Security & data

When you install Nashrly from the Shopify App Store, Shopify asks you to approve two permissions: read_products and write_products. Nothing else.

With them we read your products, variants and product images, plus basic store details Shopify returns at install: store name, store email, language (locale), currency and timezone. We use these to set up your account and write in the right language.

We write to your store only when you press Publish (or Apply) on a change you have reviewed.

We do not request — and so cannot read — your orders, customers, checkouts or payments. Your shoppers' personal data never reaches our servers.

Our servers: the app and its database run on DigitalOcean.

AI generation: product text and images are sent to Google Gemini on Google Cloud Vertex AI to write pages and create images. If Gemini is unavailable, some requests may fall back to other AI providers listed in our privacy policy. We send only what a request needs (product title, description, attributes, image) — never your password or payment details.

Model training: we do not use your data to train models of our own. Google states that on Vertex AI it does not use customer data to train or fine-tune its models without the customer's permission.

Your Shopify access token is encrypted in our database (application-level encryption) and is never written to logs or shown in the interface. Connections use HTTPS.

Every Shopify webhook we receive is verified with Shopify's HMAC signature before we act on it.

Before anything is published to Shopify, Nashrly saves the current values — title, description, SEO fields, variant names and photos, Google Shopping fields. One click on Undo puts the original back.

Nothing goes live without your review: every change is a draft until you publish it.

When you uninstall: Shopify revokes our access immediately, and we erase the stored access token and mark the store disconnected.

48 hours later Shopify sends the shop/redact request. When it arrives we delete the products we imported from your store and the store connection record. Your Nashrly account and the posts you created are yours and are kept until you ask us to delete them.

GDPR webhooks: we support customers/data_request, customers/redact and shop/redact. Because we never store shopper data, the two customer requests find nothing to export or erase.

Email hello@7okm.com from your store email and tell us whether you want an export or full deletion of your account. We handle requests by hand and confirm when it is done.

If you find a vulnerability, please email hello@7okm.com with "Security" in the subject and steps to reproduce. Give us reasonable time to fix it before sharing publicly; we will reply, keep you updated and credit you if you wish. Please do not access other merchants' data or disrupt the service while testing.