Privacy Policy: Image Optimizer Pro

Read this with the master policy

This supplement forms part of, and must be read together with, the Privacy Policy. The master sets out who we are, your rights, how to complain, security measures, this website’s cookies and everything else common to all our apps. This supplement adds what is specific to Image Optimizer Pro. Where the two differ, this supplement applies to Image Optimizer Pro.

1. Summary

Image Optimizer Pro (“the App”) is a Shopify app that compresses your store’s images and suggests alt text for them. In short:

The App only accesses your store’s products and files. It cannot see your customers, orders or checkout, and it adds nothing to your storefront.
We store details about your images (links, sizes, alt text), your App settings and your billing status. We do not keep copies of your image files. Images are processed in memory and discarded as soon as each one is finished.
Alt text suggestions are written by Google’s Gemini AI model, only after you turn the feature on and only when you ask for them. Google receives a resized copy of the image, the product name and the language you want. Neither we nor Google use it to train AI models. See section 4.
The App changes your store only when you tell it to. It saves alt text you approve and uploads the compressed images you choose to optimize. It never deletes files from your store.
Payments are handled by Shopify. We never see your card or bank details.
We do not sell your information, show you ads, or use your data to train AI models.
If you uninstall, the App loses access to your store immediately, and all your data is permanently deleted 14 days later.

If you shop at a store that uses the App

The App does not collect, receive or store any information about a store’s customers. For any privacy question about your personal information, please contact the store directly. If a store forwards a customer’s data or deletion request to us through Shopify (the customers/data_request and customers/redact webhooks), we confirm that we hold no data about that customer.

Our role

For your account, settings and billing information, we are the controller: we decide how that information is used, as described in this policy. For your store’s content that the App works on (product names, images and alt text), we act on your instructions as your processor, and use it only to provide the App to you.

2. Information We Collect

2.1 When you install

Your store’s myshopify.com address
The access credentials Shopify issues so the App can work with your products and files
Your Shopify admin language, to show the App in your language
Your store's country, from your Shopify store details, used only to check whether AI suggestions can be offered to you (section 4). It is re-read from your Shopify store details once a day.

We do not collect or store the names or email addresses of you or your staff.

The App asks Shopify for four permissions: read_products, write_products, read_files and write_files. It requests nothing else, which is why it cannot see your customers, orders or checkout.

2.2 About your products and images

Product names
Image links, current alt text, file size, dimensions, file type and upload date
Scan results, such as SEO scores and issues found
Alt text you save, plus your two previous versions so you can restore them. AI suggestions you do not save are not stored.
Compression results (original and new size, format), for your last five compressions per image
Links to the compressed copies the App has uploaded to your store, used to show you a preview and to place the copy on the product
When scans ran and how many images they covered

2.3 Your settings

Compression quality, maximum image width, whether automatic scanning is on, the App’s language, the language used for alt text, whether you have turned AI suggestions on, and whether you have completed setup.

If you agree to AI suggestions, we also store when you agreed, which version of the notice you agreed to, and the Shopify user ID of the staff account that agreed. The user ID is a number, not a name or email address. Withdrawing your agreement in the App’s settings clears all three.

2.4 Billing

Plans and credit packs are billed through Shopify. We store:

your plan, billing cycle and subscription status
the date your paid period ends
your monthly usage and credit balances
a record of each credit purchase: amount, number of credits and status

2.5 Account activity

We keep a record of installs, uninstalls, plan changes and privacy requests. This lets us answer billing questions and show that privacy requests were handled.

2.6 Technical information

Server logs: your store’s address, the time of a request and any errors, so we can keep the App running and fix problems. These logs may include the IP address the request came from. They are deleted after 14 days.
Background job records: bookkeeping for scans and compressions (which image and which settings). They never contain the image itself.
Your browser: the App sets no cookies. Merchants are signed in with short-lived tokens from Shopify. It keeps two display preferences in your browser’s local storage, the view on the Alt Text page and list or grid on Bulk Optimize, which never leave your browser. It uses no tracking, advertising or analytics. Shopify’s own App Bridge script, which measures how quickly apps load, is described in the master policy.

