Privacy policy

The plain version

We run this website and the Image Voice app for Shopify. The website collects almost nothing. The app reads your product, article, and theme images and their alt text through Shopify's API, sends images (by URL) with some of your own catalog text to Anthropic's Claude model to be described or graded, and writes alt text back — with your approval. We never access, store, or transmit your storefront customers' personal data: the app doesn't request customer or order permissions at all. The personal data we do hold is yours — the store owner's and your staff's — and this policy lists every piece of it. Everything below is that, in detail.

Who we are

We are Leaf Digital. For this website, and for your account and contact data in our apps, we are the data controller. For your store's catalog data — images, alt text, product and article content the app touches — you are the controller and we process it on your instructions, under our agreement with you and Shopify's platform terms. Reach us at hello@leafdigital.io.

This website

• Analytics. Three tools, each doing a different job. Vercel Analytics is cookieless and counts page views and button clicks. Google Analytics 4 tells us which campaign sent someone here. PostHog (posthog.com) shows how people move through the site — which pages, links and questions they open — and where they click, as heatmaps. There is no session replay and no screen recording. In the EU/EEA, the UK, Switzerland and Brazil, Google Analytics and PostHog run without cookies until you allow them in the banner; everywhere else they set analytics cookies by default, and "Privacy choices" in the footer turns them off wherever you are. Declining still lets us count visits without cookies. None of it is used for advertising: we do not run ads or sell audiences. Preview and local builds load neither.
• Video. The Image Voice page has a YouTube video on it. It does not load until you press play — until then the page shows a still image served from our own site, and YouTube is sent nothing at all. Press play and YouTube receives your IP address and sets its own cookies, under Google's privacy policy. We use the no-cookie player (youtube-nocookie.com), which keeps those cookies out of Google's advertising profiles.
• Forms and email. If you email us or join a waitlist, we keep your address and message to answer you. We don't sell it, share it, or add it to marketing lists you didn't ask for.

Cookies

Always set, because the site needs them. None of these identifies you.

• leaf_region — which consent rule applies where you are, worked out from your country. Kept for a day.
• leaf_consent — your answer in the banner. Kept for six months.
• NEXT_LOCALE, LEAF_LOCALE_CHOSEN and LEAF_LOCALE_HINT — the language you are reading in, whether you chose it yourself (kept for a year), and a one-hour suggestion when your country points to another language.

Analytics cookies, only with your OK where the law asks for it. In the EU/EEA, the UK, Switzerland and Brazil they wait until you allow them in the banner; everywhere else they are on by default. "Privacy choices" in the footer changes your answer at any time, wherever you are.

• Google Analytics: _ga and _ga_*, kept for up to two years.
• PostHog: ph_*_posthog, kept for up to a year.

Set by YouTube, only if you press play. The video on the Image Voice page loads nothing until you ask for it. Pressing play hands you to YouTube's no-cookie player, which sets cookies on youtube-nocookie.com to remember playback — never on this site, and never for advertising. Not pressing play sets none of them.

Vercel Analytics sets no cookies. Google, PostHog and Vercel process website analytics in the United States; each relies on the EU Standard Contractual Clauses and is certified under the EU-U.S. Data Privacy Framework.

These tools receive your IP address, as every website does when your browser asks it for a page. They use it to work out roughly where you are — country and city — and we don't use it to identify you.

The Image Voice app

What we access

Through the Shopify API, with the permissions you grant at install: your product images and their alt text, product titles and catalog fields, blog articles and their images, your published theme's image files, and your store's language settings. That is the working set. The app does not request access to customers, orders, or payment data — those permissions are absent by design, and our build checks fail if a customer or order subscription ever appears.

What we store

Scan results (coverage grades per image), proposed and applied alt text, and the before/after history that powers the 30-day undo. We store image references (Shopify CDN URLs), not copies of your image library.

