Shopify Connect App Privacy Policy
This privacy notice covers the Kittl Shopify Connect Extension and supplements Kittl's main Privacy Policy at kittl.com/privacy. Both apply in full; this notice describes only what is specific to the Shopify Connect integration.
The Shopify Connect Extension lets you bring product photos from a Shopify store into Kittl and add designs from Kittl to your products as product images. It reads a store's public product catalog and, once you connect your own store, uses the Shopify Admin API through an app you create for your store in Shopify's Dev Dashboard. It never asks for your Shopify password. It is separate from the Kittl Shopify Extension, which has its own notice at kittl.com/privacy/apps/shopify. Kittl is not affiliated with, sponsored by, or endorsed by Shopify Inc. Shopify is a trademark of Shopify Inc.
When you type a store's address, Kittl's servers read that store's public storefront information (the store's name and its myshopify.com address) and its public product catalog, and return up to 15 product photos with their product titles. No sign-in or credential is involved, and only what the store already shows publicly is read. To keep lookups fast, this answer may be cached on Kittl's servers for up to 15 minutes and reused for anyone who looks up the same store. To prevent misuse, your browser keeps a random device identifier that does not identify you or your Kittl account; Kittl's servers use it to count each device's store lookups and connection attempts per day, and delete the counts of earlier days.
To see your whole catalog, including draft and unlisted products, you connect your store by pasting the Client ID and secret of the app you created in Shopify's Dev Dashboard with the "read_products" and "write_products" permissions. Kittl's servers send them to Shopify once to obtain an Admin API access token, which Shopify issues for 24 hours, and discard them as soon as Shopify answers. Kittl never stores, logs or caches your Client ID or secret, and the extension does not save them in your browser. The access token is kept only in the memory of the open extension panel and is sent with each request to read your products or add a design to one. Kittl's servers pass it to Shopify for that request only and do not store, log or cache it. We do not cache your products, product photos or other Shopify data from your connected store on Kittl servers; it is fetched from the Shopify API on demand when needed to provide the integration.
When you add a product photo to a design, your browser downloads it directly from Shopify's servers, and Kittl stores it in your Kittl workspace and places it on the canvas. From then on it is governed by the imported-content terms in our main Privacy Policy. The photo previews in the extension are also loaded by your browser directly from Shopify's servers, so Shopify receives your IP address and standard browser information for those requests, just as when you visit any website.
When you add a design from Kittl to a Shopify product, the design you selected is exported as a PNG image and sent by your browser directly to Shopify's upload storage, without passing through Kittl's servers. Kittl's servers then ask Shopify to attach it to the product you chose, sending the product's identifier, the upload reference Shopify returned, and alternative text made from the product's title ("<product title>, designed in Kittl"). Kittl receives operational data back from Shopify in connection with this, for example the upload target, the product's title and any error messages, which we use to operate the integration. Once added, the image is part of your store; you can edit or remove it in your Shopify admin.
Kittl does not access or process the personal data of your store's customers, including names, shipping addresses, or payment information; the permissions the extension uses cover products only. That data stays in your store under your own privacy practices.
Kittl records anonymous usage events for the extension, for example whether looking up a store, adding a photo, connecting or adding a design to a product succeeded, how many photos a lookup returned and how long each step took, to operate and improve the feature, as described in the main Privacy Policy. These events do not include your store's address or name, your Client ID, secret or access token, product names or identifiers, image addresses, search terms or images. Kittl does not sell or redistribute Shopify content or Shopify-derived data to any third party; the service providers described in the main Privacy Policy process it only to operate the extension.
Because Kittl never stores your Shopify credentials or access token, there is nothing for Kittl to delete when you disconnect. Clicking Disconnect in the extension removes the access token from the panel. The extension never saves the token in your browser's storage, and Shopify issues it for 24 hours only, after which it expires. You can also uninstall the app you created from your store in your Shopify admin at any time. Shopify content remains subject to Shopify's Merchant Terms of Service and your store's own terms.