merchant has configured, which may process it in a different country. Where required, we put appropriate safeguards in place for international transfers.

9. Your Rights

Depending on your location, you may have the right to access, correct, delete, or restrict the use of your personal information, object to certain processing, request data portability, and withdraw consent. To exercise these rights for data we control directly, contact us using Section 12.

If your request concerns a photo or artwork submitted to a specific merchant’s store, please contact that merchant directly, as they control that data. We will assist the merchant as their processor.

10. Children’s Privacy

The App is not directed to children under 16, and its storefront widget should not be used to upload a photo of a child under 16 without the consent of a parent or guardian. We do not knowingly collect personal information, including photos, from children through the App.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date. Significant changes may be communicated through the App or by email.

12. Contact Us

Winsletapps
ajmal.developer@gmail.com