AI Act Image Tool: Privacy Policy
Last updated: 10 November 2026
This notice explains how Made in Evolve S.r.l. processes personal data in connection with the Shopify app AI Act Image Tool (the App), available on the Shopify App Store. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and of the Italian Privacy Code (Legislative Decree 196/2003). It applies to merchants who install the App, to their staff and, where relevant, to the customers of their stores. The use of the App is also governed by the Terms of Service; for the website madeinevolve.com the general Privacy Policy applies.
1. Controller and contact details
The controller is Made in Evolve S.r.l., Via Rosalba Carriera 26, 41126 San Damaso, Modena (MO), Italy, Tax Code and VAT no. 03497200364, REA MO-392876.
| Channel | Reference |
|---|---|
| Data protection email | privacy@madeinevolve.com |
| General email | hello@madeinevolve.com |
| Certified email (PEC) | madeinevolve@pec.it |
| Telephone | +39 059 788 0854 |
| Form for privacy requests | /policy/data-removal |
Made in Evolve is the controller of the data concerning the merchant that installs the App and its staff. The App does not process data of the merchant’s customers (see section 3). Shopify is an independent controller of the data processed on its platform, under its own privacy policy.
The Controller has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR are not met.
2. What the App does
The App marks the products whose images have been generated or modified with artificial intelligence: on the products chosen by the merchant it writes a metafield, a tag and a marker in the alternative text of the images, and, if the merchant enables it, prints a visible watermark on the photos. It also offers a badge for the online store, the automatic monitoring of the catalogue (Advanced plan) and the cancellation of every change. It supports the transparency the merchant chooses to provide, including in view of Regulation (EU) 2024/1689 (the AI Act).
At installation the App asks Shopify only for the following permissions: read_products, write_products, read_files, write_files, read_locales.
3. Data processed
| Category | Data | Source |
|---|---|---|
| Store data | Store domain, access and refresh tokens issued by Shopify (with expiry), granted permissions, language of the App. | Shopify, at installation and during use |
| Settings | Marking settings chosen by the merchant: active actions, tag and text, watermark options, automation rules, references (name, identifier and address) to the merchant’s own watermark file, which stays in the store’s file library. | The merchant |
| Job history | Products and files marked, date, previous and new alternative texts, tag added, identifiers of the replaced image and of its backup copy: needed to cancel a change, even partially. | The App, during use |
| Staff data | Shopify makes the store owner’s basic details (name, email, phone, address) available to all apps. The App does not store them. | Shopify |
| Support chat | Messages exchanged in the in-App support chat, the store domain and the technical data of the browser used (including IP address). | The merchant or its staff |
| Technical logs | IP address of the requests reaching the App server, date and time, requested address, outcome. | Automatically |
The App does not access the data of the merchant’s customers or orders and does not request the permissions to read them. When the merchant enables the watermark, the App downloads the photo from Shopify, processes it in memory for the time needed (a few seconds) and uploads it back: images are never saved on Made in Evolve’s servers; the backup copy needed to cancel the change is stored in the store’s own file library. The merchant should not mark images that depict identifiable people unless it has the right to do so.
The App does not use cookies to authenticate the merchant: access takes place through Shopify session tokens. The support chat stores technical data in the browser to keep the conversation open between pages. The App does not use advertising or profiling tools and takes no automated decisions about people.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Installing the App and providing its functions to the merchant | Performance of the contract with the merchant (Art. 6(1)(b) GDPR) |
| Managing plans and billing through Shopify | Performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) |
| Answering support requests | Performance of the contract (Art. 6(1)(b)) |
| Security, error diagnosis and prevention of abuse (technical logs) | Legitimate interest in keeping the service working and secure (Art. 6(1)(f)) |
| Handling Shopify privacy requests and data subject requests | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
Providing the store data is necessary to use the App: without them the App cannot work.
