Legal

Privacy Policy

How FeedGraph collects, uses, stores, and shares personal data — and what you can ask us to do with it. The people this policy is about are the people who use FeedGraph, not your store’s customers.

Last updated 2026-09-09

Who this covers

FeedGraph is a commerce data and performance platform at feedgraph.ai. This policy applies to the marketing website, early-access and contact forms, and the FeedGraph application.

FeedGraph’s data subjects are the people who use it — merchant and agency staff. The product handles a merchant’s product catalogue, not their customers’ orders. There is no orders table and no end-customer list. Advertising metrics we pull from Google and Meta are aggregate, keyed by campaign and SKU.

The one place an identifiable person who is not a FeedGraph user can appear is a product photograph. That is covered by the in-app AI rights terms, not by treating your shoppers as FeedGraph users.

Controller and processor

For accounts, sign-in, billing references, consent records, and this website, FeedGraph is the controller: we decide how that personal data is processed.

For catalogue, feed, and advertising data you connect, FeedGraph is your processor. You decide what to import, enrich, and publish. That processing is described in the Data Processing Agreement.

What we collect

We collect only what the product needs to run. Personal data falls into these categories:

Identity and contact
Email, display name, and user id. Workspace membership, role, and invitations (including the invited email and who sent it).
Authentication
Sign-in methods (email one-time codes, Google sign-in), hashed passwords where used, session records, and optional MFA secrets. One-time codes are hashed; we also keep the IP that requested them, briefly, for abuse investigation.
Device and activity
IP address and user agent on the security trail. What someone did in the workspace — catalog edits, approvals, report runs — so a change can be attributed, reviewed, and reversed.
Content you type
Assistant prompts and replies, in-app feedback (including a screenshot if you attach one), and AI reports you generate.
Billing
Credit grants, purchases, and usage attributed to the person who triggered them. Stripe customer and subscription references. Card numbers never touch FeedGraph.
Credentials held for you
OAuth tokens and API secrets for Shopify, Google, and Meta, stored encrypted, so the workspace can stay connected. These belong to the workspace, not to an individual staff member.
Marketing-site forms
Name, email, company, phone number (early access), and whatever you write in a contact or early-access request. Used only to reply to you and arrange a demo — not added to a marketing list. These submissions reach us as an email notification to our team inbox; they are not stored in the product database, so the product retention classes below do not apply to them. See “How long we keep it”.

What we do not collect

We do not import Shopify customer records or order PII. Product catalogue fields, inventory, and images are commercial data about goods.

We do not sell merchant data. We do not use your catalogue to train a shared model. Data is shared only with the infrastructure and AI subprocessors required for features you have switched on.

Where it comes from

You, when you create an account, invite a teammate, submit a form, or type into the assistant.

Connected platforms, when you grant OAuth access: Shopify for catalogue and inventory; Google Ads, Merchant Center, and Meta for feeds and aggregate performance.

Automatically, from running the service: sessions, audit events, job records, and hashed API keys you create.

Why we use it

Each purpose maps to a lawful basis under GDPR Article 6 and to the in-app consent register (Settings → Privacy). Absence of consent is treated as refusal. Required purposes are recorded as notice, not as a fake optional toggle.

Provide the service (contract)
Accounts, workspaces, Shopify sync, feed generation, and the activity needed to operate them. Hosting, database, and sign-in email are on this path.
AI processing of catalogue content (consent)
Sending product titles, descriptions, and attributes to AI providers so FeedGraph can write, fix, and categorise them. Catalogue content only — never account login details. Optional; the workspace can refuse it.
Image rights and model consent (consent)
Your confirmation that you hold rights in source photographs, including consent from anyone depicted, before we generate images or video. Optional until you generate.
Distribution to ad platforms (consent)
Publishing your catalogue to Google Merchant Center, Google Ads, Meta, and other connected channels.
Security and service integrity (legitimate interest)
One-time codes, MFA, audit trails, and abuse investigation. You can object; some of this cannot be switched off without ending the account.
Legal obligation
Billing records, consent proof, data-subject request logs, and who approved a spend-affecting write to a live ad account.
Product emails and extra analytics (consent)
Optional feature emails, and optional usage analytics beyond the activity log security and billing already require.

