Rabbot — Privacy Policy

1. What Rabbot is

Rabbot is operated by Gorevoker Studio ("we", "us"), the trading name of a sole trader in the United Kingdom, and it is the controller of the data described below. Rabbot is installed from the Shopify App Store onto your store's admin. Once installed, it checks the pages and products you choose to monitor on a recurring basis and emails you (and, optionally, posts to Slack) when something looks broken — for example a page that starts returning an error, a missing redirect, or a product whose storefront listing disagrees with your store's own catalog data. Everything below describes exactly what that requires, and nothing more.

2. Information we access from your Shopify store

When you install Rabbot, Shopify asks you to approve a fixed, read-only list of permissions. This is the entire list — we never request anything broader, and nothing we hold can write to, or change, anything in your store:

We do not request permission to read your customers, your orders, your discounts, or your payment information. Installing Rabbot grants read-only permissions, and this is the complete list of them. The only write permissions we ever hold are the optional ones in "Fixes you tap" below, and Shopify asks you for those only when you tap a fix. The only other data Rabbot can ever read is the Google, Meta, or TikTok data in the next three sections, plus the sales totals described just below, and only if you separately and deliberately connect or switch each one on.

Fixes you tap (only if you tap them)

When Rabbot finds a problem it can fix, the Rabbot app in your Shopify admin offers a fix you can tap. Nothing is changed until you tap. At that moment Shopify shows its own permission prompt, and the fix runs only if you approve it. Rabbot never asks for theme access.

Every fix is recorded with what it changed and when. You can undo a fix for 30 days from the same screen. The one exception is a redirect chain pointed straight at its end, which Shopify does not allow to be put back, and the app says so before you tap. You can switch fixes off and revoke these permissions in the app's Settings at any time. Revoking removes the write permission from Shopify's record. Nothing about your customers, orders, discounts, or payments changes. We never request those.

• write_products. To put one product field back, for example an SEO title that another app rewrote.
• write_online_store_navigation with read_online_store_navigation. To add or change a URL redirect, or to put a product's previous web address back.

Sales totals (only if you turn this on)

Rabbot can show your own sales figures beside the problems it finds on your store, so you can see whether a broken page and a quiet day line up. Rabbot calls this the revenue line.

This stays off until you switch it on. Switching it on asks you to approve one extra read-only Shopify permission. Say no and everything else keeps working.

What Rabbot reads. Daily sales totals from Shopify's own reports: one for the store, one for each product, and one for each channel a visit came from.

What Rabbot never reads. Individual orders. Your customers, or anything that identifies one: names, email addresses, postal addresses, phone numbers. None of that, before you switch this on or after.

How long it is kept. 90 days, then Rabbot deletes it. One copy can outlive that: our nightly, encrypted backups exist for disaster recovery only, they are never restored to bring deleted totals back, and nothing stays in one past about six months (section 10). If you uninstall, it goes with everything else on the schedule in section 11.

Where it goes. The totals stay in your store's own database on our server in the EU, encrypted. They do one job: draw your sales line next to your own issues. Four places can show you a figure taken from them, and each one is a place you already use:

• Rabbot's own pages in your Shopify admin. On screen, to you.
• Your Rabbot summary email. The sales line for a problem Rabbot caught and cleared is written into that email, so it travels through Postmark, the provider that delivers our email for us (section 12). Nothing else from the totals is in it.
• An answer to Shopify's Sidekick assistant, for a problem Rabbot caught and cleared, and only if you ask Sidekick about it. Shopify holds what it receives under its own terms, which section 12 sets out in full.
• Your own AI assistant, if you generate a Rabbot API token and connect one. The same sales line is then in the answers Rabbot gives it, and what that assistant does with an answer is in your hands, not ours.

That is the whole list. The totals are never sold, never shared with another store, never part of the pooled statistics described in section 9, and never shown on a public page.

Turning it off. Switch it off in Rabbot's settings. Collection stops, and the totals already collected are deleted.

3. Information we access from Google (only if you connect it)

Rabbot can, entirely at your option, connect to your own Google Merchant Center and Google Search Console accounts so it can show you Google's own verdicts on your store — for example a product Google has disapproved in your shopping listings, or a page Google has dropped from its index. This connection is optional and merchant-initiated: it is separate from installing the app, nothing here is granted at install, you start it yourself from Rabbot's settings by signing in with Google, and you can disconnect it at any time. If you never connect Google, none of this section applies to you.

