Privacy policy

Last updated: 20 October 2026

This policy explains how Merivirta Digital Oy (“we”) processes information when a merchant installs and uses Merivirta AI Optimizer(“the App”) in a Shopify store. Questions and requests: jere@merivirta.com.

Roles

For store data processed through the App, the merchant is the controller and we act as a processor on the merchant’s instructions. The AI in the App is provided by us: we use Anthropic (Claude) as a sub-processor under our own Anthropic account. Merchants don’t need an AI account or API key. We send content to Anthropic only when the merchant has allowed AI processing in Settings and starts a generation job.

Information we process

• Store and installation data: shop domain, access scopes, Shopify access tokens, install and uninstall times and when store updates were turned on. The App uses offline access only, so it does not store the names or emails of staff members.
• Catalog content: for the products and collections the merchant selects – title, description, SEO title, meta description, handle, vendor, product type, tags, option names and (for collections) sample product titles.
• App data: AI proposals, job progress, the keywords and notes entered for a job, the number of AI proposals used each month and token usage counts, settings (AI processing consent, language, brand voice, time format and time zone), the store’s time zone, the cached app plan and an activity log of actions taken in the App.

The App does not request access to customers, orders or other protected customer data and does not store personal data of the store’s customers. We do not use cookies for tracking.

Why we process it

• To provide the App: generate proposals, let the merchant review and edit them, apply approved changes and revert them.
• To secure and operate the service, prevent abuse and fix errors.
• To comply with legal obligations.

We do not sell data, use store content to train AI models, or use it for advertising.

AI processing (Anthropic)

When the merchant starts a generation job, the catalog content listed above for the selected products and collections, plus any keywords, brand voice and notes the merchant enters, is sent to Anthropic, PBC through the Anthropic API (model Claude) to write the proposals. We use our own Anthropic account and pay for this processing; it is included in the merchant’s plan. Anthropic processes the data under its Commercial Terms of Service and Data Processing Addendum. Under those terms Anthropic may not train models on customer content from its API services. Merchants should avoid entering personal data in product content or notes.

Sub-processors

• Shopify – platform, authentication and the Admin API.
• Render Services, Inc. – application hosting and database, in the Frankfurt (EU) region.
• Anthropic, PBC – AI processing of the catalog content described above (Claude, through the Anthropic API).

Retention and deletion

• When the App is uninstalled we immediately delete the Shopify access tokens and stop all background work.
• Shopify sends a shop redaction request 48 hours after uninstall; we then permanently delete all remaining data for the store (proposals, jobs, settings, usage counters and activity log).
• Merchants can withdraw their AI processing consent at any time in Settings (no new content is then sent to Anthropic), and can ask us to delete their data earlier by contacting us. Anthropic retains API data only as its Commercial Terms and Data Processing Addendum allow.
• Backups of the database are kept for a limited period by our hosting provider and then overwritten.

Security

Data is transferred over HTTPS. Proposal content and app documents are encrypted at rest. Access to production systems is limited to personnel who need it to operate the service. Requests from Shopify are verified with session tokens and webhook signatures.

International transfers

Anthropic may process data outside the EEA, for example in the United States. Such transfers rely on the safeguards in Anthropic’s Data Processing Addendum.

Your rights

Under the GDPR and similar laws, individuals have rights to access, rectify, erase, restrict and object to processing and to data portability, and may lodge a complaint with a supervisory authority (in Finland, the Data Protection Ombudsman, tietosuoja.fi). Requests about a store’s data should normally be directed to the merchant; we will assist the merchant. You can also contact us at jere@merivirta.com.

Changes

We will update this page when our processing changes and revise the date above.