GDPR Compliance

Controller and processor roles

When you use ShopAltAI to generate listings, alt text, or content for your store, you are the data controller for any personal data that ends up in your product catalog or customer-facing content, and ShopAltAI acts as your data processor. You're responsible for having a lawful basis to collect and use any personal data in your own catalog; we're responsible for processing what you send us securely and only for the purposes you've instructed.

Data minimization by design

ShopAltAI's generation flow is built around processing what's needed and nothing more:

• No unattended publishing. Every generated field is a draft until you approve it, which limits how personal data (if any slips into your catalog) can propagate.
• No use for AI training. Your product content is not used by us, or by the AI providers we use, to train models — this is a standard term of the provider APIs we integrate with.
• Scoped access. Platform integrations request only the product, image, and inventory data needed to generate and publish listings — not your customer database.

How product images are handled

Images you upload or that we read from your connected store are processed to generate alt text or listing content, and are retained only as long as needed to support your account (for example, so you can review generation history). We don't sell, license, or repurpose your product images for any use outside providing the Services to you.

Where processing happens

ShopAltAI is operated from India. Today, product content is processed by Google (Gemini) — the only AI provider currently enabled on the platform. Support for additional providers (including Anthropic, OpenAI, DeepSeek, and others) is built into the product but not yet available to customers; we'll update this page before any of them go live. Where personal data is involved in these transfers, we rely on the safeguards built into each provider's standard API terms. If your organization requires a signed Data Processing Agreement or Standard Contractual Clauses for your own compliance file, contact us — see below.

Data subject rights

If personal data about one of your customers or employees ends up in content generated through ShopAltAI, you — as the controller — are responsible for handling their GDPR requests (access, correction, deletion, etc.). We'll support you in fulfilling those requests where the data lives in our systems on your behalf; contact info@shopaltai.com.

For your own account data as a ShopAltAI customer, see the “Your Rights and Choices” section of our Privacy Policy.

Data Processing Agreement

Agencies and businesses that need a signed DPA as part of their own GDPR compliance can request one by emailing info@shopaltai.com.

Frequently asked questions

Is my product data used to train your AI models?

No. Product content sent through the AI providers we integrate with is not used to train their models, under the standard terms of their APIs.

Can I delete my data on request?

Yes. You can delete individual generations from your history at any time, and request full account deletion by contacting us.

Do you sell or share customer data with advertisers?

No. We don't sell or share personal data for advertising purposes.