Merivirta AI Optimizer On the Shopify App Store AI Optimizer privacy policy
Last updated: 9 November 2026
This privacy policy explains what information the Shopify app Merivirta AI Optimizer (“the app”) processes when a merchant installs and uses it, what is sent to the AI, where it is stored and how it is deleted. The app is provided by Merivirta Digital Oy (“Merivirta”, “we”, “us”).
1. Who we are
| Company | Merivirta Digital Oy |
| Country | Finland |
| Privacy contact | jere@merivirta.com |
| App URL | https://optimizer.merivirta.com |
2. What the app does
The app writes AI proposals for the titles, descriptions, SEO titles and meta descriptions of the products and collections the merchant selects, and optionally for URL handles, image alt text and a short summary and highlights. The merchant reviews, edits and approves each proposal. Nothing is written to the store until the merchant turns on store updates in Settings and approves a proposal, and applied changes can be reverted. Prices, inventory, variants, tags, the images themselves and collection rules are never changed.
3. Information we process
- Store and installation data: shop domain, access scopes, Shopify access tokens, install and uninstall times and when store updates were turned on. The app uses offline access only, so it does not store the names or emails of staff members.
- Catalog content of the products and collections the merchant selects: title, description, SEO title, meta description, URL handle, vendor, product type, category, tags, options and variant names, the collections a product belongs to, product fields (metafields) with text, numbers or measurements (fields that look like secrets are skipped), image file names and alt text, the short summary and highlights the app writes, and for collections sample product titles. For the product page preview the app also keeps product image addresses, the price range and option values with the proposal. When the merchant applies a URL change, the app stores the ID of the redirect it created so it can remove it on revert.
- App data: AI proposals, job progress, the keywords and notes entered for a job, the number of AI proposals used each month and token counts, settings (AI processing consent, language, brand voice, time format and time zone), the store’s time zone, the cached app plan and an activity log of actions taken in the app.
The app does not request access to customers, orders or other protected customer data, and it does not store personal data of the store’s customers. We do not use cookies for tracking, and the app has no analytics or advertising scripts.
4. AI processing (Anthropic)
The AI is provided by us: we use Anthropic’s Claude through our own Anthropic account and pay for it as part of the merchant’s plan. Merchants don’t need an AI account or API key.
Content is sent to Anthropic only after the merchant has allowed AI processing in Settings and starts a job. Then the catalog content listed above for the selected products and collections, plus any keywords, brand voice and notes, is sent to Anthropic to write the proposals. Prices and the images themselves are not sent, and no customer or order data is sent. Under its Commercial Terms of Service, Anthropic may not train models on content sent through its API, and it processes the data under its Data Processing Addendum. Prompts and outputs are not written to our logs. Merchants should avoid entering personal data in product content or notes.
Ask Virta (optional AI assistant). The app’s Help page has a chat with Virta, Merivirta’s AI assistant, labelled as AI. Nothing is sent unless the merchant writes a question. When they do, the question, Virta’s replies, the store’s myshopify domain, the app’s plan and the browser language go to Merivirta’s Support Hub, and Anthropic’s Claude writes the replies. If the merchant selects Ask a person and ticks the consent box, the email address they confirm is stored with the conversation so a person from Merivirta can reply by email. Store content, customers and orders are never sent to the assistant.
5. How we use the information
We use the information only to provide the app: generate proposals, let the merchant review and edit them, apply approved changes and revert them, count the AI proposals of the plan, answer support questions, and secure and operate the service. We do not sell data, use store content to train AI models, or use it for advertising.
Legal basis (GDPR). Most of the information is business data about the store and its catalog. Where personal data is processed, the legal basis is the performance of our contract with the merchant (Art. 6(1)(b)) and our legitimate interest in running and securing the service (Art. 6(1)(f)). For store data processed through the app, the merchant is the controller and Merivirta acts as processor on the merchant’s instructions. Merivirta is controller for support communication.
6. Where the information is stored and who processes it
All app data is stored in a PostgreSQL database and processed by the app’s web server and background worker hosted by Render in the Frankfurt (EU) region. Proposal content and app documents are encrypted at rest.
| Service provider | Purpose | Location |
|---|---|---|
| Shopify | Platform, authentication and the Admin API | Shopify’s own infrastructure |
| Render Services, Inc. | Hosting of the app and its database | Frankfurt, Germany (EU) |
| Anthropic PBC | Writes the AI proposals and Virta’s replies | United States. The transfer relies on the safeguards in Anthropic’s Data Processing Addendum. |
| Merivirta Support Hub (our own service, on Render in Frankfurt) | Virta chat conversations and “Ask a person” requests | Frankfurt, Germany (EU) |
7. Retention and deletion
- When the app is uninstalled, we immediately delete the Shopify access tokens and stop all background work.
- Shopify sends a shop redaction request 48 hours after uninstall. We then permanently delete all remaining data for the store: proposals, jobs, settings, usage counters and the activity log. Changes already applied stay in the store.
- Merchants can withdraw AI processing consent in Settings at any time, after which no new content is sent to Anthropic, and can ask us to delete their data earlier by emailing us.
- Database backups are kept for a limited period by our hosting provider and then overwritten. Anthropic retains API data only as its terms and Data Processing Addendum allow.
8. Security
Data is transferred over HTTPS. Proposal content and app documents are encrypted at rest. Access to production systems is limited to the people who operate the service. Requests from Shopify are verified with session tokens and webhook signatures.
9. Your rights
Under the GDPR and similar laws, individuals have the right to access, rectify and erase their data, to restrict and object to processing and to data portability, and to lodge a complaint with a supervisory authority (in Finland, the Data Protection Ombudsman, tietosuoja.fi). Requests about a store’s data should normally go to the merchant, and we will assist. You can also contact us at jere@merivirta.com.
10. Changes
We update this page when our processing changes and revise the date above.
