Privacy policy

Last updated: 2026-10-16

1. Who we are

Boresha Labs (“Boresha”, “we”) provides a Shopify embedded admin app that helps merchants create and optimize product listings. Contact: support@boresha.ai.

For catalog and store data you connect through Shopify, you (the shop owner) are the controller. We act as a processor. For this marketing website and contact form, Boresha Labs is the controller.

2. What we process in the app

• Shop domain and Shopify identifiers
• Staff names and emails from the Shopify admin session
• Product content you submit or we generate as a proposal
• Brand profile (tone, audience, keywords, image style, colours, logo)
• Images and video you upload or we generate, while they wait for your decision
• Billing identifiers from Shopify Billing
• Support tickets you send from inside the app

A small number of Boresha staff may view listings and media generated in the app to provide support and maintain quality.

3. What we do not process

We do not send Shopify customers, orders, or payment cards to AI models. This app does not need them. We do not sell personal data. We do not train models on your catalog.

4. Subprocessors

• Shopify — app hosting of the merchant session, Billing, Files after you accept media
• OpenRouter — AI inference
• Cloudflare — DNS/CDN, R2 staging storage, Turnstile on this website
• Railway — application hosting, Postgres, Redis (production in Amsterdam)
• Resend — transactional email

5. Where data lives

Application data is hosted on Railway in Amsterdam (EU). Media is stored in Cloudflare R2:

• Videos wait in R2 until you decide. When you add one to a listing it goes to Shopify Files and we delete our copy; a video you don’t decide on is deleted after 60 days.
• Photos and generated images for a batch stay in R2 while the batch is reviewed and are deleted automatically about 60 days after the batch was created. Images you publish are also copied into Shopify Files, which keeps its own copy.
• Your brand logo and reference photos are kept while the app is installed.

Analytics events are kept for 180 days. Finished batches are archived for up to 12 months.

When you uninstall, the app stops all work straight away. 48 hours later Shopify sends us its shop/redact request, and we delete your store’s records and every file we hold for it in R2, keeping only anonymous totals with nothing that identifies your store. If that request never arrives, we delete the same data 60 days after the uninstall.

Backups. Our database is backed up in encrypted form every day. Daily backups are kept for 30 days and weekly backups for 90 days, so a deleted store’s records can remain in a backup until it expires. Backups are used only to recover from failures, and expire automatically.

6. This website

The public site is static. If you use the contact form we process your name, email, optional shop domain, topic, and message so we can reply. We use Cloudflare Turnstile to reduce spam. We do not set advertising cookies and we do not run Google Analytics. We count visits to the site, clicks on the install button and contact messages sent, using Cloudflare’s cookieless analytics: these are totals only, with no cookie, no identifier and nothing that points to you.

7. Your rights

You can ask for access or deletion at support@boresha.ai. Merchants can also uninstall the app. See How we handle your store data and our DPA.