The personal data the app stores is the merchant's own and their staff's, never a storefront customer's:

• Your digest email address, if you enable the weekly digest — entered by you, used only to send it.
• Shopify staff-user session details (name, email, locale) that Shopify's own session tooling attaches when a staff member uses the app. We don't read these fields; they're deleted at uninstall and re-swept at redaction.
• Alt text itself, which is free prose. If someone at your store typed personal data into an alt text, we store it as typed — we don't inspect it.
• Usage records of the app's own screens and actions, identified by your store and, where a session names one, a staff-user ID — never by a customer.

AI processing — disclosed plainly

To write or grade a description, the app sends your image (as its Shopify CDN URL) to Anthropic (anthropic.com), whose Claude model returns the text. Alongside the image, the app sends context from your own store so the description fits: the product's title and, where set, its description excerpt, vendor, and type; for blog images, the article's title and summary; for the quality pass, the alt text currently live on the image. The honest rule: apart from the image URL, its media type, and your store's language setting, everything sent is text someone at your store wrote, passed through as typed. Images and text are transmitted for this purpose only. Under Anthropic's commercial terms, which are the agreement our API use runs under, Anthropic may not train its models on that content. No storefront customer data is involved at any point: neither flow has anywhere a customer or order could even be attached.

Product telemetry

The app records which of its own screens you reached — scan, review, apply — so we can see where merchants get stuck. It's sent from our servers to PostHog (posthog.com), identified by your store or a staff-user ID, limited to counts and states of the app's own interface, and kept for [12 months — confirm retention setting]. There is no session replay and no screen recording of any kind — structurally: no recording script is ever served to your browser. Nothing in telemetry names a customer or contains store content.

The weekly digest

If you enable it, we send your digest email address and the digest message through Resend (resend.com), our email delivery provider. The message contains your shop domain, the week's counts, and links back into the app. Nothing else, and no one else's address.

Those three — Anthropic, PostHog, and Resend — are the complete list of third parties this app sends anything to. Everything else the app talks to is Shopify itself or our own infrastructure.

Where your data lives

App data is stored on servers in the United States (Hetzner, in Ashburn, Virginia). Anthropic, PostHog, and Resend also process data in the United States. Where European data-protection law applies to your store, each of those transfers rests on a named safeguard: Anthropic's data processing addendum incorporates the EU Standard Contractual Clauses, with the UK and Swiss addenda; PostHog and Resend rely on the same clauses and are additionally certified under the EU-U.S. Data Privacy Framework and its UK extension.

Retention and deletion

• Alt-text change history: 30 days, to power restore, then pruned.
• Store data (scan results, settings, sessions): kept while the app is installed. When you uninstall, Shopify sends us a mandatory erasure request about 48 hours later, and we erase your store's data when it arrives — the deletion is logged, and re-running it removes nothing more because nothing is left.
• Usage and event records: aged out after 12 months.
• Billing records: kept as long as tax and accounting law requires.

Shopify privacy webhooks

The app implements all three of Shopify's mandatory privacy webhooks. A customer data request receives a truthful answer: we hold no customer data to export. A customer redaction request likewise: nothing held, nothing to delete, and we log the receipt. A shop redaction request erases your store's data as described above.

What we never do

We don't sell or share your personal information — under the CCPA's definitions or anyone else's. We don't run advertising, don't use advertising identifiers, don't record sessions, and don't touch storefront customer data. Access tokens for your store are encrypted at rest, and every store's data is isolated from every other's by construction.

Your rights

You can request access to, a copy of, correction of, or erasure of the personal data we hold about you, and you can object to or ask us to restrict processing. GDPR, CCPA, and equivalent frameworks apply according to where you are; we honor the substance of these rights for everyone rather than checking your jurisdiction first. Write to hello@leafdigital.io and we'll respond within 30 days, usually much faster. If you're in the EU/EEA or UK, you can also complain to your local supervisory authority. We will never treat you differently for exercising a privacy right.

Children

Neither the website nor the app is directed at children under 16, and we do not knowingly collect their data.

Changes

When this policy changes, we'll update the date at the top and, for anything material to app users, say so in the app or by email. The current version always lives at this address.