Privacy policy

Last updated: 2026-09-01

1. Who we are

Boresha Labs (“Boresha”, “we”) provides a Shopify embedded admin app that helps merchants create and optimize product listings. Contact: support@boresha.app.

For catalog and store data you connect through Shopify, you (the shop owner) are the controller. We act as a processor. For this marketing website and contact form, Boresha Labs is the controller.

2. What we process in the app

• Shop domain and Shopify identifiers
• Staff names and emails from the Shopify admin session
• Product content you submit or we generate as a proposal
• Brand profile (tone, audience, keywords, image style, colours, logo)
• Images and video you upload or we generate, while they wait for your decision
• Billing identifiers from Shopify Billing
• Support tickets you send from inside the app

3. What we do not process

We do not send Shopify customers, orders, or payment cards to AI models. This app does not need them. We do not sell personal data. We do not train models on your catalog.

4. Subprocessors

• Shopify — app hosting of the merchant session, Billing, Files after you accept media
• OpenRouter — AI inference
• Cloudflare — DNS/CDN, R2 staging storage, Turnstile on this website
• Railway — application hosting, Postgres, Redis (production in Amsterdam)
• Resend — transactional email

5. Where data lives

Application data is hosted on Railway in Amsterdam (EU). Staging media sits in Cloudflare R2 until you accept it into Shopify Files, then the staging copy is deleted. Analytics events are kept for 180 days. Finished run blobs are archived, then removed on the schedule described in our internal retention policy. Uninstall plus Shopify’s shop/redact webhook lets us delete or anonymize shop data.

6. This website

The public site is static. If you use the contact form we process your name, email, optional shop domain, topic, and message so we can reply. We use Cloudflare Turnstile to reduce spam. We do not set advertising cookies and we do not run Google Analytics.

7. Your rights

You can ask for access or deletion at support@boresha.app. Merchants can also uninstall the app. See How we handle your store data and our DPA.