How long we keep it

Inside the product, retention is classed in the data inventory and aged out by an automated job. A workspace can shorten a class, never extend it past the ceiling. “Keep forever” is not an option.

Data you send us through a form on this website is the exception: it arrives as email, is kept in a team inbox, and is cleared by hand. It is listed first below so the difference is not buried.

Marketing-site enquiries
Up to 24 months in the team inbox that receives them, then deleted. These are handled by hand rather than by the automated job below, because they arrive as email and never enter the product database. Ask us and we will delete yours sooner.
Sign-in codes
1 day.
Operational queue and invite records
90 days after they stop being useful.
AI assistant conversations
180 days.
In-app feedback
365 days. The reporter’s identity is cleared on erasure; the ticket can remain.
Activity and security trail
730 days (two years).
Consent proof and rights-request logs
2555 days (seven years). A withdrawal is a new row, not a deleted grant.
Billing and credit ledgers
2555 days (seven years), then aged out.

Your rights

You can ask for a copy of what we hold about you, to correct identity and contact fields, or to be erased. In the app this is Settings → Privacy → Data-subject requests. Workspace admins act on their own workspace only. The screen shows a preview — which tables will be exported, deleted, anonymised, or refused — before anything runs.

Erasure is not a blanket DELETE. Audit and approval records keep the event and clear the person (name, email, IP, user agent) so the history of what happened survives without naming who. Some rows are refused with a reason: shared workspaces, hash-chained consent, billing state, and the register of the request itself.

Rectification is a closed list: email and display name on the account, and email on linked sign-in identities. It does not rewrite the audit trail, change a role, or move credits.

If you do not have an account, use the contact form on this site. We will need enough to find you (usually the email you used).

Who else sees data

Active subprocessors — the parties this deployment actually sends data to — are listed in the Data Processing Agreement. Planned vendors that are not processing yet are not listed here, because naming a transfer that is not happening is as wrong as omitting one that is.

AI providers (Anthropic, Google Gemini/Veo, OpenAI when the image fallback is on) receive catalogue content for the job you ran, not your login. Shopify, Google, and Meta receive catalogue and feed data you chose to publish. Stripe receives billing contact and customer references. Resend receives email addresses for sign-in codes, invitations, and form replies.

International transfers

Several subprocessors process in the United States. Where GDPR requires a transfer tool, we rely on the vendor’s Standard Contractual Clauses (or an adequacy decision where one applies).

Cookies and sessions

The application uses a server-side session cookie so you stay signed in and in the right workspace. API keys you create are stored as SHA-256 hashes.

The marketing site does not run advertising pixels. Theme preference may be stored locally in your browser.

Children

FeedGraph is a business product. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.

How to reach us

Use the contact form at feedgraph.ai/contact, or the Privacy screen in your workspace. Security issues can also be sent to security@feedgraph.ai — see feedgraph.ai/.well-known/security.txt. We aim to acknowledge vulnerability reports within 48 hours.

Privacy and data requests
privacy@feedgraph.ai, or feedgraph.ai/contact. We answer within one month, as GDPR Article 12(3) requires.
Grievance redressal (India, DPDP)
privacy@feedgraph.ai. Indian law gives you the right to a defined complaints route before approaching the Data Protection Board, and this is it. Tell us it is a DPDP grievance and we will treat it as one.
Security reports
security@feedgraph.ai. Acknowledged within 48 hours.

This page describes how FeedGraph actually operates. It is written in plain language and pending external legal review. If something here conflicts with a signed order form or data processing addendum, the signed document wins.