Draft updated: October 16, 2026
Vistolist helps Shopify merchants prepare product images, listing content, and Shopify Draft products. This draft explains the data used to provide that service.
Data we process
- Your Shopify store domain, installation status, authorized scopes, and encrypted Shopify access token.
- Product photographs, merchant-entered product facts, generated images and content, SKUs, and Shopify product references.
- Operational records such as generation counts, errors, and timestamps needed to run and secure the service.
How data is used
We use this data to authenticate your store, generate requested content, create or update Shopify Drafts, provide downloads, prevent duplicates, meter usage, and maintain service security. The current PUBLIC app policy states that the app does not read or retain Shopify customer records; that scope must be re-confirmed for the Vistolist release.
Service providers
Product photographs and relevant product facts may be sent to OpenAI to generate and evaluate requested images and listing content. Hosting and storage providers may process encrypted or access-controlled application data on our behalf. The complete Vistolist subprocessor list must be confirmed before launch. We do not claim to sell merchant or customer data.
Security and retention
The current PUBLIC application encrypts Shopify tokens at rest and isolates store product data. A precise retention schedule is not yet approved for this Vistolist policy. Final language must explain how long each data type is retained, how uninstall and Shopify privacy-redaction requirements are handled, and which limited legal or security exceptions apply.
Your choices
The current PUBLIC workflow allows a merchant to delete local app products without deleting the corresponding Shopify Draft. Uninstalling revokes access. Shopify privacy requests are handled through mandatory compliance webhooks. These behaviors must be verified before this policy is finalized.
Contact
Privacy and deletion questions may be sent to support@vistolist.com with “Privacy request” in the subject.