When you connect, Google asks you to approve exactly these two read-only scopes — this is the entire list:

Google's Merchant scope (…/auth/content) has no separate read-only version, so we enforce the boundary in our own code. Our Merchant client contains no method that could create, change, or delete a product, a price, an inventory record, or any other item in your feed, and an automated test fails our build if one is ever added. There is exactly one thing we create in your Merchant Center, and it changes none of your data: a notification subscription, which is how we ask Google to tell us when one of your products changes status instead of waiting to check. We remove it ourselves when you disconnect Google or uninstall Rabbot. If you have already withdrawn our access in your Google account by then, we can no longer reach in to delete it; it stops working either way, because the address it reports to stops existing, and you can remove it yourself in Merchant Center. The Search Console scope is read-only by definition.

What we do not access. We read only the data above. Through these scopes we cannot, and do not, read your Google Ads, your Google Analytics, your Gmail, your Google account profile, or any Google product other than the Merchant Center and Search Console data described here.

How we use it. Only to detect and alert you about regressions in your own store — a disapproved product, a demoted listing, a deindexed page, a sitemap coverage drop — and to show that history back to you inside Rabbot. That is the only purpose. We do not use Google user data for advertising or ad targeting of any kind; we do not sell it, and we do not share it with data brokers or resellers; and we do not use it to train or improve any AI or machine-learning model.

Limited Use disclosure. Rabbot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we store from it. The connection itself — your encrypted Google sign-in (refresh) token, which Merchant Center account and which Search Console property you chose, and simple counts (such as how many products are currently disapproved) — is stored in our control database, encrypted the same way as your Shopify token (see §13). The short-lived access token Google issues is held only in memory while a check runs and is never written to disk. When a check finds a problem, the resulting alert — which may quote the product's name, its offer id, and Google's own description of the issue — is stored alongside the rest of your store's monitoring history, so you can see what changed and when.

How it's shared. Google user data is processed on our own server in the EU and is only ever handled by the same short list of infrastructure providers named in §12 (hosting, network, email, backups), each acting purely as a processor on our behalf — none of them use it for their own purposes. We transfer Google user data to no one else.

How we protect it. Your Google refresh token is encrypted at rest with AES-256-GCM, exactly like your Shopify token (§13); it never appears in a log, and the access token is memory-only. All traffic to Google and back is encrypted in transit (HTTPS/TLS).

Disconnecting & deletion. You can disconnect Google at any time from Rabbot's settings. Doing so revokes Rabbot's access at Google and immediately deletes the stored Google tokens; Rabbot then stops all Google checks for your store. Alerts we already raised remain part of your monitoring history until you uninstall (see §11) — or you can email us to delete them sooner. If you uninstall Rabbot, everything Google-related is erased together with the rest of your store's data in the automatic ~48-hour purge described in §11.

4. Information we access from Meta (only if you connect it)

Rabbot can, entirely at your option, connect to your own Meta (Facebook & Instagram) product catalog so it can show you Meta's own verdicts on your store — for example a product Meta has rejected from your Facebook or Instagram shopping listings, or a data-quality error that stops an item selling there. This connection is optional and merchant-initiated: it is separate from installing the app, nothing here is granted at install, you start it yourself from Rabbot's settings by signing in with Meta (Facebook Login for Business), and you can disconnect it at any time. If you never connect Meta, none of this section applies to you.

When you connect, Meta asks you to approve one product-catalog permission, plus the basic public profile Meta attaches to every login — this is the entire list:

Meta's catalog permission (catalog_management) is create-read-update-delete with no separate read-only version, so we enforce read-only in our own code: our Meta client contains no method that could create, change, or delete anything in your catalog, and an automated test fails our build if one is ever added. Nothing in this connection can write to, or change, anything in your Meta catalog or account.

What we do not access. We read only the data above. Through this connection we cannot, and do not, read your Meta ad accounts, your ad performance or spend, your Facebook or Instagram messages, your Pages or their posts, or any of your customers' data. The grant carries no permission to any of those.

How we use it. Only to detect and alert you about problems with your own products — a rejected item, a held listing, a data-quality error that will stop it selling — and to show that history back to you inside Rabbot. That is the only purpose. We do not use Meta data for advertising or ad targeting of any kind; we do not sell it, and we do not share it with data brokers or resellers; and we do not use it to train or improve any AI or machine-learning model.

What we store from it. The connection itself — your encrypted Meta sign-in token, which product catalog you chose, the connecting account's id, and simple counts (such as how many products are currently rejected) — is stored in our control database, encrypted the same way as your Shopify token (see §13). When a check finds a problem, the resulting alert — which may quote the product's name, its id, and Meta's own description of the issue — is stored alongside the rest of your store's monitoring history, so you can see what changed and when.