5. Retention
| Data | Retention period |
|---|---|
| Access tokens | Deleted immediately when the App is uninstalled. |
| Settings and job history | For as long as the App is installed; deleted when Shopify sends the shop/redact request (48 hours after uninstallation). |
| Backup copies of the photos | Stored in the store’s file library, not by Made in Evolve: the App removes a copy only when it cancels the change it served; the others remain until the merchant removes them. |
| Support chat | For as long as needed to provide support and in any case no longer than 24 months from the last message; it can be deleted earlier on request. |
| Technical logs | 14 days. |
At the end of these periods the data are deleted or made anonymous, unless they must be kept longer to comply with a legal obligation or to defend a right. Billing data are kept by Shopify, which issues the invoices for the App.
6. Recipients and sub-processors
Data are processed by authorised staff and collaborators of Made in Evolve bound to confidentiality, and only to the extent necessary for their tasks. They are also processed by the following parties:
| Party | Activity | Role | Location |
|---|---|---|---|
| Shopify International Limited (Ireland) and its group companies | Platform on which the store runs: the App reads and writes data only through the Shopify APIs; Shopify also manages the App’s billing | Independent controller | Ireland, Canada and other countries, under its own safeguards |
| DigitalOcean, LLC (United States) | Hosting: cloud server and PostgreSQL database of the App, not reachable from the Internet | Processor | EU (Frankfurt (Germany) data centre); see section 7 |
| Crisp IM SAS (France) | In-App support chat | Processor | EU |
Data may also be disclosed to public authorities where required by law, and to professional advisers bound to confidentiality where necessary to establish, exercise or defend legal claims. We do not sell personal data, do not use them for advertising and do not use them to train artificial intelligence models.
7. Transfers outside the European Economic Area
The App’s data are stored in the Frankfurt (Germany) data centre. DigitalOcean, LLC and Shopify have their parent companies outside the European Economic Area (United States and Canada), and the support chat provider may use technical sub-processors outside the EEA. Where personal data are transferred, or may be accessed, outside the EEA, the transfer takes place on the basis of an adequacy decision of the European Commission (including, for US providers that participate in it, the EU-US Data Privacy Framework) or of the Standard Contractual Clauses adopted by Decision (EU) 2021/914. A copy of the safeguards can be requested at privacy@madeinevolve.com.
8. Shopify privacy requests (mandatory webhooks)
The App is subscribed to the three privacy webhooks that Shopify requires of all public apps, and accepts them only if their cryptographic signature is valid:
customers/data_requestandcustomers/redact: Because the App does not hold any data of the store’s customers,customers/data_requestandcustomers/redactrequests are acknowledged to Shopify with nothing to deliver or delete; the contact details contained in those requests are not recorded.shop/redact: Shopify sends it 48 hours after the App has been uninstalled, if it has not been reinstalled in the meantime. On receipt, the App permanently deletes all the data of that store from its database.app/uninstalled: on uninstallation the App immediately deletes the store’s access credentials.
9. Your rights and how to exercise them
Under Articles 15 to 22 GDPR you may ask at any time and free of charge for access to your data and a copy of them, rectification, erasure, restriction of processing, portability of the data you provided, and you may object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of the processing carried out before.
Requests can be sent through the privacy request form or by email to privacy@madeinevolve.com. We reply within one month of receipt, extendable by two further months where necessary given the complexity or number of requests (Article 12(3) GDPR). Uninstalling the App does not limit these rights.
If you are a customer of a store that uses the App, the App does not hold any of your data: for the data processed by the store, please contact the store directly.
If you believe that the processing infringes the GDPR, you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority of the Member State where you live or work.
10. Security
Traffic between the merchant’s browser, Shopify and the App is always encrypted (HTTPS). Access tokens are used only to call the Shopify APIs within the permissions granted, messages from Shopify are accepted only with a valid signature, and access to servers and databases is limited to authorised staff. The measures adopted are described in the Information Security Policy.
11. Changes to this notice
This notice may be updated when the App, its providers or the applicable rules change; the date at the top shows the latest version. Substantial changes (new categories of data, new purposes, new sub-processors or different retention periods) are announced in the App before they take effect.
12. Contacts
For any question about this notice or about the processing of personal data through the App, write to privacy@madeinevolve.com.