3. How We Use Your Information

We use your information only to provide the App:

Scanning your store’s images and flagging missing alt text and oversized files.
Compressing images when you run an optimization. The App downloads the image from your store, compresses it in memory on our servers and uploads the result to your Shopify Files as a new file, named after the original and ending in -optimized. The image is never saved to disk and is discarded as soon as that image is finished. If you choose to replace the product image, the new file is added to the product and the original is removed from the product but stays in your Shopify Files. The App never deletes files from your store.
Suggesting alt text when you ask for it. See section 4 for exactly what is sent and to whom.
Saving changes you approve. Alt text is written to the image in your store only when you save it, along with a new file name if you choose to rename the image. The App never renames anything on its own.
Keeping your image list up to date. If automatic scanning is on, the App re-checks your products and files when they change and once a night. These checks are read-only and never generate alt text.
Billing: applying your plan’s limits and tracking your usage and credits.
Security and support: protecting the App from misuse, fixing errors and answering your questions.
Legal obligations: meeting our obligations under the law and under Shopify’s terms.

We do not sell your information, use it for advertising, or use it to train AI models. The App makes no automated decisions about you.

4. How AI Alt Text Works

Which AI model. Suggestions are written by Google’s Gemini family of models through Google’s Gemini API. The contracting entity is Google LLC or Google Cloud EMEA Limited, depending on the region of the billing account. Google releases newer versions of Gemini from time to time and we may move to one without notice. We will always tell you in the App before switching to a model from a different company.
Only with your agreement, and only when you ask. Before the App generates its first suggestion it asks you to agree to this processing. The request names Google, says the request goes to the United States, and says how long Google keeps it. We keep a record of your agreement (section 2.3) so that we can show it was given, and withdrawing clears it. You can switch AI suggestions off again in the App’s settings at any time. Alt text is generated only when you request suggestions for an image. Automatic scans never send anything to Google.
What is sent. The App downloads a copy of the image from Shopify’s servers, resized to at most 800 pixels wide, and sends it to Google with the product name and the language you chose. Nothing else is sent: no store address, no customer or order data, and no information about you. The copy is held in memory only for that request.
Images that show people. If a product image shows a person, the AI may describe what is visible, such as clothing or a pose. The instructions we send with every image tell the model to describe only what is clearly visible, to refer to people generically, never to name or identify anyone, and not to guess personal traits such as age, ethnicity or health. They also tell it not to add brands or claims that are not in your own product data, and to ignore any text inside the image that tries to give it instructions.
You stay in control. Suggestions are shown to you and are not stored or published unless you save one. AI can make mistakes, so please check a suggestion before saving it.
How Google handles it. We use Google’s paid Gemini API service, under its Gemini API terms and its data processing terms for the paid service. Requests are sent under our Google account, not yours. On those terms, Google does not use your requests or the results to improve its products or train its models. Google keeps each request and response for 55 days to detect abuse and misuse of its service; authorised Google staff may review a request that its systems flag. We have switched off Google’s optional developer logging, so nothing else is kept on Google’s side. We cannot shorten the 55 days, and a deletion request to us does not reach Google’s abuse log, which expires on its own.
No AI training by us. We do not use your store’s data, or anything derived from it, to create, train or improve any AI model.
Where it is available. Google offers the Gemini API only in the countries and territories it lists. The App checks your store’s country from your Shopify store details and offers AI suggestions only to stores based in those places. Stores based elsewhere, for example in China, Hong Kong, Macao or Russia, have every other feature of the App. The language you write alt text in is not affected by this check.

Legal basis: Consent (Article 6(1)(a) UK GDPR) for the AI feature, given in the App and withdrawable in its settings. Performance of a contract (Article 6(1)(b)) for everything else the App does.

6. How Long We Keep Information

6.1 While the App is installed

Information	How long it is kept
Image files	Never saved. Each image is held in server memory only while it is processed, then discarded.
AI suggestions	Not stored by us. Only alt text you choose to save is kept. Google keeps each request for 55 days for abuse monitoring (section 4).
Access credentials	Until you uninstall
Record of your AI agreement (date, notice version, Shopify user ID)	Until you withdraw your agreement or uninstall
Image details, saved alt text, links to compressed copies, settings, billing, credits and account activity	While the App is installed
Previous alt text	Your two most recent versions
Compression history	Your five most recent per image
Scan history	30 days. Your latest scan is always kept.
Background job records	Deleted when the job finishes. Failed jobs are kept for 7 days for diagnosis.
Server logs	Up to 14 days, then deleted automatically
Server backups	Taken by Hostinger in the UK, encrypted, and replaced by newer backups within 14 days

When you delete an image from your store, the App removes its details at the next scan.