How it's shared. Meta data is processed on our own server in the EU and is only ever handled by the same short list of infrastructure providers named in §12 (hosting, network, email, backups), each acting purely as a processor on our behalf — none of them use it for their own purposes. We transfer Meta data to no one else.

How we protect it. Your Meta token is encrypted at rest with AES-256-GCM, exactly like your Shopify token (§13), and never appears in a log. Meta issues a single long-lived token (there is no separate refresh token), so we store that token only as encrypted data; the decrypted copy is held in the server's memory to run your checks and is cleared from memory when you disconnect. All traffic to Meta and back is encrypted in transit (HTTPS/TLS).

Disconnecting & deletion. You can disconnect Meta at any time from Rabbot's settings. Doing so asks Meta to revoke Rabbot's access and immediately deletes the stored Meta token and clears it from the server's memory; Rabbot then stops all Meta checks for your store. Alerts we already raised remain part of your monitoring history until you uninstall (see §11) — or you can email us to delete them sooner. If you uninstall Rabbot, everything Meta-related is erased together with the rest of your store's data in the automatic ~48-hour purge described in §11.

5. Information we access from TikTok (only if you connect it)

Rabbot can, entirely at your option, connect to your own TikTok Ads product catalog so it can show you TikTok's own verdicts on your store: for example a product TikTok has rejected from its catalog and video shopping ads, or a data-quality problem that stops an item selling there. This connection is optional and merchant-initiated: it is separate from installing the app, nothing here is granted at install, you start it yourself from Rabbot's settings by signing in with TikTok, and you can disconnect it at any time. If you never connect TikTok, none of this section applies to you.

The TikTok connector is in beta, and it is open to a limited pilot. It appears in Rabbot's settings only for the stores we have added to that pilot. Every other store never sees it and cannot start it.

When you connect, TikTok asks you to approve read scopes from its Catalog Management family. These are the ones Rabbot uses, and this is everything it reads with them:

The grant also lets Rabbot list the TikTok Business Centres and advertiser accounts it has been authorised for. That is how Rabbot's settings can offer you the right catalog to choose, and how it notices when your authorisation has been withdrawn on TikTok's side.

TikTok's catalog scopes come in read and write pairs (each read id above has a create, update, and delete sibling), so we enforce read-only in our own code as well: our TikTok client contains no method that could create, change, or delete anything in your catalog, every call it makes is a GET, and an automated test fails our build if either of those stops being true. Nothing in this connection can write to, or change, anything in your TikTok catalog or account.

What we do not access. We read only the data above. Our TikTok client has no method that could reach your TikTok ad campaigns, your ad performance or spend, your account's videos, comments, messages, or followers, or any of your customers' data.

How we use it. Only to detect and alert you about problems with your own products (a rejected item, a data-quality problem that will stop it selling) and to show that history back to you inside Rabbot. That is the only purpose. We do not use TikTok data for advertising or ad targeting of any kind; we do not sell it, and we do not share it with data brokers or resellers; and we do not use it to train or improve any AI or machine-learning model.

What we store from it. The connection itself (your encrypted TikTok access token, which Business Centre and catalog you chose, the scope ids TikTok granted, the advertiser ids the grant covers, and simple counts such as how many products are currently rejected) is stored in our control database, encrypted the same way as your Shopify token (see §13). When a check finds a problem, the resulting alert, which may quote the product's name, its id, and TikTok's own description of the issue, is stored alongside the rest of your store's monitoring history, so you can see what changed and when.

How it's shared. TikTok data is processed on our own server in the EU and is only ever handled by the same short list of infrastructure providers named in §12 (hosting, network, email, backups), each acting purely as a processor on our behalf. None of them use it for their own purposes. We transfer TikTok data to no one else.

How we protect it. Your TikTok token is encrypted at rest with AES-256-GCM, exactly like your Shopify token (§13), and never appears in a log. TikTok issues a single long-term token (there is no separate refresh token, and it does not expire on its own), so we store that token only as encrypted data; the decrypted copy is held in the server's memory to run your checks and is cleared from memory when you disconnect. All traffic to TikTok and back is encrypted in transit (HTTPS/TLS).

Disconnecting & deletion. You can disconnect TikTok at any time from Rabbot's settings. Doing so immediately deletes the stored TikTok token and clears it from the server's memory, and Rabbot then stops all TikTok checks for your store. One thing differs from Google and Meta here, and we would rather state it than let you assume otherwise: TikTok publishes no way for an app to revoke its own access, so deleting our copy of the token is the only step we can take. If you want the authorisation itself removed on TikTok's side as well, remove Rabbot from your TikTok Business Centre. Alerts we already raised remain part of your monitoring history until you uninstall (see §11), or you can email us to delete them sooner. If you uninstall Rabbot, everything TikTok-related is erased together with the rest of your store's data in the automatic ~48-hour purge described in §11.

