Privacy policy

1. Who this applies to

This policy applies to merchants who install Lumora on a Shopify store, and to visitors of this website. Lumora is made and run by NickFlix, based in Gurgaon, Haryana, India, which is responsible for the data described here. In this policy, “we” and “us” mean NickFlix. You can reach us at [email protected].

2. What data we access from your store

When you install Lumora, you grant it access to the following through the Shopify Admin API:

• Products: titles, descriptions, vendors, product types, tags, options, SEO titles and descriptions, and the facts on the product that the writer uses (read and write).
• Collections: titles, descriptions and SEO fields (read and write).
• Images and files: product images and their alt text, so we can describe, upscale and replace them (read and write).
• Shop and account details from your session: your shop domain and, when you sign in, the name and email address of the staff member using the app, as provided by Shopify.

We only change something on your store when you apply a draft, or when you turn on an automatic option such as auto-applying drafts for new products (off by default).

3. What we store

• Sessions: the access token Shopify gives the app, your shop domain, and the signed-in user’s name and email address.
• Drafts and versions: AI drafts of descriptions, SEO fields and alt text, and the earlier versions of product and collection text so you can restore them.
• Image records: links to the original and upscaled images, and temporary copies of results waiting for your approval.
• Settings: your brand voice (tone, audience, word lists, sample copy), automation switches, writing and image defaults, and setup progress.
• Usage and billing records: how many writing runs, upscales and images you have used this month, your plan, and your Shopify subscription ID.
• Job logs: the queue of work we run on your behalf and any error messages.

4. Customer data and privacy requests

Lumora does not request access to customer or order data, and does not store personal data about your customers or their orders. We still handle Shopify’s mandatory privacy webhooks:

• customers/data_request and customers/redact: we hold no customer data, so there is nothing to export or delete. We record that the request arrived.
• shop/redact (sent by Shopify 48 hours after uninstall): we delete all data we hold for that store, as described in section 8.

5. AI providers and how your content is used

To do its job, Lumora sends content to the following kinds of service providers. We name the categories rather than vendors, and we keep this list up to date:

• A large language model provider receives product or collection details (titles, existing text, tags, options, your brand voice settings and any notes you paste) to write descriptions, SEO fields and alt text. For alt text it also receives the product image so the description matches what is in the photo.
• An image upscaling service that we run ourselves receives the product image you ask us to upscale. It does not send the image on to a third party.
• An image generation provider receives the product image, the scene and format you pick, and any details you add, to create lifestyle images.

We send only what is needed for the request you made. We do not sell your data, we do not use it for advertising, and we do not use your content to train our own models. Providers process the content under their own terms and are used only to carry out your requests.

AI output can be wrong. Lumora always presents it as a draft for you to check before it goes on your store.

6. How we use data

We use the data above only to:

• provide and improve the app’s features for your store;
• keep track of your plan, allowances and billing through Shopify;
• keep the service secure, prevent abuse and fix errors; and
• reply when you contact us.

7. Cookies

This website does not use advertising or analytics cookies. The embedded app uses only what Shopify and the app need to keep you signed in and secure.

8. Retention and deletion

• While the app is installed, we keep your drafts, versions, settings and usage so the app works as expected. You can ask us to delete anything sooner.
• When you uninstall, we delete your access token and sessions straight away and stop any queued work.
• When Shopify sends the shop/redact webhook, we delete your drafts, versions, alt text drafts, image records, brand voice, settings, usage history and job logs. We keep one small record (your shop domain, plan, subscription ID and install dates) so that a reinstall does not reset your free monthly allowance.
• Encrypted backups rotate out on a regular schedule, so deleted data also leaves our backups shortly afterwards.

9. Security

Data is sent over encrypted connections. Access tokens are stored in our database, which is not reachable from the public internet, and the admin tools we use to run the service are restricted to our team. We limit the scopes we request to what the app needs. No system is perfectly secure, and if we learn of a breach that affects you we will tell you without undue delay.

10. International transfers

Our service providers may process data in other countries. Where the law requires it, we rely on appropriate safeguards for those transfers.

11. Your rights

Depending on where you live, you may have the right to access, correct, export or delete the personal data we hold about you, and to object to or restrict how we use it. The personal data we hold about merchants is limited to the name and email in the session. To use any of these rights, email [email protected]. If you are in the EU or UK, you can also complain to your local data protection authority.

If you are a merchant, you are responsible for the privacy of your own customers. Lumora does not process their personal data on your behalf.

12. Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and, for significant changes, tell merchants in the app or by email.

13. Contact

Questions about privacy? Email [email protected].