Rabbot — Privacy Policy

The short version

We can only ever read your store. Nothing we're granted can change anything in it.
We do not request, store, or ever see your customers' names, addresses, orders, or payment details. None of that.
We store your shop's domain, its admin contact email (so we can send you alerts), your Shopify access token (encrypted), the pages you're monitoring, and their monitoring history.
Only if you choose to, you can connect your own Google (Merchant Center or Search Console) or Meta (Facebook & Instagram) product catalog. Nothing here is granted when you install the app — you start each one yourself, we read those accounts read-only to show you Google's or Meta's verdicts on your store, and you can disconnect either at any time (see §3 and §4).
Your access token is encrypted at rest and never appears in a log.
Uninstall the app and monitoring stops immediately. Shopify tells us, automatically, to permanently erase everything about your store about 48 hours later — and we do.
Your data is hosted on servers in the EU. We don't sell data, and we run no ads or trackers.

1. What Rabbot is

Rabbot is operated by Gorevoker Studio ("we", "us"), the trading name of a sole trader in the United Kingdom, and it is the controller of the data described below. Rabbot is installed from the Shopify App Store onto your store's admin. Once installed, it checks the pages and products you choose to monitor on a recurring basis and emails you (and, optionally, posts to Slack) when something looks broken — for example a page that starts returning an error, a missing redirect, or a product whose storefront listing disagrees with your store's own catalog data. Everything below describes exactly what that requires, and nothing more.

2. Information we access from your Shopify store

When you install Rabbot, Shopify asks you to approve a fixed, read-only list of permissions. This is the entire list — we never request anything broader, and nothing we hold can write to, or change, anything in your store:

Permission	What it's for
`read_products`	Your product catalog — titles, prices, availability, and variants — so we can catch a product that's silently gone out of stock, or your storefront showing different pricing or availability than your store's own catalog data says it should. That kind of mismatch is a common cause of shopping-feed listing disapprovals.
`read_content`	The content of your store's Online Store pages, blog posts, and articles, so we can catch pages that go missing, get emptied out, or otherwise break.
`read_themes`	Your theme files. Publishing a new theme is one of the most common ways a store accidentally breaks something — a redirect, a broken template, a missing tag — so this lets us notice the moment it happens and re-check the pages it touched.

We do not request permission to read your customers, your orders, your discounts, or your payment information — and we hold no permission that would let us write to, or modify, anything in your store. This is the complete list of what installing Rabbot grants; the only other data Rabbot can ever read is the Google or Meta data in the next two sections, and only if you separately and deliberately connect it.

3. Information we access from Google (only if you connect it)

Rabbot can, entirely at your option, connect to your own Google Merchant Center and Google Search Console accounts so it can show you Google's own verdicts on your store — for example a product Google has disapproved in your shopping listings, or a page Google has dropped from its index. This connection is optional and merchant-initiated: it is separate from installing the app, nothing here is granted at install, you start it yourself from Rabbot's settings by signing in with Google, and you can disconnect it at any time. If you never connect Google, none of this section applies to you.

When you connect, Google asks you to approve exactly these two read-only scopes — this is the entire list:

Google scope What it lets us read — and why

https://www.googleapis.com/auth/content Read-only access to your Google Merchant Center account: each product's approval status (approved / pending / disapproved, per country and per destination such as Shopping ads and free listings), the specific issues Google lists against a product, and the account's name. This is what lets us alert you the moment Google disapproves or demotes one of your products — the thing that quietly stops that product showing in Google Shopping.

https://www.googleapis.com/auth/webmasters.readonly Read-only access to your Search Console (Google's own name for it): whether Google currently indexes a page you monitor and its index/coverage state, your submitted sitemaps' indexed-vs-submitted counts, and aggregate search-performance figures (impressions and clicks) for your pages. This is what lets us alert you when Google drops a monitored page from its index or a sitemap's coverage collapses.

Google scope	What it lets us read — and why
`https://www.googleapis.com/auth/content`	Read-only access to your Google Merchant Center account: each product's approval status (approved / pending / disapproved, per country and per destination such as Shopping ads and free listings), the specific issues Google lists against a product, and the account's name. This is what lets us alert you the moment Google disapproves or demotes one of your products — the thing that quietly stops that product showing in Google Shopping.
`https://www.googleapis.com/auth/webmasters.readonly`	Read-only access to your Search Console (Google's own name for it): whether Google currently indexes a page you monitor and its index/coverage state, your submitted sitemaps' indexed-vs-submitted counts, and aggregate search-performance figures (impressions and clicks) for your pages. This is what lets us alert you when Google drops a monitored page from its index or a sitemap's coverage collapses.