6. Information we store

• Your store's domain (for example yourstore.myshopify.com) and Shopify's own internal identifier for your store.
• The admin contact email for your store, captured once from Shopify when you install (you can change it any time in Rabbot's settings) — used only to send you catch alerts and the summary email.
• Your Shopify access token, encrypted at rest (AES-256-GCM), with an encryption key that is never stored in our source code or alongside the encrypted data itself.
• Which plan you're on and its billing status. Shopify handles the actual billing and payment step — we never see, or store, your card details.
• The list of pages and products you (or Rabbot's suggestions) have chosen to monitor, and the monitoring history for them: page titles, meta tags, canonical URLs, structured data, headings, and similar page-structure details captured at each check, so we can tell you what changed. For the most recent check of each page, we also keep a saved copy of that page's markup, so we can show you exactly what changed.
• If you connect Slack: the webhook URL you give us, encrypted the same way as your access token.
• If you generate an API token to connect Rabbot to your own AI assistant: only a one-way cryptographic hash of that token — never the token itself.
• If you switch the revenue line on (section 2): daily sales totals from Shopify's own reports, encrypted at rest and kept for 90 days. No order, and nothing that identifies a customer.

7. Information we never collect

• Your customers' names, email addresses, physical addresses, or phone numbers.
• Orders, carts, discounts, or the details of any individual purchase.
• Payment or card details of any kind — Shopify itself handles all billing for the app.
• Any tracking of the people who visit your storefront: no analytics, no advertising pixels, no behavioral profiling.

If you switch the revenue line on (section 2), Rabbot reads daily sales totals from Shopify's own reports. Those are daily totals, never an order, and never anything about the person who bought.

8. Cookies

Rabbot sets exactly one cookie, and only for the few seconds Shopify is installing or reconnecting the app to your store: a short-lived (10-minute), technical cookie that stops a malicious site from forging that step. It carries no personal information and expires automatically. Inside the Shopify admin, Rabbot otherwise identifies your session using Shopify's own short-lived session tokens, not cookies. We set no advertising, analytics, or tracking cookies of any kind.

9. How we use this information

We use it for the monitoring you installed Rabbot for: checking the pages and products you've chosen, comparing each check against the last, and telling you by email (and by Slack, if you've connected it) when something looks broken. Two things sit beside that, and both are set out on this page: the shared, pseudonymised catch ledger in the next paragraph, and answering a question you put to Shopify's Sidekick assistant (§12). We do not use your data for advertising, we do not build ad-targeting profiles from it, and we do not sell your data, to anyone, ever.

Separately, we keep a shared, pseudonymised ledger across every store we monitor, including yours. It records one plain fact at a time: that a problem was caught, and what kind it was. This covers problems we find on the public storefront pages we check, and it also covers feed problems on any Google, Meta, or TikTok channel you connect (for example, a product disapproved from your Google Merchant Center feed). We record the bare fact of the catch only. We never record the contents of the alert, the page, or the connected account, and we never record any payload from Google, Meta, or TikTok. Before a record is stored, we strip out anything that could identify your store, so no single record ever names a store and nobody reading one can tell whose it is. Any figures we publish or share are always calculated across a large pool of at least twenty stores, never from one store or a small group. You can opt out at any time from the Settings page in the app, or by emailing us. When you do, we delete the records already collected for your store and stop collecting new ones. Turning collection back on rebuilds your store's records from its history at our next check. As everywhere in this policy, we never sell this data or any other.

10. How long we keep it

We keep your store's monitoring data for as long as the app stays installed, so we can show you history and detect changes over time. The full saved copy of a page (its markup) is kept only for the most recent check of that page; older checks are pruned automatically — typically after about a month — unless they recorded something that changed, in which case that record is kept as part of your issue history. Nightly, encrypted backups exist purely for disaster recovery; they roll off over time and nothing is kept in a backup past about six months. If you switch the revenue line on, the daily sales totals it collects are kept for 90 days and then deleted, as section 2 sets out. The backup roll-off just described covers them as well: a deleted total can sit in a backup until that backup rolls off, and a backup is never restored to bring deleted data back.

