Legal

How we handle your store data

Last updated: 2026-10-16

This is the short version of how Boresha treats your store. The privacy policy and DPA are the formal documents.

Proposals, not silent publishes

Everything the AI writes is a proposal. For each listing you choose publish live, save as draft, or discard. Optimizing an existing product is update or leave it alone. Nothing is written to Shopify until that step.

What we process

Catalog content, your brand profile, media you upload or we generate, staff identity from the Shopify session, and billing identifiers. Support tickets if you write in. A small number of Boresha staff may view listings and media generated in the app to provide support and maintain quality.

What we never send to models

Customers, orders, and payment cards.

Where it runs

Application hosting is Railway in Amsterdam (EU), and media is stored in Cloudflare R2. A video waits there until you decide: added to a listing, it goes to Shopify Files and we delete our copy. A batch’s photos and generated images are deleted about 60 days after the batch was created; images you publish also live in Shopify Files. Analytics events are kept for 180 days.

Uninstall and redact

Uninstall stops all work straight away. 48 hours later, Shopify’s GDPR shop/redact webhook tells us to delete your store’s data, and we delete its records and every file we hold for it, keeping only anonymous totals. Encrypted database backups expire on their own within 90 days. You can also email support@boresha.ai.

Ready to use Boresha? Add Boresha to Shopify