Google's Merchant scope (…/auth/content) has no separate read-only version, so we enforce read-only in our own code: our Merchant client contains no method that could create, change, or delete anything in your Merchant Center, and an automated test fails our build if one is ever added. The Search Console scope is read-only by definition. Nothing in this connection can write to, or change, anything in your Google accounts.

What we do not access. We read only the data above. Through these scopes we cannot, and do not, read your Google Ads, your Google Analytics, your Gmail, your Google account profile, or any Google product other than the Merchant Center and Search Console data described here.

How we use it. Only to detect and alert you about regressions in your own store — a disapproved product, a demoted listing, a deindexed page, a sitemap coverage drop — and to show that history back to you inside Rabbot. That is the only purpose. We do not use Google user data for advertising or ad targeting of any kind; we do not sell it, and we do not share it with data brokers or resellers; and we do not use it to train or improve any AI or machine-learning model.

What we store from it. The connection itself — your encrypted Google sign-in (refresh) token, which Merchant Center account and which Search Console property you chose, and simple counts (such as how many products are currently disapproved) — is stored in our control database, encrypted the same way as your Shopify token (see §12). The short-lived access token Google issues is held only in memory while a check runs and is never written to disk. When a check finds a problem, the resulting alert — which may quote the product's name, its offer id, and Google's own description of the issue — is stored alongside the rest of your store's monitoring history, so you can see what changed and when.

How it's shared. Google user data is processed on our own server in the EU and is only ever handled by the same short list of infrastructure providers named in §11 (hosting, network, email, backups), each acting purely as a processor on our behalf — none of them use it for their own purposes. We transfer Google user data to no one else.

How we protect it. Your Google refresh token is encrypted at rest with AES-256-GCM, exactly like your Shopify token (§12); it never appears in a log, and the access token is memory-only. All traffic to Google and back is encrypted in transit (HTTPS/TLS).

Disconnecting & deletion. You can disconnect Google at any time from Rabbot's settings. Doing so revokes Rabbot's access at Google and immediately deletes the stored Google tokens; Rabbot then stops all Google checks for your store. Alerts we already raised remain part of your monitoring history until you uninstall (see §10) — or you can email us to delete them sooner. If you uninstall Rabbot, everything Google-related is erased together with the rest of your store's data in the automatic ~48-hour purge described in §10.

Google API Limited Use

Rabbot's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Information we access from Meta (only if you connect it)

Rabbot can, entirely at your option, connect to your own Meta (Facebook & Instagram) product catalog so it can show you Meta's own verdicts on your store — for example a product Meta has rejected from your Facebook or Instagram shopping listings, or a data-quality error that stops an item selling there. This connection is optional and merchant-initiated: it is separate from installing the app, nothing here is granted at install, you start it yourself from Rabbot's settings by signing in with Meta (Facebook Login for Business), and you can disconnect it at any time. If you never connect Meta, none of this section applies to you.

When you connect, Meta asks you to approve one product-catalog permission, plus the basic public profile Meta attaches to every login — this is the entire list:

Meta permission What it lets us read — and why

catalog_management The product catalog you connect. For each product, Rabbot reads its review status on each Meta surface (Facebook Shops, Instagram Shopping, and Meta catalog ads — for example approved, pending, or rejected), the specific data-quality issues Meta lists against it, the reasons Meta gives when an item is rejected, and the product's name and ids. This is what lets us alert you when Meta rejects or holds a product — the thing that stops it selling on Facebook and Instagram.

public_profile The basic profile Meta attaches to any Facebook login: the name, profile picture, and account id of the person who connects. Rabbot keeps only the account id — it lets us honor a Meta data-deletion request for this connection — and does not use the name or the picture.

Meta permission	What it lets us read — and why
`catalog_management`	The product catalog you connect. For each product, Rabbot reads its review status on each Meta surface (Facebook Shops, Instagram Shopping, and Meta catalog ads — for example approved, pending, or rejected), the specific data-quality issues Meta lists against it, the reasons Meta gives when an item is rejected, and the product's name and ids. This is what lets us alert you when Meta rejects or holds a product — the thing that stops it selling on Facebook and Instagram.
`public_profile`	The basic profile Meta attaches to any Facebook login: the name, profile picture, and account id of the person who connects. Rabbot keeps only the account id — it lets us honor a Meta data-deletion request for this connection — and does not use the name or the picture.