6.2 After you uninstall

Immediately: Shopify removes the App’s access to your store.
For 14 days: everything else is kept. If you reinstall during this time, your images, settings, plan and unused credits are restored.
After 14 days: all information about your store is permanently deleted, including billing information and credit balances. Unused credits cannot be recovered after this point. Copies in our hosting provider’s backups are replaced within a further 14 days, so nothing remains 28 days after uninstall.

We keep one record of the deletion containing only the date and how many records were deleted, with nothing that identifies your store. It shows that the deletion took place.

A valid Shopify shop/redact webhook, or a request from you, triggers deletion sooner. See the master policy, section 8. We do not take our own backups of merchant or customer data. Our hosting provider takes encrypted server backups, which are replaced within 14 days.

7. Security

Your information travels over encrypted connections.
Your store's access credentials are encrypted in our database (AES-256), stay on our servers and are never sent to your browser.
We check that every notification the App receives genuinely comes from Shopify.
The App has no login of its own. You sign in through Shopify, and access to our systems is limited to the people who run the App.

No system is completely secure. If a breach affects your information, we will tell you without undue delay and within the time limits set by law, as set out in the master policy.

8. Your Rights

Wherever you are, you can ask us to:

see the information we hold about your store, and get a copy in a common, machine-readable format;
correct information that is wrong;
delete your information sooner than the 14-day period;
object to or restrict how we use it;
stop AI processing. Switch AI suggestions off in the App's settings, or simply do not request them. Nothing is sent to Google unless you ask for a suggestion.

Email hello@mega-tronic.com from, or on behalf of, the store. We may need to confirm the request comes from the store before acting on it. We will respond within one calendar month, or sooner where the law requires. If we cannot do what you ask, we will explain why, and you can ask us to reconsider by replying to that email. Using a right never affects your price or the service you get. You can also complain to your local data protection authority. Full details are in the master policy.

9. Legal Bases (EEA and UK)

Where EEA or UK data protection law applies, we rely on:

Contract: to provide the App and bill you for your plan.
Consent: for AI suggestions, which you turn on in the App and can turn off at any time.
Legitimate interests: to keep the App secure and reliable.
Legal obligation: to comply with the law.

Legal basis: Performance of a contract (Article 6(1)(b) UK GDPR) for all core processing; consent (Article 6(1)(a)) for AI suggestions; legitimate interests (Article 6(1)(f)) for logs and security.

10. Where Information Is Processed

The App runs on Megatronic Ltd infrastructure in the United Kingdom (Hostinger VPS, UK datacentre), and your information is stored there.

The one exception is AI alt text. When you ask for a suggestion, the resized image, product name and language are sent to Google (Google LLC or Google Cloud EMEA Limited, depending on the region of the billing account), which may process them in the United States or in other countries where it operates. No other information leaves the United Kingdom or EEA.

Safeguards for that transfer

From the EEA: the European Commission's adequacy decision for the United Kingdom, and, for transfers to Google, the EU-US Data Privacy Framework and the Standard Contractual Clauses in Google's data processing terms.
From the UK: the UK Extension to the EU-US Data Privacy Framework, and the UK Addendum to the Standard Contractual Clauses.
From Switzerland: the Swiss-US Data Privacy Framework and the Standard Contractual Clauses as adapted for Swiss law.
From elsewhere: contractual safeguards that give your information a level of protection comparable to this policy.

11. Region-Specific Information

What particular laws require, including for the United States, Canada, Brazil, Australia, Japan, South Korea and India, is set out in section 14 of the Privacy Policy. We do not sell or share personal information as defined by the California Consumer Privacy Act.

12. Children

The App is a business tool for merchants. It is not intended for, or directed at, anyone under 18, and we do not knowingly collect information from them.

13. Changes to This Supplement

We may update this supplement from time to time and will change the version and last updated date when we do. For significant changes, such as a new provider receiving your information, we will let you know in the App before they take effect.

14. Contact Us

Megatronic Ltd, Company No. 17202380, Westminster House, 10 Westminster Road, Macclesfield, England, SK10 1BX. Email: hello@mega-tronic.com. Who we are, how to complain and your full rights are set out in the Privacy Policy.

This supplement describes the App’s behaviour as at the date above. Retention periods reflect the App’s configured settings.