11. Uninstalling the app & data deletion

If you uninstall Rabbot, monitoring for your store stops immediately. We don't erase anything right away, so that if you reinstall shortly after, your history picks back up where it left off. Shopify then automatically tells us, about 48 hours after uninstall, to permanently erase your store's data — and we do: your encrypted access token (and any Google or Meta connection tokens you added), contact email, monitored-page list, and all monitoring history are deleted in one irreversible pass. The only remaining copies are the encrypted disaster-recovery backups described in section 10, which are never restored to bring an erased store back and which roll off automatically within about six months. That purge reaches everything we hold. It does not reach an answer Rabbot already sent to Shopify's Sidekick assistant at your request: that copy is Shopify's, under Shopify's own terms, and section 12 sets out what that means and where to ask about it.

Shopify also requires every app to acknowledge two further privacy requests: a request for a customer's data, and a request to erase a customer's data. Because we never collect any customer data in the first place, there is nothing for us to hand over or erase in response to either — we simply confirm receipt, as Shopify requires.

If you'd like your data deleted sooner than the automatic 48-hour window, or have any question about what we hold, email [email protected] and we'll take care of it directly.

12. Where your data is processed, and who else receives it

Rabbot's application and its primary databases run on a server we operate in the European Union, hosted by Hetzner. A small number of specialist infrastructure providers help us run the service:

None of these four providers use your data for their own purposes: each processes it solely to provide its service to us, on our instructions. The recipient below is a different kind of thing, which is why it is stated separately and not added to the table above.

Shopify's Sidekick assistant

Shopify's admin includes an assistant called Sidekick. When you ask Sidekick a question that Rabbot can answer, Rabbot sends Sidekick the results of its own checks of your store: which checks failed, on which of your pages and products, when each one was first seen, and the plain-English label, impact and next step Rabbot already shows you for each of them. The answer also carries how much of your store Rabbot covers, which of its checks are running, and when it last checked. Rabbot sends this only when Sidekick asks for it while working on a question you put to it, and Rabbot still only ever reads your store: it cannot change anything in it, and answering a question in Sidekick changes nothing either.

What is never in that answer. Rabbot does not send what Google, Meta or TikTok reported about your products, and it holds no order or customer data to send. Your Shopify access token, your connection tokens and your alert email are never part of it either.

If you switch the revenue line on. Rabbot then holds daily sales totals from Shopify's own reports for 90 days (section 2), and a Sidekick answer can carry a sales figure only for a problem Rabbot caught and cleared. It carries no other figure from those totals, no order, and nothing that identifies a customer.

Shopify is not our processor here. The four providers above act on our instructions. Shopify does not. Under the Shopify API License and Terms of Use, Shopify owns the data it receives when you use an app inside its admin, and it handles that data under Shopify's own terms and privacy policy rather than under this one. In data-protection terms Shopify receives it as a separate controller, not as a subprocessor working for us, so it is listed on its own:

What we cannot take back. Once an answer has reached Sidekick it is in Shopify's hands. Deleting your Rabbot data does not delete it, and neither uninstalling Rabbot nor asking us to erase your data reaches it, because it is no longer ours to erase. Shopify publishes no statement we could find on how long it keeps what an app returns to Sidekick, or on whether that data is used to train a model, and we will not guess on Shopify's behalf: Shopify's own privacy policy governs it, and Shopify is the place to ask. The way to end the transfer altogether is to uninstall Rabbot, because Sidekick then has nothing of ours to ask for.

13. How we protect it

• Your Shopify access token — and your Slack webhook URL and any Google or Meta connection token, if you connect them — is encrypted at rest using AES-256-GCM. The encryption key is never stored in our source code or alongside the encrypted data itself, and neither is ever written to a log.
• All traffic to and from Rabbot is encrypted in transit (HTTPS/TLS).
• We request only read-only Shopify permissions — nothing we hold can modify your store.
• Each store's monitoring data is kept isolated from every other store's.
• If you generate an API token for your own AI assistant, we store only a one-way hash of it, never the token itself, and you can revoke it at any time.

14. Your rights & choices

• Change or remove your alert email at any time in Rabbot's settings.
• Disconnect Slack at any time; we delete the stored webhook URL.
• Revoke your AI-assistant API token at any time and mint a new one whenever you like.
• Uninstall the app at any time — see §11 above for exactly what happens to your data, and when.
• Ask Shopify about anything Rabbot has already answered inside Sidekick: that copy is held by Shopify under its own terms, not by us (§12).
• Ask us anything, or ask us to delete your data sooner than the automatic 48-hour window: [email protected].

15. Changes to this policy

If we materially change what we collect or how we use it, we'll update the effective date at the top of this page and, for significant changes, email the address on file for your store.

16. Contact

Questions, concerns, or requests about your data: [email protected]