Skip to content
IFG eCommerce IFG GEO Optimizerby IFG eCommerce®

Privacy Policy

IFG GEO Optimizer — a Shopify app for Generative Engine Optimization Last updated: October 2026

1. Data Controller

The data controller for personal data processed through IFG GEO Optimizer is:

IFG eCommerce — based in Rome, Italy Email: info@ifgecommerce.com

2. What We Collect

The app never requests or receives personal end-customer data — no names, emails or addresses — and never reads the details of any order. It asks Shopify for nine permissions, each tied to a function the app actually performs:

  • read_products — reads the catalog for the audit, the crawler simulator, FAQ drafting, content rewriting, image alt text and technical-spec extraction.
  • write_products — writes the structured-data metafields (one-click schema fix) and the FAQs, rewritten descriptions and product title, description and SEO edits that you approve or save.
  • read_themes — checks that the “GEO Schema” theme block is active, and reads the text of the theme’s Liquid files for the structured-data conflict checks and the entity-consistency check.
  • write_themes — writes the three AI-readability files (agents.md, llms.txt, llms-full.txt) as Liquid templates on the published theme when you click publish in the Catalog audit, and automatically whenever you publish a different theme (themes/publish webhook); files that already exist and were not created by the app are not overwritten without your explicit confirmation.
  • write_pixels and read_customer_events — activate and subscribe to the events of the anonymous traffic Web Pixel described above, never customer-identifying data.
  • write_files — writes the alt text of a product image (Files API) when you approve or save it, never the image itself.
  • read_online_store_pages — reads the text of Pages and blog Articles for the uncited-statistics scanner and the duplicate-content detector described above.
  • read_orders — reads the aggregate count of recent orders described above, in preparation for a future reporting feature. Never the details of an order or any customer data.

We process this data to provide the service you installed the app for — under Art. 6(1)(b) GDPR, performance of a contract: analyzing and improving your catalog’s visibility on generative search engines, including AI-assisted FAQ drafting and content rewriting, the in-app support chat, weekly AI-visibility tracking on prompts you choose, and anonymous AI-referral traffic measurement — all either merchant-initiated or, for the traffic pixel, consent-gated on your storefront.

Welcome email. After a new installation we send one single welcome email to the email address of the store owner’s Shopify account, which we read from Shopify’s Admin API at install time (the public contact email of the store is never used). We also read the store name, to address you. The email is sent by Francesco Guiducci (IFG eCommerce), thanks you for installing the app, introduces him as its freelance developer and invites you to reply with any question. It is a service message, not a newsletter or a promotion, and nothing else is sent afterwards. It is delivered through Resend (United States, Standard Contractual Clauses). Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, for the introduction, legitimate interest (Art. 6(1)(f) GDPR). You can object at any time by replying to the email, using the unsubscribe link in it, or writing to info@ifgecommerce.com. The owner’s email address is not stored in our records. What we keep after uninstall is described in section 6. The email and content already handed to Resend remain in its logs under its own retention.

Suggestions and replies. When you send a suggestion from the Support page, the text and your store domain reach our support address by email through Resend (United States, Standard Contractual Clauses). We use them to assess and improve the app, based on our legitimate interest (Art. 6(1)(f) GDPR). If you enter an email address, we use it only to reply to you, based on your request (Art. 6(1)(b) GDPR): we don’t store it in the app’s database, don’t use it for any other communication and don’t share it with anyone else. The message stays in the support mailbox for as long as needed to handle your request, and in Resend’s logs under its own retention. You can ask for it to be deleted at any time by writing to info@ifgecommerce.com.

4. How We Collect It

Account data is collected once, through Shopify’s OAuth flow, at install. Catalog data is read through Shopify’s Admin API only when you trigger an action from the dashboard. The traffic pixel runs on your storefront and reports events only after consent; nothing else runs in the background without you asking for it.

5. Who We Share It With

We don’t sell data, and we don’t use it for marketing or behavioral profiling. The welcome email described in section 3 is a service message, not marketing.

6. How Long We Keep It

7. Your Rights

Under Articles 15–22 GDPR, you can request access to your data, correction of inaccurate data, or deletion — the simplest way is to uninstall the app — or object to processing. You can also lodge a complaint with your local data protection authority. Since the app never processes personal end-customer data, the customers/data_request and customers/redact compliance webhooks respond confirming there’s nothing to export or delete.

8. Security

All traffic runs over HTTPS/TLS 1.2+. Shopify authentication tokens are never exposed to the browser. Every webhook is verified with a constant-time HMAC SHA-256 check before it’s processed. The database is reachable only from the backend, authenticated via the hosting platform’s own service identity — there are no static credentials in the code, and direct client access is denied by the database’s own security rules. Data is encrypted at rest and in transit.

9. Changes

We may update this policy from time to time. Material changes will be reflected here, with the date at the top kept current.

Questions about your data? info@ifgecommerce.com

← Back to Help Center