Meta's catalog permission (catalog_management) is create-read-update-delete with no separate read-only version, so we enforce read-only in our own code: our Meta client contains no method that could create, change, or delete anything in your catalog, and an automated test fails our build if one is ever added. Nothing in this connection can write to, or change, anything in your Meta catalog or account.

What we do not access. We read only the data above. Through this connection we cannot, and do not, read your Meta ad accounts, your ad performance or spend, your Facebook or Instagram messages, your Pages or their posts, or any of your customers' data. The grant carries no permission to any of those.

How we use it. Only to detect and alert you about problems with your own products — a rejected item, a held listing, a data-quality error that will stop it selling — and to show that history back to you inside Rabbot. That is the only purpose. We do not use Meta data for advertising or ad targeting of any kind; we do not sell it, and we do not share it with data brokers or resellers; and we do not use it to train or improve any AI or machine-learning model.

What we store from it. The connection itself — your encrypted Meta sign-in token, which product catalog you chose, the connecting account's id, and simple counts (such as how many products are currently rejected) — is stored in our control database, encrypted the same way as your Shopify token (see §12). When a check finds a problem, the resulting alert — which may quote the product's name, its id, and Meta's own description of the issue — is stored alongside the rest of your store's monitoring history, so you can see what changed and when.

How it's shared. Meta data is processed on our own server in the EU and is only ever handled by the same short list of infrastructure providers named in §11 (hosting, network, email, backups), each acting purely as a processor on our behalf — none of them use it for their own purposes. We transfer Meta data to no one else.

How we protect it. Your Meta token is encrypted at rest with AES-256-GCM, exactly like your Shopify token (§12), and never appears in a log. Meta issues a single long-lived token (there is no separate refresh token), so we store that token only as encrypted data; the decrypted copy is held in the server's memory to run your checks and is cleared from memory when you disconnect. All traffic to Meta and back is encrypted in transit (HTTPS/TLS).

Disconnecting & deletion. You can disconnect Meta at any time from Rabbot's settings. Doing so asks Meta to revoke Rabbot's access and immediately deletes the stored Meta token and clears it from the server's memory; Rabbot then stops all Meta checks for your store. Alerts we already raised remain part of your monitoring history until you uninstall (see §10) — or you can email us to delete them sooner. If you uninstall Rabbot, everything Meta-related is erased together with the rest of your store's data in the automatic ~48-hour purge described in §10.

5. Information we store

Your store's domain (for example yourstore.myshopify.com) and Shopify's own internal identifier for your store.
The admin contact email for your store, captured once from Shopify when you install (you can change it any time in Rabbot's settings) — used only to send you catch alerts and the summary email.
Your Shopify access token, encrypted at rest (AES-256-GCM), with an encryption key that is never stored in our source code or alongside the encrypted data itself.
Which plan you're on and its billing status. Shopify handles the actual billing and payment step — we never see, or store, your card details.
The list of pages and products you (or Rabbot's suggestions) have chosen to monitor, and the monitoring history for them: page titles, meta tags, canonical URLs, structured data, headings, and similar page-structure details captured at each check, so we can tell you what changed. For the most recent check of each page, we also keep a saved copy of that page's markup, so we can show you exactly what changed.
If you connect Slack: the webhook URL you give us, encrypted the same way as your access token.
If you generate an API token to connect Rabbot to your own AI assistant: only a one-way cryptographic hash of that token — never the token itself.

6. Information we never collect

Your customers' names, email addresses, physical addresses, or phone numbers.
Orders, carts, discounts, or any purchase history.
Payment or card details of any kind — Shopify itself handles all billing for the app.
Any tracking of the people who visit your storefront: no analytics, no advertising pixels, no behavioral profiling.

7. Cookies

Rabbot sets exactly one cookie, and only for the few seconds Shopify is installing or reconnecting the app to your store: a short-lived (10-minute), technical cookie that stops a malicious site from forging that step. It carries no personal information and expires automatically. Inside the Shopify admin, Rabbot otherwise identifies your session using Shopify's own short-lived session tokens, not cookies. We set no advertising, analytics, or tracking cookies of any kind.

