Last updated: [UPDATE DATE WHEN PUBLISHING]
ListingLab (“we”, “us”) is a Shopify application operated by Sistrom Tech, Sydney, NSW, Australia. This policy explains what data the app accesses, what we store, and why.
Who this policy covers
This policy covers:
- Merchants who install the ListingLab Shopify app, and the visitors to their storefronts whose activity the app’s web pixel measures.
- Visitors to listinglab.tech, including anyone who uses the free store grader.
- People who join our agency waitlist.
- Business contacts we email directly about ListingLab (see “If we emailed you”).
What the app accesses
When you install ListingLab, you grant it the following Shopify permissions. We request the minimum needed for the app to function.
| Permission | Why it is needed |
|---|---|
| Read products | To read your product listings and score them against our optimization rubric. |
| Write products | To apply changes you have explicitly reviewed and approved. The app never modifies a product without a per-product action by you. |
| Read orders | To calculate per-product sales volume and revenue, which determines which listings are commercially important. |
| Write pixels | To install the web pixel that records anonymous storefront activity. |
| Read customer events | Required by Shopify to operate the web pixel. |
What we store
From your product catalogue: product titles, descriptions, tags, product type, category, image metadata (count and alt text), SEO fields, variant options and prices, and inventory levels. We store the scores we calculate from these, a history of those scores over time, and any rewrite proposals generated for you.
From your orders: only product IDs, quantities, and line-item monetary totals, aggregated into per-product sales figures over a rolling 60-day window.
We do not access, store, or display customer names, email addresses, postal addresses, phone numbers, payment details, or any other personally identifiable customer information. Our order-processing code constructs its records field by field from an explicit allowlist, so customer data is discarded at the point of receipt and never written to our database or logs. (Email addresses we hold for waitlist signups and business contacts are described elsewhere in this policy.)
From the web pixel: for each event, only the shop domain, the event type (product viewed, added to cart, or purchased), the product ID, and a timestamp. The pixel does not record user agents, device identifiers, cookies, or any other information that could identify an individual visitor, and our ingest endpoint rejects any payload containing fields beyond these. The storefront web pixel does not record visitors’ IP addresses either; the store grader on listinglab.tech processes the requester’s IP address briefly and stores only a salted hash, as described under “The free store grader” below.
From your Shopify account: your shop domain, the email address Shopify provides for app communications, your plan status, and authentication tokens needed to call the Shopify API on your behalf.
The free store grader
When you grade a store on listinglab.tech, we collect and store:
- The store address you entered.
- Public product data from that store: product titles, descriptions, tags and images, as the store publishes them openly on the web. We read only what any visitor to the store can see. We do not access the store’s admin, orders, customers or any non-public data.
- The grade we calculate, which is saved so it can be viewed again at its results link.
- A hashed version of your IP address. We use your IP address briefly to limit how often the grader can be used, and to recognise when one person grades several stores (so we can offer our agency waitlist). We store only a one-way, salted hash of it, never the address itself, and we delete the hash after 30 days.
Grade results are kept for 12 months and then deleted. Results pages can be viewed by anyone who has the link, but they are hidden from search engines.
Grades of other businesses’ stores. The grader can be used on any public Shopify store, including one you don’t own. It only ever uses product information the store publishes publicly, and it contains no personal information about that store’s customers. If you own a store and would like its grade removed, email support@listinglab.tech and we will delete it.
Visitor consent
The web pixel respects Shopify’s Customer Privacy API. Where a storefront visitor has declined analytics tracking, the pixel records nothing for that visitor. The pixel also responds to consent changes during a session.
Agency waitlist
If you join the agency waitlist, we store the email address you give us — that’s the only field the form collects. We use it only to contact you about ListingLab’s agency features. We keep it until you ask us to remove it or unsubscribe, which you can do at any time by emailing support@listinglab.tech.
If we emailed you
We sometimes email store owners and agencies directly about ListingLab. We find business contact email addresses that are publicly listed on store websites, and we may include a grade of your store’s public listings.
These are individual emails, not a mailing list. To stop hearing from us, reply “stop” to any email. We will not contact you again, and we keep your email address on a do-not-contact list solely so that we honour that request. You can ask us to delete any other information we hold about you by emailing support@listinglab.tech.
How we use data
- To score your listings and show you which ones are underperforming
- To weight those scores by commercial importance using your sales data
- To generate improved copy for listings you choose to work on
- To measure whether applied changes improved performance over time
- To send you product communications about your own store’s results, where you have not opted out
- To operate, debug and improve the service
We do not sell data. We do not share your data with third parties except the sub-processors listed below. We do not use your data to train AI models.
Analytics
On listinglab.tech, we use PostHog to count how the site and grader are used: for example, when a grade is started, completed or fails, when a results page is viewed, and when someone clicks to install the app. PostHog is configured not to set cookies or store identifiers in your browser, and not to keep your IP address.
In the Shopify app, we record product-usage events such as installation, catalog sync, viewing the audit, generating, editing, applying or reverting a suggested rewrite, reaching the free-plan limit, and subscription changes. These events are linked to the merchant’s shop, not to the shop’s customers. We use them to understand where merchants get stuck and to improve the app.
Sub-processors
| Provider | What it does for us | Data involved |
|---|---|---|
| Render | Hosts the Shopify app and its database | Merchant shop data, product data, app usage events |
| Anthropic | AI copy assessment and rewrite suggestions in the app | Product titles and descriptions sent for assessment or rewriting |
| Vercel | Hosts listinglab.tech and the grader | Website requests, grader requests |
| Neon | Database for the grader and waitlist | Graded store addresses, grade results, IP hashes, waitlist emails |
| PostHog | Usage analytics for the site and app | Usage events (no cookies or IP addresses on the site) |
| Google Workspace | Support email (support@listinglab.tech) | Emails you send us |
| Zoho Mail | Our direct outreach email | Business contact emails and replies |
When you ask ListingLab to assess or rewrite a listing, that listing’s content (title, description, tags, product type and variant options) is sent to Anthropic’s API for processing. No customer data is included. Anthropic does not use data submitted through its API to train its models.
How long we keep data
| Data | Kept for |
|---|---|
| Grader IP hashes | 30 days |
| Grade results | 12 months |
| Agency waitlist emails | Until you unsubscribe or ask us to delete them |
| Do-not-contact list | Indefinitely, only to honour opt-out requests |
| Merchant app data | Deleted on uninstall — see “Data retention and deletion” below |
Data retention and deletion
We retain your data for as long as the app is installed on your store.
When you uninstall ListingLab, all data associated with your store is permanently deleted. This includes products, scores, score history, sales aggregates, rewrite proposals, and pixel events. Pixel event staging records are additionally pruned after seven days as a matter of course.
We respond to Shopify’s mandatory data request, customer redaction, and shop redaction webhooks. Because we hold no customer personal data, a customer data request returns a statement to that effect.
Your rights
Depending on where you are located, you may have rights to access, correct, export, or delete the data we hold about you, and to object to or restrict certain processing. Contact us at support@listinglab.tech and we will respond within 30 days.
If you are in the EU or UK, our lawful basis for processing is the performance of our contract with you (providing the app) and our legitimate interest in operating and improving the service.
Security
Data is encrypted in transit (HTTPS) and at rest. Access to production systems is limited to Sistrom Tech personnel. We verify the authenticity of all webhooks received from Shopify.
Changes to this policy
We will update this page when this policy changes and revise the date at the top. Material changes will be communicated to installed merchants by email.
Contact
support@listinglab.tech
Sistrom Tech, Sydney, NSW, Australia