Privacy Policy

1. Who We Are

DescriBoost is operated by DescriBoost, based in Alicante, Spain.

For any privacy-related questions or requests, contact us at contact@describoost.com.

For the purposes of the EU General Data Protection Regulation (GDPR), we act as the data controller for merchant account data and as a data processor for product and store data you submit for description generation.

2. Information We Collect

2.1 Information from Your Shopify Store

When you install DescriBoost, we access certain data through the Shopify API, limited to what is necessary to provide the Service:

• Store name, store URL, and store contact email
• Product titles and existing product descriptions
• Product images
• Product tags, product types, and vendor information
• Basic store settings relevant to description generation, such as store language

We do not access your customers' personal data, order data, or payment information.

2.2 Account and Billing Information

We may collect and store:

• Your name and email address associated with your Shopify account
• Your subscription plan
• Your credit balance and usage information

All payments are processed by Shopify through the Shopify Billing API. We do not collect or store your payment card details.

2.3 Usage Data

We automatically collect technical and usage data such as:

• IP address
• Browser type and device information
• Pages visited within the application
• Generation history
• Timestamps
• Diagnostic, performance, and error data

We use this data for security, analytics, troubleshooting, fraud prevention, and improving the Service.

2.4 Cookies and Analytics

We use cookies and similar technologies for authentication, maintaining user sessions, analytics, security, and remembering preferences.

We use Google Analytics to understand how the Service is used. Analytics may collect information such as IP address, browser type, device identifiers, and interaction data.

Where required by law, we obtain consent before placing non-essential analytics cookies. You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of the Service.

3. How We Use AI to Process Your Data

DescriBoost uses artificial intelligence to generate product descriptions and other product content. In practical terms, this is how the process works:

• When you request content generation, the relevant product data, such as the product title, images, attributes, existing content, and any instructions you provide, is transmitted to one of our third-party AI service providers.
• The AI provider processes this data solely to generate the requested output and returns the generated content to DescriBoost.
• We configure our AI providers so that data submitted through their APIs is not used to train their foundation models. This requirement is reflected in our agreements or applicable provider terms.
• Generated descriptions and other generated content are AI-produced. You are responsible for reviewing, editing, and approving the content before publishing it to your store.
• Nothing is published automatically without your action or explicit approval.

Generated content and the associated product data may be stored in your account so you can access your generation history. This data is deleted following app uninstallation in accordance with Section 7.

4. Legal Bases for Processing (GDPR)

Where the GDPR applies, we process your personal data on the following legal bases:

• Performance of a contract — to provide the Service you subscribed to, including AI content generation, account management, Shopify integration, and billing.
• Legitimate interests — to secure and improve the Service, prevent fraud and abuse, troubleshoot technical issues, and analyze aggregated usage patterns.
• Consent — for optional marketing communications and non-essential cookies where consent is legally required.
• Legal obligation — to comply with applicable tax, accounting, regulatory, and legal requirements.

5. Third-Party Service Providers (Subprocessors)

We share data with the following categories of service providers strictly to the extent necessary to operate and provide the Service:

We do not sell your personal data and do not share it with third parties for their own independent marketing purposes.

6. International Data Transfers

Some of our service providers are located outside the European Economic Area, primarily in the United States.

Where personal data is transferred outside the EEA, we rely on appropriate safeguards, which may include:

• The EU-U.S. Data Privacy Framework, where the relevant provider is certified
• Standard Contractual Clauses approved by the European Commission
• Other lawful transfer mechanisms recognized under applicable data protection law

7. Data Retention and Deletion

Account data is retained for as long as your account remains active and as necessary to provide the Service.

Product data and generation history are retained while the DescriBoost application is installed. When you uninstall DescriBoost, this data is deleted within 30 days unless we are legally required to retain certain records for a longer period.

Billing, tax, transaction, and accounting records may be retained for longer periods where required by applicable law.

Shopify GDPR Webhooks

DescriBoost implements Shopify's mandatory privacy webhooks.

When we receive a valid shop/redact request following app uninstallation, we permanently delete the relevant store data from our systems in accordance with Shopify's requirements and applicable law.

Because DescriBoost does not process Shopify store customers' personal data, valid customers/data_request and customers/redact requests are acknowledged and handled with confirmation that no customer personal data is held by DescriBoost.

8. Your Rights

If you are located in the EEA or the United Kingdom, you may have the following rights regarding your personal data:

• The right to access the personal data we hold about you
• The right to request correction of inaccurate or incomplete data
• The right to request deletion of your personal data
• The right to restrict processing in certain circumstances
• The right to object to certain processing activities
• The right to data portability
• The right to withdraw consent at any time where processing is based on consent
• The right to lodge a complaint with a competent supervisory authority

In Spain, the relevant supervisory authority is the Agencia Española de Protección de Datos (AEPD).

To exercise any of these rights, contact us at contact@describoost.com. We aim to respond to valid requests within 30 days, subject to any extensions permitted by applicable law.

We may request reasonable information to verify your identity before completing a privacy request.

9. Security

We use commercially reasonable technical and organizational measures designed to protect your information, including:

• Encryption in transit using TLS
• Access controls and least-privilege permissions
• Secure authentication through Shopify OAuth
• Secure API authentication and credential management
• Monitoring, logging, and technical safeguards intended to prevent unauthorized access

However, no method of Internet transmission or electronic storage is completely secure. We therefore cannot guarantee absolute security.

DescriBoost uses AI to generate text content but does not make automated decisions that produce legal or similarly significant effects on individuals.

Based on the nature and scale of our current processing activities, DescriBoost is not required to appoint a Data Protection Officer under Article 37 of the GDPR.

10. Children's Privacy

The Service is a business tool intended for merchants and is not directed at anyone under the age of 18.

We do not knowingly collect personal data from minors. If you believe that a minor has provided personal data to us, please contact us so that we can investigate and take appropriate action.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Where changes are material, we will notify you by email, through a prominent notice within the application, or through another appropriate method before the changes become effective.

We will also update the "Last updated" date displayed at the top of this page.

12. Contact Us

If you have any questions about this Privacy Policy, our use of your information, or your privacy rights, contact us at:

DescriBoost
Alicante, Spain
Email: contact@describoost.com