8. How we use this information

We use it for one purpose: running the monitoring you installed Rabbot for — checking the pages and products you've chosen, comparing each check against the last, and telling you by email (and by Slack, if you've connected it) when something looks broken. That's it. We do not use your data for advertising, we do not build ad-targeting profiles from it, and we do not sell your data — to anyone, ever.

Separately, we keep a shared, pseudonymised ledger across every store we monitor, including yours. It records one plain fact at a time: that a problem was caught, and what kind it was. This covers problems we find on the public storefront pages we check, and it also covers feed problems on any Google, Meta, or TikTok channel you connect (for example, a product disapproved from your Google Merchant Center feed). We record the bare fact of the catch only. We never record the contents of the alert, the page, or the connected account, and we never record any payload from Google, Meta, or TikTok. Before a record is stored, we strip out anything that could identify your store, so no single record ever names a store and nobody reading one can tell whose it is. Any figures we publish or share are always calculated across a large pool of at least twenty stores, never from one store or a small group. You can opt out at any time by emailing us. When you do, we delete the records already collected for your store as well as stop collecting new ones. As everywhere in this policy, we never sell this data or any other.

9. How long we keep it

We keep your store's monitoring data for as long as the app stays installed, so we can show you history and detect changes over time. The full saved copy of a page (its markup) is kept only for the most recent check of that page; older checks are pruned automatically — typically after about a month — unless they recorded something that changed, in which case that record is kept as part of your issue history. Nightly, encrypted backups exist purely for disaster recovery; they roll off over time and nothing is kept in a backup past about six months.

10. Uninstalling the app & data deletion

If you uninstall Rabbot, monitoring for your store stops immediately. We don't erase anything right away, so that if you reinstall shortly after, your history picks back up where it left off. Shopify then automatically tells us, about 48 hours after uninstall, to permanently erase your store's data — and we do: your encrypted access token (and any Google or Meta connection tokens you added), contact email, monitored-page list, and all monitoring history are deleted in one irreversible pass. The only remaining copies are the encrypted disaster-recovery backups described in section 9, which are never restored to bring an erased store back and which roll off automatically within about six months.

Shopify also requires every app to acknowledge two further privacy requests: a request for a customer's data, and a request to erase a customer's data. Because we never collect any customer data in the first place, there is nothing for us to hand over or erase in response to either — we simply confirm receipt, as Shopify requires.

If you'd like your data deleted sooner than the automatic 48-hour window, or have any question about what we hold, email [email protected] and we'll take care of it directly.

11. Where your data is processed

Rabbot's application and its primary databases run on a server we operate in the European Union, hosted by Hetzner. A small number of specialist infrastructure providers help us run the service:

Provider	What they do for us
Hetzner	Hosts the server that runs Rabbot and stores your store's data (EU).
Cloudflare	Network security and DNS in front of our server, and routes mail for our support and abuse-monitoring addresses.
Postmark	Delivers the alert and summary emails we send you.
Backblaze	Stores our encrypted, offsite backups.

None of these providers use your data for their own purposes — each processes it solely to provide its service to us.

12. How we protect it

Your Shopify access token — and your Slack webhook URL and any Google or Meta connection token, if you connect them — is encrypted at rest using AES-256-GCM. The encryption key is never stored in our source code or alongside the encrypted data itself, and neither is ever written to a log.
All traffic to and from Rabbot is encrypted in transit (HTTPS/TLS).
We request only read-only Shopify permissions — nothing we hold can modify your store.
Each store's monitoring data is kept isolated from every other store's.
If you generate an API token for your own AI assistant, we store only a one-way hash of it, never the token itself, and you can revoke it at any time.

13. Your rights & choices

Change or remove your alert email at any time in Rabbot's settings.
Disconnect Slack at any time; we delete the stored webhook URL.
Revoke your AI-assistant API token at any time and mint a new one whenever you like.
Uninstall the app at any time — see §10 above for exactly what happens to your data, and when.
Ask us anything, or ask us to delete your data sooner than the automatic 48-hour window: [email protected].

14. Changes to this policy

If we materially change what we collect or how we use it, we'll update the effective date at the top of this page and, for significant changes, email the address on file for your store.

15. Contact

Questions, concerns, or requests about your data: [email protected]