Privacy Policy

1. Information we process

• Shop identity, app installation identifiers, encrypted access credentials, and connection status.
• Product titles, descriptions, vendors, types, tags, variants, prices, inventory summaries, product media URLs, and merchant-entered garment attributes.
• Uploaded product or reference images, prompts, generation settings, generated images and videos, job metadata, downloads, and product-media application history.
• Plan, billing-cycle, AU ledger, security, device, access, error, and support records. Shopify processes payment credentials; supaMov does not store raw card details.

The current Shopify app does not request order, fulfillment, or customer scopes.

2. Purposes and legal bases

We process information to authenticate the merchant, synchronize products, generate requested fashion content, apply selected media to products, provide billing and AU accounting, prevent abuse, troubleshoot failures, respond to support requests, and meet legal obligations. Depending on jurisdiction, the legal basis is contract performance, legitimate interests, consent, or legal obligation.

3. AI processing and service providers

Cloudflare provides cloud infrastructure, data storage, content delivery, and security services. Selected AI processing can be performed by OpenAI, Google, fal.ai, FASHN AI, or another provider disclosed for the enabled feature. Shopify provides authentication, product APIs, app distribution, and billing. Only data needed for the requested operation is sent to each provider.

4. International transfers

Service providers may process data outside your country. We use contractual and technical safeguards appropriate to the service and applicable law, including encrypted transport, scoped credentials, tenant isolation, and access controls.

5. Retention

• Merchant content and generated media: until deleted by the merchant, the app is uninstalled and the applicable deletion period expires, or retention is no longer necessary.
• Temporary source images used only to extract pose guides: deleted after processing; orphaned uploads have a technical maximum of 24 hours.
• Platform credentials: revoked and deleted after uninstall or disconnection, subject to a short operational grace period.
• Security logs: generally three months. Billing, tax, dispute, and audit records: retained for the period required by applicable law.

6. Shopify privacy requests and deletion

We verify Shopify's mandatory privacy webhooks. A shop redaction request revokes credentials, permanently deletes shop-owned media, removes tenant-owned operational records, and de-identifies records that must be retained for billing, fraud prevention, or legal compliance. Customer data request and redaction webhooks receive a minimal response because the app does not request customer data scopes.

7. Security

We use encrypted transport, encrypted platform credentials, signed media access, tenant isolation, least-privilege access, verified webhooks, rate limits, and audit records. No system is completely secure, but we review and improve these safeguards.

8. Your choices and rights

Merchants can review and delete supported assets in the app, disconnect or uninstall the app, and request access, correction, deletion, restriction, or portability where applicable. Some requests may be limited by legal retention duties or the rights of others.

9. Contact

Privacy and support requests can be submitted through the in-app Contact Support page. Include the shop domain and request type, but do not send passwords, access tokens, or payment-card data.

10. Updates

We may update this Policy when the service, providers, or law changes. Material updates will be communicated in the app or through an appropriate merchant contact channel. Effective March 15, 2026; last updated August 26, 2026.